# Flog Txt Version 1
# Analyzer Version: 3.1.2
# Analyzer Build Date: Oct 28 2019 11:51:53
# Log Creation Date: 04.11.2019 12:14:32.707

Process:
	id = "1"
	image_name = "takeaway (2).exe"
	filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway (2).exe"
	page_root = "0x4fdc3000"
	os_pid = "0x97c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe\" "
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1
	os_tid = 0x980

	[0033.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x43f860 | out: lpSystemTimeAsFileTime=0x43f860*(dwLowDateTime=0x7cbb6bc0, dwHighDateTime=0x1d59309)) 
	[0033.964] GetCurrentThreadId () returned 0x980
	[0033.964] GetCurrentProcessId () returned 0x97c
	[0033.964] QueryPerformanceCounter (in: lpPerformanceCount=0x43f858 | out: lpPerformanceCount=0x43f858*=15389546180) returned 1
	[0033.988] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
	[0033.988] LoadLibraryExW (lpLibFileName="<pi-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0033.988] GetLastError () returned 0x57
	[0033.988] LoadLibraryExW (lpLibFileName="<pi-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x0
	[0033.989] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0033.989] GetLastError () returned 0x57
	[0033.989] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000
	[0033.990] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28
	[0033.990] LoadLibraryExW (lpLibFileName="<pi-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0033.990] GetLastError () returned 0x57
	[0033.990] LoadLibraryExW (lpLibFileName="<pi-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0033.991] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b
	[0033.991] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208
	[0033.991] LoadLibraryExW (lpLibFileName="<pi-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0033.991] GetLastError () returned 0x57
	[0033.991] LoadLibraryExW (lpLibFileName="<pi-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x0
	[0033.992] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0033.992] GetLastError () returned 0x57
	[0033.992] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000
	[0033.992] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28
	[0033.993] GetProcessHeap () returned 0x4f0000
	[0033.993] LoadLibraryExW (lpLibFileName="<pi-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0033.993] GetLastError () returned 0x57
	[0033.993] LoadLibraryExW (lpLibFileName="<pi-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0033.994] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b
	[0033.994] GetLastError () returned 0x7e
	[0033.994] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252
	[0033.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x364) returned 0x4fef38
	[0033.994] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208
	[0033.994] SetLastError (dwErrCode=0x7e) 
	[0033.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc00) returned 0x4ff2a8
	[0033.996] GetStartupInfoW (in: lpStartupInfo=0x43f788 | out: lpStartupInfo=0x43f788*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xef0140, hStdOutput=0xe894561a, hStdError=0xfffffffe)) 
	[0033.996] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0033.996] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0033.996] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0033.996] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe\" "
	[0033.996] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe\" "
	[0033.996] GetLastError () returned 0x7e
	[0033.996] SetLastError (dwErrCode=0x7e) 
	[0033.996] GetLastError () returned 0x7e
	[0033.996] SetLastError (dwErrCode=0x7e) 
	[0033.996] GetACP () returned 0x4e4
	[0033.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x220) returned 0x5006b0
	[0033.996] IsValidCodePage (CodePage=0x4e4) returned 1
	[0033.997] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x43f7b8 | out: lpCPInfo=0x43f7b8) returned 1
	[0033.997] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x43f080 | out: lpCPInfo=0x43f080) returned 1
	[0033.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x43f694, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0033.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x43f694, cbMultiByte=256, lpWideCharStr=0x43ee18, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0033.997] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x43f094 | out: lpCharType=0x43f094) returned 1
	[0033.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x43f694, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0033.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x43f694, cbMultiByte=256, lpWideCharStr=0x43edc8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0033.997] LoadLibraryExW (lpLibFileName="<pi-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0033.997] GetLastError () returned 0x57
	[0033.997] LoadLibraryExW (lpLibFileName="<pi-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0034.005] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1
	[0034.006] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0034.006] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x43ebb8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256
	[0034.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x43f594, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x02!'èÐ÷C", lpUsedDefaultChar=0x0) returned 256
	[0034.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x43f694, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0034.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x43f694, cbMultiByte=256, lpWideCharStr=0x43ede8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256
	[0034.006] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0034.006] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x43ebd8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256
	[0034.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x43f494, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x02!'èÐ÷C", lpUsedDefaultChar=0x0) returned 256
	[0034.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x5008d8
	[0034.006] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xf28c98, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway (2).exe")) returned 0x36
	[0034.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x3f) returned 0x500960
	[0034.006] RtlInitializeSListHead (in: ListHead=0xf28890 | out: ListHead=0xf28890) 
	[0034.006] GetLastError () returned 0x0
	[0034.006] SetLastError (dwErrCode=0x0) 
	[0034.006] GetEnvironmentStringsW () returned 0x5009a8*
	[0034.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x565) returned 0x501480
	[0034.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x501480, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381
	[0034.007] FreeEnvironmentStringsW (penv=0x5009a8) returned 1
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x98) returned 0x5019f0
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x1f) returned 0x500120
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x36) returned 0x501a90
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x37) returned 0x501ad0
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x3c) returned 0x501b10
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x31) returned 0x501b58
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x17) returned 0x501b98
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x24) returned 0x501bb8
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x14) returned 0x501be8
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xd) returned 0x501c08
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x25) returned 0x501c20
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x39) returned 0x501c50
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x18) returned 0x501c98
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x17) returned 0x501cb8
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xe) returned 0x501cd8
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x69) returned 0x501cf0
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x3e) returned 0x501d68
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x1b) returned 0x500148
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x1d) returned 0x500170
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x48) returned 0x501db0
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x12) returned 0x501e00
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x18) returned 0x501e20
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x1b) returned 0x500198
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x24) returned 0x501e40
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x29) returned 0x501e70
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x1e) returned 0x5001c0
	[0034.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x41) returned 0x501ea8
	[0034.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x17) returned 0x501ef8
	[0034.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xf) returned 0x501f18
	[0034.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x16) returned 0x501f30
	[0034.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x2a) returned 0x501f50
	[0034.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x29) returned 0x501f88
	[0034.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x15) returned 0x501fc0
	[0034.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x1e) returned 0x5001e8
	[0034.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x2a) returned 0x5009a8
	[0034.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x12) returned 0x5009e0
	[0034.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x18) returned 0x500a00
	[0034.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x46) returned 0x500a20
	[0034.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501480 | out: hHeap=0x4f0000) returned 1
	[0034.008] QueryPerformanceFrequency (in: lpFrequency=0x43f810 | out: lpFrequency=0x43f810*=100000000) returned 1
	[0034.009] QueryPerformanceCounter (in: lpPerformanceCount=0x43f808 | out: lpPerformanceCount=0x43f808*=15391770402) returned 1
	[0034.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x800) returned 0x500a70
	[0034.010] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
	[0034.010] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xeed30f) returned 0x0
	[0034.010] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x43f7fc | out: lpCPInfo=0x43f7fc) returned 1
	[0034.016] GetCurrentProcess () returned 0xffffffff
	[0034.016] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x43f7c0, lpSystemAffinityMask=0x43f7bc | out: lpProcessAffinityMask=0x43f7c0, lpSystemAffinityMask=0x43f7bc) returned 1
	[0034.016] GetCurrentProcess () returned 0xffffffff
	[0034.017] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x43f7d4, lpSystemAffinityMask=0x43f7d0 | out: lpProcessAffinityMask=0x43f7d4, lpSystemAffinityMask=0x43f7d0) returned 1
	[0034.017] GetStartupInfoW (in: lpStartupInfo=0x43f7f0 | out: lpStartupInfo=0x43f7f0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0034.018] GetModuleHandleW (lpModuleName="kernel32") returned 0x76c20000
	[0034.018] GetProcAddress (hModule=0x76c20000, lpProcName="SetDllDirectoryW") returned 0x76cb004f
	[0034.018] SetDllDirectoryW (lpPathName="") returned 1
	[0034.019] GetProcAddress (hModule=0x76c20000, lpProcName="SetDefaultDllDirectories") returned 0x0
	[0034.019] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x43468c, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway (2).exe")) returned 0x36
	[0034.019] GetVersionExW (in: lpVersionInformation=0x43425c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x370cc5, dwMinorVersion=0xfffffffe, dwBuildNumber=0x7716019b, dwPlatformId=0x771602ea, szCSDVersion="⤘O䋊C") | out: lpVersionInformation=0x43425c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0034.019] GetSystemDirectoryW (in: lpBuffer=0x43336c, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0034.019] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\version.dll") returned 0x74b60000
	[0034.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="version.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3
	[0034.449] GetSystemDirectoryW (in: lpBuffer=0x43336c, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0034.449] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\DXGIDebug.dll") returned 0x0
	[0034.449] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DXGIDebug.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dxgidebug.dll")) returned 0xffffffff
	[0034.449] GetSystemDirectoryW (in: lpBuffer=0x43336c, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0034.449] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\sfc_os.dll") returned 0x74b50000
	[0034.528] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="sfc_os.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3
	[0034.528] GetSystemDirectoryW (in: lpBuffer=0x43336c, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0034.528] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\SSPICLI.DLL") returned 0x74c90000
	[0035.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="SSPICLI.DLL", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3
	[0035.811] GetSystemDirectoryW (in: lpBuffer=0x43336c, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0035.811] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\rsaenh.dll") returned 0x74b10000
	[0035.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="rsaenh.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3
	[0035.959] GetSystemDirectoryW (in: lpBuffer=0x43336c, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0035.959] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\UXTheme.dll") returned 0x745e0000
	[0039.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="UXTheme.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3
	[0039.610] GetSystemDirectoryW (in: lpBuffer=0x43336c, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0039.610] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\dwmapi.dll") returned 0x745c0000
	[0039.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="dwmapi.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 1
	[0039.812] GetSystemDirectoryW (in: lpBuffer=0x43336c, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0039.812] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\cryptbase.dll") returned 0x74c80000
	[0039.813] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="cryptbase.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 1
	[0039.813] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lpk.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lpk.dll")) returned 0xffffffff
	[0039.813] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\usp10.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\usp10.dll")) returned 0xffffffff
	[0039.813] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\clbcatq.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\clbcatq.dll")) returned 0xffffffff
	[0039.813] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\comres.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\comres.dll")) returned 0xffffffff
	[0039.813] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ws2_32.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ws2_32.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ws2help.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ws2help.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\psapi.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\psapi.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ieframe.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ieframe.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ntshrui.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ntshrui.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\atl.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\atl.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\setupapi.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\setupapi.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\apphelp.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\apphelp.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\userenv.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\userenv.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\netapi32.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\netapi32.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\shdocvw.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\shdocvw.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\crypt32.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\crypt32.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\msasn1.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\msasn1.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cryptui.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cryptui.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wintrust.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wintrust.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\shell32.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\shell32.dll")) returned 0xffffffff
	[0039.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\secur32.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\secur32.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cabinet.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cabinet.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oleaccrc.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oleaccrc.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ntmarta.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ntmarta.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\profapi.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\profapi.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WindowsCodecs.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\windowscodecs.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\srvcli.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srvcli.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cscapi.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cscapi.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\slc.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\slc.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imageres.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\imageres.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dnsapi.DLL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dnsapi.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\iphlpapi.DLL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iphlpapi.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WINNSI.DLL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winnsi.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\netutils.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\netutils.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mpr.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mpr.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\devrtl.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\devrtl.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\propsys.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\propsys.dll")) returned 0xffffffff
	[0039.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mlang.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mlang.dll")) returned 0xffffffff
	[0039.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\samcli.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\samcli.dll")) returned 0xffffffff
	[0039.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\samlib.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\samlib.dll")) returned 0xffffffff
	[0039.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wkscli.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wkscli.dll")) returned 0xffffffff
	[0039.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dfscli.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dfscli.dll")) returned 0xffffffff
	[0039.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\browcli.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\browcli.dll")) returned 0xffffffff
	[0039.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rasadhlp.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rasadhlp.dll")) returned 0xffffffff
	[0039.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dhcpcsvc6.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dhcpcsvc6.dll")) returned 0xffffffff
	[0039.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dhcpcsvc.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dhcpcsvc.dll")) returned 0xffffffff
	[0039.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XmlLite.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmllite.dll")) returned 0xffffffff
	[0039.817] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\linkinfo.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\linkinfo.dll")) returned 0xffffffff
	[0039.817] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cryptsp.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cryptsp.dll")) returned 0xffffffff
	[0039.817] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RpcRtRemote.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rpcrtremote.dll")) returned 0xffffffff
	[0039.817] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aclui.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\aclui.dll")) returned 0xffffffff
	[0039.817] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dsrole.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dsrole.dll")) returned 0xffffffff
	[0039.817] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\peerdist.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\peerdist.dll")) returned 0xffffffff
	[0039.817] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x755e0000
	[0040.951] GetProcAddress (hModule=0x755e0000, lpProcName="OleInitialize") returned 0x755fefd7
	[0040.951] OleInitialize (pvReserved=0x0) returned 0x0
	[0040.982] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x43f740 | out: lpCPInfo=0x43f740) returned 1
	[0040.983] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe\" "
	[0040.984] SetEnvironmentVariableW (lpName="sfxcmd", lpValue="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe\" ") returned 1
	[0040.984] SetEnvironmentVariableW (lpName="sfxpar", lpValue="") returned 1
	[0040.984] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xf247f0, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway (2).exe")) returned 0x36
	[0040.984] SetEnvironmentVariableW (lpName="sfxname", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe") returned 1
	[0040.984] GetLocalTime (in: lpSystemTime=0x43f76c | out: lpSystemTime=0x43f76c*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x1, wDay=0x4, wHour=0x17, wMinute=0xf, wSecond=0x4, wMilliseconds=0x215)) 
	[0040.984] GetLastError () returned 0x0
	[0040.984] SetLastError (dwErrCode=0x0) 
	[0040.985] SetEnvironmentVariableW (lpName="sfxstime", lpValue="2019-11-04-23-15-04-533") returned 1
	[0040.985] GetModuleHandleW (lpModuleName=0x0) returned 0xed0000
	[0040.985] LoadLibraryExA (lpLibFileName="USER32.dll", hFile=0x0, dwFlags=0x0) returned 0x74f40000
	[0040.985] GetProcAddress (hModule=0x74f40000, lpProcName="LoadIconW") returned 0x74f5b142
	[0040.985] LoadIconW (hInstance=0xed0000, lpIconName=0x64) returned 0xd01c3
	[0040.989] GetProcAddress (hModule=0x74f40000, lpProcName="LoadBitmapW") returned 0x74f68b72
	[0040.990] LoadBitmapW (hInstance=0xed0000, lpBitmapName=0x65) returned 0xf05027f
	[0040.991] GetSystemDirectoryW (in: lpBuffer=0x43e73c, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0040.991] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\riched20.dll") returned 0x74a90000
	[0041.342] OleInitialize (pvReserved=0x0) returned 0x1
	[0041.342] LoadLibraryExA (lpLibFileName="COMCTL32.dll", hFile=0x0, dwFlags=0x0) returned 0x748f0000
	[0042.643] GetProcAddress (hModule=0x748f0000, lpProcName="InitCommonControlsEx") returned 0x749109ce
	[0042.643] InitCommonControlsEx (picce=0x43f74c) returned 1
	[0042.644] LoadLibraryExA (lpLibFileName="SHELL32.dll", hFile=0x0, dwFlags=0x0) returned 0x75fd0000
	[0044.912] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetMalloc") returned 0x75ff0602
	[0044.912] SHGetMalloc (in: ppMalloc=0xf120d8 | out: ppMalloc=0xf120d8*=0x757266bc) returned 0x0
	[0044.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway (2).exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xc4
	[0044.914] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x0
	[0044.914] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.915] SetFilePointer (in: hFile=0xc4, lDistanceToMove=8176, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x1ff0
	[0044.916] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x1ff0
	[0044.916] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.916] SetFilePointer (in: hFile=0xc4, lDistanceToMove=16352, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x3fe0
	[0044.916] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x3fe0
	[0044.916] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.916] SetFilePointer (in: hFile=0xc4, lDistanceToMove=24528, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x5fd0
	[0044.916] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x5fd0
	[0044.916] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.916] SetFilePointer (in: hFile=0xc4, lDistanceToMove=32704, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x7fc0
	[0044.916] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x7fc0
	[0044.916] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.917] SetFilePointer (in: hFile=0xc4, lDistanceToMove=40880, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x9fb0
	[0044.917] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x9fb0
	[0044.917] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.917] SetFilePointer (in: hFile=0xc4, lDistanceToMove=49056, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0xbfa0
	[0044.917] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0xbfa0
	[0044.917] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.917] SetFilePointer (in: hFile=0xc4, lDistanceToMove=57232, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0xdf90
	[0044.917] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0xdf90
	[0044.917] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.917] SetFilePointer (in: hFile=0xc4, lDistanceToMove=65408, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0xff80
	[0044.917] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0xff80
	[0044.918] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.918] SetFilePointer (in: hFile=0xc4, lDistanceToMove=73584, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x11f70
	[0044.918] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x11f70
	[0044.918] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.918] SetFilePointer (in: hFile=0xc4, lDistanceToMove=81760, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x13f60
	[0044.918] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x13f60
	[0044.918] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.918] SetFilePointer (in: hFile=0xc4, lDistanceToMove=89936, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x15f50
	[0044.918] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x15f50
	[0044.918] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.919] SetFilePointer (in: hFile=0xc4, lDistanceToMove=98112, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x17f40
	[0044.919] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x17f40
	[0044.919] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.919] SetFilePointer (in: hFile=0xc4, lDistanceToMove=106288, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x19f30
	[0044.919] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x19f30
	[0044.919] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.919] SetFilePointer (in: hFile=0xc4, lDistanceToMove=114464, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x1bf20
	[0044.919] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x1bf20
	[0044.919] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.919] SetFilePointer (in: hFile=0xc4, lDistanceToMove=122640, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x1df10
	[0044.919] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x1df10
	[0044.919] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.919] SetFilePointer (in: hFile=0xc4, lDistanceToMove=130816, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x1ff00
	[0044.920] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x1ff00
	[0044.920] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.920] SetFilePointer (in: hFile=0xc4, lDistanceToMove=138992, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x21ef0
	[0044.920] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x21ef0
	[0044.920] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.920] SetFilePointer (in: hFile=0xc4, lDistanceToMove=147168, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x23ee0
	[0044.920] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x23ee0
	[0044.920] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.920] SetFilePointer (in: hFile=0xc4, lDistanceToMove=155344, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x25ed0
	[0044.920] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x25ed0
	[0044.920] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.920] SetFilePointer (in: hFile=0xc4, lDistanceToMove=163520, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x27ec0
	[0044.920] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x27ec0
	[0044.920] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.921] SetFilePointer (in: hFile=0xc4, lDistanceToMove=171696, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x29eb0
	[0044.921] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x29eb0
	[0044.921] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.921] SetFilePointer (in: hFile=0xc4, lDistanceToMove=179872, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x2bea0
	[0044.921] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x2bea0
	[0044.921] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.921] SetFilePointer (in: hFile=0xc4, lDistanceToMove=188048, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x2de90
	[0044.921] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x2de90
	[0044.921] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.921] SetFilePointer (in: hFile=0xc4, lDistanceToMove=196224, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x2fe80
	[0044.921] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x2fe80
	[0044.921] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.922] SetFilePointer (in: hFile=0xc4, lDistanceToMove=204400, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x31e70
	[0044.922] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x31e70
	[0044.922] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.922] SetFilePointer (in: hFile=0xc4, lDistanceToMove=212576, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x33e60
	[0044.922] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x33e60
	[0044.922] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.922] SetFilePointer (in: hFile=0xc4, lDistanceToMove=220752, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x35e50
	[0044.922] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x35e50
	[0044.922] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.922] SetFilePointer (in: hFile=0xc4, lDistanceToMove=228928, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x37e40
	[0044.922] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x37e40
	[0044.922] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.922] SetFilePointer (in: hFile=0xc4, lDistanceToMove=237104, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x39e30
	[0044.923] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x39e30
	[0044.923] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.923] SetFilePointer (in: hFile=0xc4, lDistanceToMove=245280, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x3be20
	[0044.923] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x3be20
	[0044.923] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.923] SetFilePointer (in: hFile=0xc4, lDistanceToMove=253456, lpDistanceToMoveHigh=0x43b6d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x43b6d8*=0) returned 0x3de10
	[0044.923] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x43b6e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x43b6e8*=0) returned 0x3de10
	[0044.923] ReadFile (in: hFile=0xc4, lpBuffer=0x43c6fc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x43b6b8, lpOverlapped=0x0 | out: lpBuffer=0x43c6fc*, lpNumberOfBytesRead=0x43b6b8*=0x2000, lpOverlapped=0x0) returned 1
	[0044.923] CloseHandle (hObject=0xc4) returned 1
	[0044.924] GetModuleHandleW (lpModuleName=0x0) returned 0xed0000
	[0044.924] FindResourceW (hModule=0xed0000, lpName="RTL", lpType=0x5) returned 0x0
	[0044.924] GetProcAddress (hModule=0x74f40000, lpProcName="DialogBoxParamW") returned 0x74f7cfca
	[0044.924] DialogBoxParamW (hInstance=0xed0000, lpTemplateName="STARTDLG", hWndParent=0x0, lpDialogFunc=0xee939b, dwInitParam=0x0) returned 0x1
	[0045.036] GetProcAddress (hModule=0x74f40000, lpProcName="GetWindowRect") returned 0x74f57f34
	[0045.036] GetWindowRect (in: hWnd=0x301bc, lpRect=0x434ee0 | out: lpRect=0x434ee0) returned 1
	[0045.036] GetProcAddress (hModule=0x74f40000, lpProcName="GetClientRect") returned 0x74f60c62
	[0045.036] GetClientRect (in: hWnd=0x301bc, lpRect=0x434f00 | out: lpRect=0x434f00) returned 1
	[0045.036] GetProcAddress (hModule=0x74f40000, lpProcName="GetWindowTextW") returned 0x74f6205e
	[0045.036] GetWindowTextW (in: hWnd=0x301bc, lpString=0x434f10, nMaxCount=1024 | out: lpString="WinRAR self-extracting archive") returned 30
	[0045.037] GetProcAddress (hModule=0x74f40000, lpProcName="SetWindowTextW") returned 0x74f620ec
	[0045.037] SetWindowTextW (hWnd=0x301bc, lpString="WinRAR self-extracting archive") returned 1
	[0045.038] GetProcAddress (hModule=0x74f40000, lpProcName="GetSystemMetrics") returned 0x74f57d2f
	[0045.039] GetSystemMetrics (nIndex=8) returned 3
	[0045.039] GetProcAddress (hModule=0x74f40000, lpProcName="GetWindow") returned 0x74f5926e
	[0045.039] GetWindow (hWnd=0x301bc, uCmd=0x5) returned 0x501ba
	[0045.039] GetWindowTextW (in: hWnd=0x501ba, lpString=0x434f10, nMaxCount=1024 | out: lpString="") returned 0
	[0045.039] GetWindow (hWnd=0x501ba, uCmd=0x2) returned 0x301ca
	[0045.039] GetWindowTextW (in: hWnd=0x301ca, lpString=0x434f10, nMaxCount=1024 | out: lpString="&Destination folder") returned 19
	[0045.039] SetWindowTextW (hWnd=0x301ca, lpString="&Destination folder") returned 1
	[0045.039] GetWindow (hWnd=0x301ca, uCmd=0x2) returned 0x201fa
	[0045.039] GetWindowTextW (in: hWnd=0x201fa, lpString=0x434f10, nMaxCount=1024 | out: lpString="") returned 0
	[0045.039] GetWindow (hWnd=0x201fa, uCmd=0x2) returned 0x201ce
	[0045.039] GetWindowTextW (in: hWnd=0x201ce, lpString=0x434f10, nMaxCount=1024 | out: lpString="Bro&wse...") returned 10
	[0045.040] SetWindowTextW (hWnd=0x201ce, lpString="Bro&wse...") returned 1
	[0045.040] GetWindow (hWnd=0x201ce, uCmd=0x2) returned 0x401ec
	[0045.040] GetWindowTextW (in: hWnd=0x401ec, lpString=0x434f10, nMaxCount=1024 | out: lpString="") returned 0
	[0045.044] GetWindow (hWnd=0x401ec, uCmd=0x2) returned 0x201f4
	[0045.044] GetWindowTextW (in: hWnd=0x201f4, lpString=0x434f10, nMaxCount=1024 | out: lpString="") returned 0
	[0045.044] GetWindow (hWnd=0x201f4, uCmd=0x2) returned 0x201f6
	[0045.044] GetWindowTextW (in: hWnd=0x201f6, lpString=0x434f10, nMaxCount=1024 | out: lpString="Installation progress") returned 21
	[0045.044] SetWindowTextW (hWnd=0x201f6, lpString="Installation progress") returned 1
	[0045.044] GetWindow (hWnd=0x201f6, uCmd=0x2) returned 0x201e8
	[0045.044] GetWindowTextW (in: hWnd=0x201e8, lpString=0x434f10, nMaxCount=1024 | out: lpString="") returned 0
	[0045.044] GetWindow (hWnd=0x201e8, uCmd=0x2) returned 0x201ea
	[0045.044] GetWindowTextW (in: hWnd=0x201ea, lpString=0x434f10, nMaxCount=1024 | out: lpString="") returned 0
	[0045.044] GetWindow (hWnd=0x201ea, uCmd=0x2) returned 0x201e4
	[0045.044] GetWindowTextW (in: hWnd=0x201e4, lpString=0x434f10, nMaxCount=1024 | out: lpString="Install") returned 7
	[0045.044] SetWindowTextW (hWnd=0x201e4, lpString="Install") returned 1
	[0045.044] GetWindow (hWnd=0x201e4, uCmd=0x2) returned 0x201e6
	[0045.044] GetWindowTextW (in: hWnd=0x201e6, lpString=0x434f10, nMaxCount=1024 | out: lpString="Cancel") returned 6
	[0045.044] SetWindowTextW (hWnd=0x201e6, lpString="Cancel") returned 1
	[0045.044] GetWindow (hWnd=0x201e6, uCmd=0x2) returned 0x0
	[0045.045] GetProcAddress (hModule=0x74f40000, lpProcName="SendMessageW") returned 0x74f59679
	[0045.045] SendMessageW (hWnd=0x301bc, Msg=0x80, wParam=0x1, lParam=0xd01c3) returned 0x0
	[0045.064] GetProcAddress (hModule=0x74f40000, lpProcName="SendDlgItemMessageW") returned 0x74f7d0f5
	[0045.064] SendDlgItemMessageW (hDlg=0x301bc, nIDDlgItem=108, Msg=0x172, wParam=0x0, lParam=0xf05027f) returned 0x0
	[0045.072] GetProcAddress (hModule=0x74f40000, lpProcName="GetDC") returned 0x74f572c4
	[0045.072] GetDC (hWnd=0x0) returned 0x101084d
	[0045.072] LoadLibraryExA (lpLibFileName="GDI32.dll", hFile=0x0, dwFlags=0x0) returned 0x75ad0000
	[0045.072] GetProcAddress (hModule=0x75ad0000, lpProcName="GetDeviceCaps") returned 0x75ae4de0
	[0045.072] GetDeviceCaps (hdc=0x101084d, index=88) returned 96
	[0045.072] GetProcAddress (hModule=0x74f40000, lpProcName="ReleaseDC") returned 0x74f57446
	[0045.072] ReleaseDC (hWnd=0x0, hDC=0x101084d) returned 1
	[0045.072] GetDC (hWnd=0x0) returned 0x101084d
	[0045.072] GetDeviceCaps (hdc=0x101084d, index=90) returned 96
	[0045.072] ReleaseDC (hWnd=0x0, hDC=0x101084d) returned 1
	[0045.072] GetProcAddress (hModule=0x74f40000, lpProcName="GetDlgItem") returned 0x74f7f1ba
	[0045.072] GetDlgItem (hDlg=0x301bc, nIDDlgItem=104) returned 0x401ec
	[0045.072] SendMessageW (hWnd=0x401ec, Msg=0x435, wParam=0x0, lParam=0x400000) returned 0x0
	[0045.072] GetCurrentDirectoryW (in: nBufferLength=0x800, lpBuffer=0x43e28c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0045.072] GetProcAddress (hModule=0x74f40000, lpProcName="GetDlgItem") returned 0x74f7f1ba
	[0045.073] GetDlgItem (hDlg=0x301bc, nIDDlgItem=102) returned 0x201fa
	[0045.073] SetWindowTextW (hWnd=0x201fa, lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0045.079] GetProcAddress (hModule=0x74f40000, lpProcName="GetClassNameW") returned 0x74f582a9
	[0045.079] GetClassNameW (in: hWnd=0x201fa, lpClassName=0x435698, nMaxCount=80 | out: lpClassName="ComboBox") returned 8
	[0045.079] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="ComboBox", cchCount1=-1, lpString2="EDIT", cchCount2=-1) returned 1
	[0045.079] GetProcAddress (hModule=0x74f40000, lpProcName="FindWindowExW") returned 0x74f7f588
	[0045.079] FindWindowExW (hWndParent=0x201fa, hWndChildAfter=0x0, lpszClass="EDIT", lpszWindow=0x0) returned 0x301cc
	[0045.079] LoadLibraryExA (lpLibFileName="SHLWAPI.dll", hFile=0x0, dwFlags=0x0) returned 0x75340000
	[0045.080] GetProcAddress (hModule=0x75340000, lpProcName="SHAutoComplete") returned 0x75369353
	[0045.085] SHAutoComplete (hwndEdit=0x301cc, dwFlags=0x10) returned 0x0
	[0046.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10c0) returned 0x51c928
	[0046.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10c0) returned 0x51d9f0
	[0046.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72b0) returned 0x51eab8
	[0046.678] GetCurrentProcess () returned 0xffffffff
	[0046.678] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x42d958, lpSystemAffinityMask=0x42d954 | out: lpProcessAffinityMask=0x42d958, lpSystemAffinityMask=0x42d954) returned 1
	[0046.678] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway (2).exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x124
	[0046.679] ReadFile (in: hFile=0x124, lpBuffer=0x42fbb8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x42d92c, lpOverlapped=0x0 | out: lpBuffer=0x42fbb8*, lpNumberOfBytesRead=0x42d92c*=0x7, lpOverlapped=0x0) returned 1
	[0046.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x200000) returned 0x3270020
	[0046.679] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x42d95c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x42d95c*=0) returned 0x7
	[0046.679] ReadFile (in: hFile=0x124, lpBuffer=0x3270020, nNumberOfBytesToRead=0x1ffff0, lpNumberOfBytesRead=0x42d92c, lpOverlapped=0x0 | out: lpBuffer=0x3270020*, lpNumberOfBytesRead=0x42d92c*=0x4fb5a, lpOverlapped=0x0) returned 1
	[0046.708] SetFilePointer (in: hFile=0x124, lDistanceToMove=259584, lpDistanceToMoveHigh=0x42d94c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x42d94c*=0) returned 0x3f600
	[0046.708] ReadFile (in: hFile=0x124, lpBuffer=0x42fbb8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x42d92c, lpOverlapped=0x0 | out: lpBuffer=0x42fbb8*, lpNumberOfBytesRead=0x42d92c*=0x7, lpOverlapped=0x0) returned 1
	[0046.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3270020 | out: hHeap=0x4f0000) returned 1
	[0046.720] ReadFile (in: hFile=0x124, lpBuffer=0x42fbbf, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x42d92c, lpOverlapped=0x0 | out: lpBuffer=0x42fbbf*, lpNumberOfBytesRead=0x42d92c*=0x1, lpOverlapped=0x0) returned 1
	[0046.720] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x42d950*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x42d950*=0) returned 0x3f608
	[0046.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x518dc0
	[0046.720] ReadFile (in: hFile=0x124, lpBuffer=0x518dc0, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x42b814, lpOverlapped=0x0 | out: lpBuffer=0x518dc0*, lpNumberOfBytesRead=0x42b814*=0x7, lpOverlapped=0x0) returned 1
	[0046.720] ReadFile (in: hFile=0x124, lpBuffer=0x518dc7, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x42b810, lpOverlapped=0x0 | out: lpBuffer=0x518dc7*, lpNumberOfBytesRead=0x42b810*=0xa, lpOverlapped=0x0) returned 1
	[0046.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518dc0 | out: hHeap=0x4f0000) returned 1
	[0046.720] SetFilePointer (in: hFile=0x124, lDistanceToMove=259609, lpDistanceToMoveHigh=0x42d948*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x42d948*=0) returned 0x3f619
	[0046.720] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x42d95c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x42d95c*=0) returned 0x3f619
	[0046.720] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x42d950*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x42d950*=0) returned 0x3f619
	[0046.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x518dc0
	[0046.720] ReadFile (in: hFile=0x124, lpBuffer=0x518dc0, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x42b814, lpOverlapped=0x0 | out: lpBuffer=0x518dc0*, lpNumberOfBytesRead=0x42b814*=0x7, lpOverlapped=0x0) returned 1
	[0046.720] ReadFile (in: hFile=0x124, lpBuffer=0x518dc7, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x42b810, lpOverlapped=0x0 | out: lpBuffer=0x518dc7*, lpNumberOfBytesRead=0x42b810*=0x11, lpOverlapped=0x0) returned 1
	[0046.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518dc0 | out: hHeap=0x4f0000) returned 1
	[0046.721] SetFilePointer (in: hFile=0x124, lDistanceToMove=259787, lpDistanceToMoveHigh=0x42d948*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x42d948*=0) returned 0x3f6cb
	[0046.721] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x42d950*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x42d950*=0) returned 0x3f6cb
	[0046.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x518dc0
	[0046.721] ReadFile (in: hFile=0x124, lpBuffer=0x518dc0, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x42b814, lpOverlapped=0x0 | out: lpBuffer=0x518dc0*, lpNumberOfBytesRead=0x42b814*=0x7, lpOverlapped=0x0) returned 1
	[0046.721] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x518dc0, Size=0x48) returned 0x525d70
	[0046.721] ReadFile (in: hFile=0x124, lpBuffer=0x525d77, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x42b810, lpOverlapped=0x0 | out: lpBuffer=0x525d77*, lpNumberOfBytesRead=0x42b810*=0x26, lpOverlapped=0x0) returned 1
	[0046.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525d70 | out: hHeap=0x4f0000) returned 1
	[0046.721] SetFilePointer (in: hFile=0x124, lDistanceToMove=259609, lpDistanceToMoveHigh=0x42d938*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x42d938*=0) returned 0x3f619
	[0046.721] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x42d97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x42d97c*=0) returned 0x3f619
	[0046.721] SetFilePointer (in: hFile=0x124, lDistanceToMove=259609, lpDistanceToMoveHigh=0x42d968*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x42d968*=0) returned 0x3f619
	[0046.721] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x42d958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x42d958*=0) returned 0x3f619
	[0046.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x518dc0
	[0046.721] ReadFile (in: hFile=0x124, lpBuffer=0x518dc0, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x42b81c, lpOverlapped=0x0 | out: lpBuffer=0x518dc0*, lpNumberOfBytesRead=0x42b81c*=0x7, lpOverlapped=0x0) returned 1
	[0046.721] ReadFile (in: hFile=0x124, lpBuffer=0x518dc7, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x42b818, lpOverlapped=0x0 | out: lpBuffer=0x518dc7*, lpNumberOfBytesRead=0x42b818*=0x11, lpOverlapped=0x0) returned 1
	[0046.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518dc0 | out: hHeap=0x4f0000) returned 1
	[0046.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8003) returned 0x525d70
	[0046.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8003) returned 0x52dd80
	[0046.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b8) returned 0x535d90
	[0046.724] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x128
	[0046.724] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x12c
	[0046.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x535f50
	[0046.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9a) returned 0x575f58
	[0046.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb54) returned 0x576000
	[0046.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x576b60
	[0046.730] ReadFile (in: hFile=0x124, lpBuffer=0x576b60, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x41f1b8, lpOverlapped=0x0 | out: lpBuffer=0x576b60*, lpNumberOfBytesRead=0x41f1b8*=0x9a, lpOverlapped=0x0) returned 1
	[0046.730] GetProcAddress (hModule=0x74f40000, lpProcName="PeekMessageW") returned 0x74f605ba
	[0046.730] PeekMessageW (in: lpMsg=0x41f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x41f1c0) returned 1
	[0046.731] GetProcAddress (hModule=0x74f40000, lpProcName="GetMessageW") returned 0x74f578e2
	[0046.731] GetMessageW (in: lpMsg=0x41f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x41f1c0) returned 1
	[0046.731] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateMessage") returned 0x74f57809
	[0046.731] TranslateMessage (lpMsg=0x41f1c0) returned 0
	[0046.731] GetProcAddress (hModule=0x74f40000, lpProcName="DispatchMessageW") returned 0x74f5787b
	[0046.732] DispatchMessageW (lpMsg=0x41f1c0) returned 0x0
	[0046.732] SetThreadExecutionState (esFlags=0x1) returned 0x80000000
	[0046.732] PeekMessageW (in: lpMsg=0x41f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x41f1c0) returned 0
	[0046.732] SetThreadExecutionState (esFlags=0x1) returned 0x80000000
	[0046.732] PeekMessageW (in: lpMsg=0x41f1b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x41f1b8) returned 0
	[0046.732] SetThreadExecutionState (esFlags=0x1) returned 0x80000000
	[0046.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576b60 | out: hHeap=0x4f0000) returned 1
	[0046.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x535f50 | out: hHeap=0x4f0000) returned 1
	[0046.732] ReleaseSemaphore (in: hSemaphore=0x128, lReleaseCount=32, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1
	[0046.732] CloseHandle (hObject=0x128) returned 1
	[0046.732] CloseHandle (hObject=0x12c) returned 1
	[0046.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x535d90 | out: hHeap=0x4f0000) returned 1
	[0046.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd80 | out: hHeap=0x4f0000) returned 1
	[0046.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525d70 | out: hHeap=0x4f0000) returned 1
	[0046.732] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x575f58, Size=0xe0) returned 0x576b60
	[0046.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x136) returned 0x576c48
	[0046.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576b60 | out: hHeap=0x4f0000) returned 1
	[0046.732] SetFilePointer (in: hFile=0x124, lDistanceToMove=259609, lpDistanceToMoveHigh=0x42d958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x42d958*=0) returned 0x3f619
	[0046.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x134) returned 0x576d88
	[0046.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576c48 | out: hHeap=0x4f0000) returned 1
	[0046.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51eab8 | out: hHeap=0x4f0000) returned 1
	[0046.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51c928 | out: hHeap=0x4f0000) returned 1
	[0046.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51d9f0 | out: hHeap=0x4f0000) returned 1
	[0046.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576000 | out: hHeap=0x4f0000) returned 1
	[0046.733] CloseHandle (hObject=0x124) returned 1
	[0046.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1
	[0046.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1
	[0046.734] ExpandEnvironmentStringsW (in: lpSrc="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDst=0x417a7c, nSize=0x1000 | out: lpDst="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost") returned 0x55
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3
	[0046.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2
	[0046.735] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x417a7c, nSize=0x1000 | out: lpDst="1") returned 0x2
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1
	[0046.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1
	[0046.736] ExpandEnvironmentStringsW (in: lpSrc="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDst=0x417a7c, nSize=0x1000 | out: lpDst="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost") returned 0x55
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2
	[0046.736] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x417a7c, nSize=0x1000 | out: lpDst="1") returned 0x2
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1
	[0046.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1
	[0046.737] ExpandEnvironmentStringsW (in: lpSrc="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDst=0x417a7c, nSize=0x1000 | out: lpDst="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost") returned 0x55
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2
	[0046.737] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x417a7c, nSize=0x1000 | out: lpDst="1") returned 0x2
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3
	[0046.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2
	[0046.737] SendMessageW (hWnd=0x301bc, Msg=0x111, wParam=0x1, lParam=0x0) returned 0x0
	[0046.738] GetProcAddress (hModule=0x74f40000, lpProcName="GetDlgItemTextW") returned 0x74f7bc18
	[0046.738] GetDlgItemTextW (in: hDlg=0x301bc, nIDDlgItem=102, lpString=0x4333a4, cchMax=2048 | out: lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0046.738] GetDlgItem (hDlg=0x301bc, nIDDlgItem=104) returned 0x401ec
	[0046.738] SendMessageW (hWnd=0x401ec, Msg=0xb1, wParam=0x0, lParam=0xffffffff) returned 0x0
	[0046.738] SendMessageW (hWnd=0x401ec, Msg=0xc2, wParam=0x0, lParam=0xf00294) returned 0x0
	[0046.738] GetProcAddress (hModule=0x74f40000, lpProcName="SetFocus") returned 0x74f62175
	[0046.738] SetFocus (hWnd=0x401ec) returned 0x0
	[0046.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x57bb00
	[0046.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57bb00 | out: hHeap=0x4f0000) returned 1
	[0046.764] GetProcAddress (hModule=0x74f40000, lpProcName="LoadStringW") returned 0x74f58eb9
	[0046.764] LoadStringW (in: hInstance=0xed0000, uID=0xb9, lpBuffer=0xf0d020, cchBufferMax=512 | out: lpBuffer="Extracting files to %s folder") returned 0x1d
	[0046.764] GetLastError () returned 0x0
	[0046.764] SetLastError (dwErrCode=0x0) 
	[0046.764] GetDlgItem (hDlg=0x301bc, nIDDlgItem=104) returned 0x401ec
	[0046.765] GetProcAddress (hModule=0x74f40000, lpProcName="ShowWindow") returned 0x74f60dfb
	[0046.765] ShowWindow (hWnd=0x401ec, nCmdShow=5) returned 1
	[0046.765] SendMessageW (hWnd=0x401ec, Msg=0xb1, wParam=0x0, lParam=0xffffffff) returned 0x0
	[0046.765] SendMessageW (hWnd=0x401ec, Msg=0xc2, wParam=0x0, lParam=0xf00294) returned 0x0
	[0046.765] SendMessageW (hWnd=0x401ec, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x0
	[0046.765] SendMessageW (hWnd=0x401ec, Msg=0x43a, wParam=0x0, lParam=0x42b7f4) returned 0xf800003f
	[0046.765] SendMessageW (hWnd=0x401ec, Msg=0x444, wParam=0x1, lParam=0x42b7f4) returned 0x1
	[0046.765] SendMessageW (hWnd=0x401ec, Msg=0xc2, wParam=0x0, lParam=0x431280) returned 0x42
	[0046.771] SendMessageW (hWnd=0x401ec, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x42
	[0046.772] SendMessageW (hWnd=0x401ec, Msg=0xc2, wParam=0x0, lParam=0xf012c0) returned 0x1
	[0046.772] CreateDirectoryW (lpPathName="C:\\Users" (normalized: "c:\\users"), lpSecurityAttributes=0x0) returned 0
	[0046.772] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11
	[0046.772] GetLastError () returned 0xb7
	[0046.772] CreateDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), lpSecurityAttributes=0x0) returned 0
	[0046.772] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz")) returned 0x10
	[0046.772] GetLastError () returned 0xb7
	[0046.772] CreateDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), lpSecurityAttributes=0x0) returned 0
	[0046.773] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0046.773] GetLastError () returned 0xb7
	[0046.773] GetLastError () returned 0xb7
	[0046.773] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1
	[0046.773] GetTickCount () returned 0x114429c
	[0046.773] GetLastError () returned 0xb7
	[0046.773] SetLastError (dwErrCode=0xb7) 
	[0046.773] CreateFileW (lpFileName="__tmp_rar_sfx_access_check_18104988" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\__tmp_rar_sfx_access_check_18104988"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x134
	[0046.780] CloseHandle (hObject=0x134) returned 1
	[0046.780] DeleteFileW (lpFileName="__tmp_rar_sfx_access_check_18104988" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\__tmp_rar_sfx_access_check_18104988")) returned 1
	[0046.781] GetDlgItem (hDlg=0x301bc, nIDDlgItem=103) returned 0x201ce
	[0046.781] ShowWindow (hWnd=0x201ce, nCmdShow=0) returned 1
	[0046.781] GetDlgItem (hDlg=0x301bc, nIDDlgItem=102) returned 0x201fa
	[0046.781] ShowWindow (hWnd=0x201fa, nCmdShow=0) returned 1
	[0046.781] LoadStringW (in: hInstance=0xed0000, uID=0xe6, lpBuffer=0xf0d420, cchBufferMax=512 | out: lpBuffer="Pause") returned 0x5
	[0046.781] GetProcAddress (hModule=0x74f40000, lpProcName="SetDlgItemTextW") returned 0x74f7cfa0
	[0046.781] SetDlgItemTextW (hDlg=0x301bc, nIDDlgItem=1, lpString="Pause") returned 1
	[0046.781] GetDlgItem (hDlg=0x301bc, nIDDlgItem=105) returned 0x201f4
	[0046.781] ShowWindow (hWnd=0x201f4, nCmdShow=9) returned 0
	[0046.781] GetProcAddress (hModule=0x74f40000, lpProcName="SetDlgItemTextW") returned 0x74f7cfa0
	[0046.781] SetDlgItemTextW (hDlg=0x301bc, nIDDlgItem=101, lpString="") returned 1
	[0046.781] GetDlgItem (hDlg=0x301bc, nIDDlgItem=101) returned 0x301ca
	[0046.782] GetProcAddress (hModule=0x74f40000, lpProcName="GetWindowLongW") returned 0x74f56ffe
	[0046.782] GetWindowLongW (hWnd=0x301ca, nIndex=-16) returned 1342341120
	[0046.782] GetProcAddress (hModule=0x74f40000, lpProcName="SetWindowLongW") returned 0x74f58332
	[0046.782] SetWindowLongW (hWnd=0x301ca, nIndex=-16, dwNewLong=1342341248) returned 1342341120
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1
	[0046.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1
	[0046.784] ExpandEnvironmentStringsW (in: lpSrc="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDst=0x40db94, nSize=0x1000 | out: lpDst="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost") returned 0x55
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2
	[0046.784] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x40db94, nSize=0x1000 | out: lpDst="1") returned 0x2
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1
	[0046.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1
	[0046.785] ExpandEnvironmentStringsW (in: lpSrc="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDst=0x40db94, nSize=0x1000 | out: lpDst="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost") returned 0x55
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2
	[0046.785] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x40db94, nSize=0x1000 | out: lpDst="1") returned 0x2
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3
	[0046.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2
	[0046.785] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x503e68
	[0046.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x57bb88
	[0046.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10c0) returned 0x57cff0
	[0046.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10c0) returned 0x57e0b8
	[0046.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe6e0) returned 0x57f180
	[0046.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8003) returned 0x58d868
	[0046.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8003) returned 0x595878
	[0046.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b8) returned 0x59d888
	[0046.787] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x134
	[0046.787] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x128
	[0046.787] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe", lpFindFileData=0x427468 | out: lpFindFileData=0x427468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683b4080, ftCreationTime.dwHighDateTime=0x1d59309, ftLastAccessTime.dwLowDateTime=0x68d3d700, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x4c379f00, ftLastWriteTime.dwHighDateTime=0x1d59309, nFileSizeHigh=0x0, nFileSizeLow=0x4fb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Takeaway (2).exe", cAlternateFileName="TAKEAW~1.EXE")) returned 0x57bc50
	[0046.787] FindClose (in: hFindFile=0x57bc50 | out: hFindFile=0x57bc50) returned 1
	[0046.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10c0) returned 0x59da48
	[0046.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10c0) returned 0x59eb10
	[0046.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway (2).exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x138
	[0046.787] ReadFile (in: hFile=0x138, lpBuffer=0x420b2c, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x41e8b4, lpOverlapped=0x0 | out: lpBuffer=0x420b2c*, lpNumberOfBytesRead=0x41e8b4*=0x7, lpOverlapped=0x0) returned 1
	[0046.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x200000) returned 0x3270020
	[0046.788] SetFilePointer (in: hFile=0x138, lDistanceToMove=0, lpDistanceToMoveHigh=0x41e8e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x41e8e4*=0) returned 0x7
	[0046.788] ReadFile (in: hFile=0x138, lpBuffer=0x3270020, nNumberOfBytesToRead=0x1ffff0, lpNumberOfBytesRead=0x41e8b4, lpOverlapped=0x0 | out: lpBuffer=0x3270020*, lpNumberOfBytesRead=0x41e8b4*=0x4fb5a, lpOverlapped=0x0) returned 1
	[0046.817] SetFilePointer (in: hFile=0x138, lDistanceToMove=259584, lpDistanceToMoveHigh=0x41e8d4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x41e8d4*=0) returned 0x3f600
	[0046.817] ReadFile (in: hFile=0x138, lpBuffer=0x420b2c, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x41e8b4, lpOverlapped=0x0 | out: lpBuffer=0x420b2c*, lpNumberOfBytesRead=0x41e8b4*=0x7, lpOverlapped=0x0) returned 1
	[0046.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3270020 | out: hHeap=0x4f0000) returned 1
	[0046.827] ReadFile (in: hFile=0x138, lpBuffer=0x420b33, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x41e8b4, lpOverlapped=0x0 | out: lpBuffer=0x420b33*, lpNumberOfBytesRead=0x41e8b4*=0x1, lpOverlapped=0x0) returned 1
	[0046.827] SetFilePointer (in: hFile=0x138, lDistanceToMove=0, lpDistanceToMoveHigh=0x41e8d8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x41e8d8*=0) returned 0x3f608
	[0046.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x518fc8
	[0046.827] ReadFile (in: hFile=0x138, lpBuffer=0x518fc8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x41c79c, lpOverlapped=0x0 | out: lpBuffer=0x518fc8*, lpNumberOfBytesRead=0x41c79c*=0x7, lpOverlapped=0x0) returned 1
	[0046.827] ReadFile (in: hFile=0x138, lpBuffer=0x518fcf, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x41c798, lpOverlapped=0x0 | out: lpBuffer=0x518fcf*, lpNumberOfBytesRead=0x41c798*=0xa, lpOverlapped=0x0) returned 1
	[0046.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518fc8 | out: hHeap=0x4f0000) returned 1
	[0046.827] SetFilePointer (in: hFile=0x138, lDistanceToMove=259609, lpDistanceToMoveHigh=0x41e8d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x41e8d0*=0) returned 0x3f619
	[0046.827] SetFilePointer (in: hFile=0x138, lDistanceToMove=0, lpDistanceToMoveHigh=0x41e8e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x41e8e4*=0) returned 0x3f619
	[0046.827] SetFilePointer (in: hFile=0x138, lDistanceToMove=0, lpDistanceToMoveHigh=0x41e8d8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x41e8d8*=0) returned 0x3f619
	[0046.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x518fc8
	[0046.827] ReadFile (in: hFile=0x138, lpBuffer=0x518fc8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x41c79c, lpOverlapped=0x0 | out: lpBuffer=0x518fc8*, lpNumberOfBytesRead=0x41c79c*=0x7, lpOverlapped=0x0) returned 1
	[0046.827] ReadFile (in: hFile=0x138, lpBuffer=0x518fcf, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x41c798, lpOverlapped=0x0 | out: lpBuffer=0x518fcf*, lpNumberOfBytesRead=0x41c798*=0x11, lpOverlapped=0x0) returned 1
	[0046.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518fc8 | out: hHeap=0x4f0000) returned 1
	[0046.827] SetFilePointer (in: hFile=0x138, lDistanceToMove=259787, lpDistanceToMoveHigh=0x41e8d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x41e8d0*=0) returned 0x3f6cb
	[0046.827] SetFilePointer (in: hFile=0x138, lDistanceToMove=0, lpDistanceToMoveHigh=0x41e8d8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x41e8d8*=0) returned 0x3f6cb
	[0046.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x518fc8
	[0046.828] ReadFile (in: hFile=0x138, lpBuffer=0x518fc8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x41c79c, lpOverlapped=0x0 | out: lpBuffer=0x518fc8*, lpNumberOfBytesRead=0x41c79c*=0x7, lpOverlapped=0x0) returned 1
	[0046.828] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x518fc8, Size=0x48) returned 0x577a78
	[0046.828] ReadFile (in: hFile=0x138, lpBuffer=0x577a7f, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x41c798, lpOverlapped=0x0 | out: lpBuffer=0x577a7f*, lpNumberOfBytesRead=0x41c798*=0x26, lpOverlapped=0x0) returned 1
	[0046.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x577a78 | out: hHeap=0x4f0000) returned 1
	[0046.828] SetFilePointer (in: hFile=0x138, lDistanceToMove=259609, lpDistanceToMoveHigh=0x41e8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x41e8c0*=0) returned 0x3f619
	[0046.828] SetFilePointer (in: hFile=0x138, lDistanceToMove=0, lpDistanceToMoveHigh=0x41e8e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x41e8e8*=0) returned 0x3f619
	[0046.828] SetFilePointer (in: hFile=0x138, lDistanceToMove=0, lpDistanceToMoveHigh=0x41e8d8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x41e8d8*=0) returned 0x4fb61
	[0046.828] SetFilePointer (in: hFile=0x138, lDistanceToMove=0, lpDistanceToMoveHigh=0x41e8e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x41e8e8*=0) returned 0x4fb61
	[0046.828] SetFilePointer (in: hFile=0x138, lDistanceToMove=259609, lpDistanceToMoveHigh=0x41e8c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x41e8c4*=0) returned 0x3f619
	[0046.828] GetSystemTime (in: lpSystemTime=0x41e8fc | out: lpSystemTime=0x41e8fc*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x1, wDay=0x4, wHour=0xc, wMinute=0xf, wSecond=0x5, wMilliseconds=0x139)) 
	[0046.828] SystemTimeToFileTime (in: lpSystemTime=0x41e8fc, lpFileTime=0x41e90c | out: lpFileTime=0x41e90c) returned 1
	[0046.828] LoadStringW (in: hInstance=0xed0000, uID=0x8d, lpBuffer=0xf0d820, cchBufferMax=512 | out: lpBuffer="Extracting from %s") returned 0x12
	[0046.828] GetLastError () returned 0x0
	[0046.828] SetLastError (dwErrCode=0x0) 
	[0046.828] GetDlgItem (hDlg=0x301bc, nIDDlgItem=104) returned 0x401ec
	[0046.828] SendMessageW (hWnd=0x401ec, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x43
	[0046.828] SendMessageW (hWnd=0x401ec, Msg=0x43a, wParam=0x0, lParam=0x41d4ac) returned 0xf800003f
	[0046.828] SendMessageW (hWnd=0x401ec, Msg=0x444, wParam=0x1, lParam=0x41d4ac) returned 0x1
	[0046.828] SendMessageW (hWnd=0x401ec, Msg=0xc2, wParam=0x0, lParam=0x41d514) returned 0x20
	[0046.832] SendMessageW (hWnd=0x401ec, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x63
	[0046.832] SendMessageW (hWnd=0x401ec, Msg=0xc2, wParam=0x0, lParam=0xf012c0) returned 0x1
	[0046.832] SetFilePointer (in: hFile=0x138, lDistanceToMove=0, lpDistanceToMoveHigh=0x41e8d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x41e8d0*=0) returned 0x3f619
	[0046.832] SetFilePointer (in: hFile=0x138, lDistanceToMove=259609, lpDistanceToMoveHigh=0x41e8bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x41e8bc*=0) returned 0x3f619
	[0046.832] SetFilePointer (in: hFile=0x138, lDistanceToMove=0, lpDistanceToMoveHigh=0x41e8ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x41e8ac*=0) returned 0x3f619
	[0046.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x518fc8
	[0046.833] ReadFile (in: hFile=0x138, lpBuffer=0x518fc8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x41c770, lpOverlapped=0x0 | out: lpBuffer=0x518fc8*, lpNumberOfBytesRead=0x41c770*=0x7, lpOverlapped=0x0) returned 1
	[0046.833] ReadFile (in: hFile=0x138, lpBuffer=0x518fcf, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x41c76c, lpOverlapped=0x0 | out: lpBuffer=0x518fcf*, lpNumberOfBytesRead=0x41c76c*=0x11, lpOverlapped=0x0) returned 1
	[0046.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518fc8 | out: hHeap=0x4f0000) returned 1
	[0046.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8003) returned 0x59fce0
	[0046.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8003) returned 0x5a7cf0
	[0046.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b8) returned 0x5afd00
	[0046.834] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x13c
	[0046.834] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x140
	[0046.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x51c928
	[0046.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9a) returned 0x5afec0
	[0046.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb54) returned 0x5aff68
	[0046.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0xdb0048
	[0046.835] ReadFile (in: hFile=0x138, lpBuffer=0xdb0048, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x41010c, lpOverlapped=0x0 | out: lpBuffer=0xdb0048*, lpNumberOfBytesRead=0x41010c*=0x9a, lpOverlapped=0x0) returned 1
	[0046.835] PeekMessageW (in: lpMsg=0x410114, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x410114) returned 1
	[0046.835] GetMessageW (in: lpMsg=0x410114, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x410114) returned 1
	[0046.835] TranslateMessage (lpMsg=0x410114) returned 0
	[0046.835] DispatchMessageW (lpMsg=0x410114) returned 0x0
	[0046.835] SetThreadExecutionState (esFlags=0x1) returned 0x80000000
	[0046.835] PeekMessageW (in: lpMsg=0x410114, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x410114) returned 0
	[0046.835] SetThreadExecutionState (esFlags=0x1) returned 0x80000000
	[0046.835] PeekMessageW (in: lpMsg=0x41010c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x41010c) returned 0
	[0046.835] SetThreadExecutionState (esFlags=0x1) returned 0x80000000
	[0046.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0xdb0048 | out: hHeap=0x4f0000) returned 1
	[0046.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51c928 | out: hHeap=0x4f0000) returned 1
	[0046.836] ReleaseSemaphore (in: hSemaphore=0x13c, lReleaseCount=32, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1
	[0046.836] CloseHandle (hObject=0x13c) returned 1
	[0046.836] CloseHandle (hObject=0x140) returned 1
	[0046.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5afd00 | out: hHeap=0x4f0000) returned 1
	[0046.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5a7cf0 | out: hHeap=0x4f0000) returned 1
	[0046.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x59fce0 | out: hHeap=0x4f0000) returned 1
	[0046.839] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5afec0, Size=0xe0) returned 0x5b0ac8
	[0046.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x136) returned 0x5b0bb0
	[0046.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5b0ac8 | out: hHeap=0x4f0000) returned 1
	[0046.839] SetFilePointer (in: hFile=0x138, lDistanceToMove=259609, lpDistanceToMoveHigh=0x41e8ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x41e8ac*=0) returned 0x3f619
	[0046.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5b0bb0 | out: hHeap=0x4f0000) returned 1
	[0046.840] SetFilePointer (in: hFile=0x138, lDistanceToMove=0, lpDistanceToMoveHigh=0x41e91c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x41e91c*=0) returned 0x3f619
	[0046.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x518fc8
	[0046.840] ReadFile (in: hFile=0x138, lpBuffer=0x518fc8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x41c7e0, lpOverlapped=0x0 | out: lpBuffer=0x518fc8*, lpNumberOfBytesRead=0x41c7e0*=0x7, lpOverlapped=0x0) returned 1
	[0046.840] ReadFile (in: hFile=0x138, lpBuffer=0x518fcf, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x41c7dc, lpOverlapped=0x0 | out: lpBuffer=0x518fcf*, lpNumberOfBytesRead=0x41c7dc*=0x11, lpOverlapped=0x0) returned 1
	[0046.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518fc8 | out: hHeap=0x4f0000) returned 1
	[0046.840] SetFilePointer (in: hFile=0x138, lDistanceToMove=259787, lpDistanceToMoveHigh=0x419758*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x419758*=0) returned 0x3f6cb
	[0046.840] SetFilePointer (in: hFile=0x138, lDistanceToMove=0, lpDistanceToMoveHigh=0x41e91c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x41e91c*=0) returned 0x3f6cb
	[0046.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x518fc8
	[0046.840] ReadFile (in: hFile=0x138, lpBuffer=0x518fc8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x41c7e0, lpOverlapped=0x0 | out: lpBuffer=0x518fc8*, lpNumberOfBytesRead=0x41c7e0*=0x7, lpOverlapped=0x0) returned 1
	[0046.840] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x518fc8, Size=0x48) returned 0x577a78
	[0046.840] ReadFile (in: hFile=0x138, lpBuffer=0x577a7f, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x41c7dc, lpOverlapped=0x0 | out: lpBuffer=0x577a7f*, lpNumberOfBytesRead=0x41c7dc*=0x26, lpOverlapped=0x0) returned 1
	[0046.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x577a78 | out: hHeap=0x4f0000) returned 1
	[0046.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=1, lpString2="takeaway.ps1", cchCount2=1) returned 1
	[0046.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="__rar_", cchCount1=6, lpString2="takeaway.ps1", cchCount2=6) returned 1
	[0046.841] GetProcAddress (hModule=0x74f40000, lpProcName="CharUpperW") returned 0x74f5f350
	[0046.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=-1, lpString2="takeaway.ps1", cchCount2=-1) returned 1
	[0046.841] SetFilePointer (in: hFile=0x138, lDistanceToMove=259832, lpDistanceToMoveHigh=0x41975c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x41975c*=0) returned 0x3f6f8
	[0046.841] LoadStringW (in: hInstance=0xed0000, uID=0x65, lpBuffer=0xf0dc20, cchBufferMax=512 | out: lpBuffer="Extracting %s") returned 0xd
	[0046.841] GetLastError () returned 0x0
	[0046.841] SetLastError (dwErrCode=0x0) 
	[0046.841] SetDlgItemTextW (hDlg=0x301bc, nIDDlgItem=101, lpString="Extracting takeaway.ps1") returned 1
	[0046.841] PeekMessageW (in: lpMsg=0x418338, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x418338) returned 0
	[0046.841] GetFileAttributesW (lpFileName="takeaway.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway.ps1")) returned 0xffffffff
	[0046.841] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x4166f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0046.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway.ps1")) returned 0xffffffff
	[0046.842] CreateFileW (lpFileName="takeaway.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway.ps1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140
	[0046.864] GetFileType (hFile=0x140) returned 0x1
	[0046.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb54) returned 0x5b0ac8
	[0046.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb54) returned 0x5b1628
	[0046.864] SetFilePointer (in: hFile=0x140, lDistanceToMove=3403, lpDistanceToMoveHigh=0x41975c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x41975c*=0) returned 0xd4b
	[0046.864] SetEndOfFile (hFile=0x140) returned 1
	[0046.865] SetFilePointer (in: hFile=0x140, lDistanceToMove=0, lpDistanceToMoveHigh=0x419748*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x419748*=0) returned 0x0
	[0046.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0xdb0048
	[0046.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x400400) returned 0x3270020
	[0046.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x25724) returned 0x51c928
	[0046.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x30c00) returned 0x542058
	[0046.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x30c00) returned 0x5b2188
	[0046.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x30c00) returned 0xdf0050
	[0046.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x30c00) returned 0xe20c58
	[0046.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x30c00) returned 0xe51860
	[0046.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x30c00) returned 0x3680048
	[0046.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x30c00) returned 0x36b0c50
	[0046.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x30c00) returned 0x36e1858
	[0046.923] ReadFile (in: hFile=0x138, lpBuffer=0x3270020, nNumberOfBytesToRead=0x599, lpNumberOfBytesRead=0x4195d0, lpOverlapped=0x0 | out: lpBuffer=0x3270020*, lpNumberOfBytesRead=0x4195d0*=0x599, lpOverlapped=0x0) returned 1
	[0046.923] SendDlgItemMessageW (hDlg=0x301bc, nIDDlgItem=106, Msg=0x402, wParam=0x50, lParam=0x0) returned 0x0
	[0046.924] PeekMessageW (in: lpMsg=0x419574, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x419574) returned 0
	[0046.924] PeekMessageW (in: lpMsg=0x4195d8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x4195d8) returned 0
	[0046.924] SetThreadExecutionState (esFlags=0x1) returned 0x80000000
	[0046.924] SendDlgItemMessageW (hDlg=0x301bc, nIDDlgItem=106, Msg=0x402, wParam=0x50, lParam=0x0) returned 0x50
	[0046.924] PeekMessageW (in: lpMsg=0x419574, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x419574) returned 0
	[0046.924] PeekMessageW (in: lpMsg=0x4195d8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x4195d8) returned 0
	[0046.924] SetThreadExecutionState (esFlags=0x1) returned 0x80000000
	[0046.924] WriteFile (in: hFile=0x140, lpBuffer=0xdb0048*, nNumberOfBytesToWrite=0xd4b, lpNumberOfBytesWritten=0x4195a4, lpOverlapped=0x0 | out: lpBuffer=0xdb0048*, lpNumberOfBytesWritten=0x4195a4*=0xd4b, lpOverlapped=0x0) returned 1
	[0046.925] PeekMessageW (in: lpMsg=0x419578, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x419578) returned 0
	[0046.925] SetThreadExecutionState (esFlags=0x1) returned 0x80000000
	[0046.925] SetFilePointer (in: hFile=0x138, lDistanceToMove=261265, lpDistanceToMoveHigh=0x419758*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x419758*=0) returned 0x3fc91
	[0046.925] SetFileTime (hFile=0x140, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x41974c) returned 1
	[0046.926] CloseHandle (hObject=0x140) returned 1
	[0046.927] SetFileAttributesW (lpFileName="takeaway.ps1", dwFileAttributes=0x20) returned 1
	[0046.928] SetFilePointer (in: hFile=0x138, lDistanceToMove=0, lpDistanceToMoveHigh=0x41e91c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x41e91c*=0) returned 0x3fc91
	[0046.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x518fc8
	[0046.928] ReadFile (in: hFile=0x138, lpBuffer=0x518fc8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x41c7e0, lpOverlapped=0x0 | out: lpBuffer=0x518fc8*, lpNumberOfBytesRead=0x41c7e0*=0x7, lpOverlapped=0x0) returned 1
	[0046.928] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x518fc8, Size=0x48) returned 0x577a78
	[0046.928] ReadFile (in: hFile=0x138, lpBuffer=0x577a7f, nNumberOfBytesToRead=0x27, lpNumberOfBytesRead=0x41c7dc, lpOverlapped=0x0 | out: lpBuffer=0x577a7f*, lpNumberOfBytesRead=0x41c7dc*=0x27, lpOverlapped=0x0) returned 1
	[0046.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x577a78 | out: hHeap=0x4f0000) returned 1
	[0046.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=1, lpString2="winhost.exe", cchCount2=1) returned 1
	[0046.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="__rar_", cchCount1=6, lpString2="winhost.exe", cchCount2=6) returned 1
	[0046.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=-1, lpString2="winhost.exe", cchCount2=-1) returned 1
	[0046.928] SetFilePointer (in: hFile=0x138, lDistanceToMove=261311, lpDistanceToMoveHigh=0x41975c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x41975c*=0) returned 0x3fcbf
	[0046.928] LoadStringW (in: hInstance=0xed0000, uID=0x65, lpBuffer=0xf0e020, cchBufferMax=512 | out: lpBuffer="Extracting %s") returned 0xd
	[0046.928] GetLastError () returned 0x0
	[0046.928] SetLastError (dwErrCode=0x0) 
	[0046.928] SetDlgItemTextW (hDlg=0x301bc, nIDDlgItem=101, lpString="Extracting winhost.exe") returned 1
	[0046.928] PeekMessageW (in: lpMsg=0x418338, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x418338) returned 0
	[0046.928] GetFileAttributesW (lpFileName="winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0xffffffff
	[0046.928] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x4166f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0046.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0xffffffff
	[0046.929] CreateFileW (lpFileName="winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140
	[0046.929] GetFileType (hFile=0x140) returned 0x1
	[0046.929] SetFilePointer (in: hFile=0x140, lDistanceToMove=94720, lpDistanceToMoveHigh=0x41975c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x41975c*=0) returned 0x17200
	[0046.929] SetEndOfFile (hFile=0x140) returned 1
	[0046.932] SetFilePointer (in: hFile=0x140, lDistanceToMove=0, lpDistanceToMoveHigh=0x419748*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x419748*=0) returned 0x0
	[0046.932] ReadFile (in: hFile=0x138, lpBuffer=0x3270020, nNumberOfBytesToRead=0xfe4f, lpNumberOfBytesRead=0x4195d0, lpOverlapped=0x0 | out: lpBuffer=0x3270020*, lpNumberOfBytesRead=0x4195d0*=0xfe4f, lpOverlapped=0x0) returned 1
	[0046.933] SendDlgItemMessageW (hDlg=0x301bc, nIDDlgItem=106, Msg=0x402, wParam=0x63, lParam=0x0) returned 0x50
	[0046.933] PeekMessageW (in: lpMsg=0x419574, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x419574) returned 0
	[0046.933] PeekMessageW (in: lpMsg=0x4195d8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x4195d8) returned 0
	[0046.933] SetThreadExecutionState (esFlags=0x1) returned 0x80000000
	[0046.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa3c) returned 0x144
	[0046.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa40) returned 0x148
	[0046.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa44) returned 0x14c
	[0046.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa48) returned 0x150
	[0046.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa4c) returned 0x154
	[0046.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa50) returned 0x158
	[0046.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa54) returned 0x15c
	[0046.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa58) returned 0x160
	[0046.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa5c) returned 0x164
	[0046.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa60) returned 0x168
	[0046.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa64) returned 0x16c
	[0046.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa68) returned 0x170
	[0046.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa6c) returned 0x174
	[0046.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa70) returned 0x178
	[0046.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa74) returned 0x17c
	[0046.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa78) returned 0x180
	[0046.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa7c) returned 0x184
	[0046.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa80) returned 0x188
	[0046.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa84) returned 0x18c
	[0046.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa88) returned 0x190
	[0046.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa8c) returned 0x194
	[0046.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa90) returned 0x198
	[0046.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa94) returned 0x19c
	[0046.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa98) returned 0x1a0
	[0046.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xa9c) returned 0x1a4
	[0046.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xaa0) returned 0x1a8
	[0046.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xaa4) returned 0x1ac
	[0046.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xaa8) returned 0x1b0
	[0046.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xaac) returned 0x1b4
	[0046.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xab0) returned 0x1b8
	[0047.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xab4) returned 0x1bc
	[0047.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0xedf976, lpParameter=0x59d888, dwCreationFlags=0x0, lpThreadId=0x419610 | out: lpThreadId=0x419610*=0xab8) returned 0x1c0
	[0047.003] ResetEvent (hEvent=0x128) returned 1
	[0047.003] ReleaseSemaphore (in: hSemaphore=0x134, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1
	[0047.003] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0047.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x200) returned 0xe82a98
	[0047.009] SendDlgItemMessageW (hDlg=0x301bc, nIDDlgItem=106, Msg=0x402, wParam=0x63, lParam=0x0) returned 0x63
	[0047.009] PeekMessageW (in: lpMsg=0x419574, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x419574) returned 1
	[0047.009] GetMessageW (in: lpMsg=0x419574, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x419574) returned 1
	[0047.010] TranslateMessage (lpMsg=0x419574) returned 0
	[0047.010] DispatchMessageW (lpMsg=0x419574) returned 0x0
	[0047.010] PeekMessageW (in: lpMsg=0x4195d8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x4195d8) returned 0
	[0047.010] SetThreadExecutionState (esFlags=0x1) returned 0x80000000
	[0047.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x59fce0
	[0047.014] WriteFile (in: hFile=0x140, lpBuffer=0x59fce0*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x4195d4, lpOverlapped=0x0 | out: lpBuffer=0x59fce0*, lpNumberOfBytesWritten=0x4195d4*=0x10000, lpOverlapped=0x0) returned 1
	[0047.016] PeekMessageW (in: lpMsg=0x4195a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x4195a8) returned 0
	[0047.016] SetThreadExecutionState (esFlags=0x1) returned 0x80000000
	[0047.017] WriteFile (in: hFile=0x140, lpBuffer=0xdc0048*, nNumberOfBytesToWrite=0x7200, lpNumberOfBytesWritten=0x4195a4, lpOverlapped=0x0 | out: lpBuffer=0xdc0048*, lpNumberOfBytesWritten=0x4195a4*=0x7200, lpOverlapped=0x0) returned 1
	[0047.017] PeekMessageW (in: lpMsg=0x419578, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x419578) returned 0
	[0047.017] SetThreadExecutionState (esFlags=0x1) returned 0x80000000
	[0047.017] SetFilePointer (in: hFile=0x138, lDistanceToMove=326414, lpDistanceToMoveHigh=0x419758*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x419758*=0) returned 0x4fb0e
	[0047.017] SetFileTime (hFile=0x140, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x41974c) returned 1
	[0047.018] CloseHandle (hObject=0x140) returned 1
	[0047.020] SetFileAttributesW (lpFileName="winhost.exe", dwFileAttributes=0x20) returned 1
	[0047.020] SetFilePointer (in: hFile=0x138, lDistanceToMove=0, lpDistanceToMoveHigh=0x41e91c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x41e91c*=0) returned 0x4fb0e
	[0047.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x518fc8
	[0047.020] ReadFile (in: hFile=0x138, lpBuffer=0x518fc8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x41c7e0, lpOverlapped=0x0 | out: lpBuffer=0x518fc8*, lpNumberOfBytesRead=0x41c7e0*=0x7, lpOverlapped=0x0) returned 1
	[0047.020] ReadFile (in: hFile=0x138, lpBuffer=0x518fcf, nNumberOfBytesToRead=0xc, lpNumberOfBytesRead=0x41c7dc, lpOverlapped=0x0 | out: lpBuffer=0x518fcf*, lpNumberOfBytesRead=0x41c7dc*=0xc, lpOverlapped=0x0) returned 1
	[0047.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518fc8 | out: hHeap=0x4f0000) returned 1
	[0047.020] SetFilePointer (in: hFile=0x138, lDistanceToMove=326489, lpDistanceToMoveHigh=0x419758*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x419758*=0) returned 0x4fb59
	[0047.020] SetFilePointer (in: hFile=0x138, lDistanceToMove=0, lpDistanceToMoveHigh=0x41e91c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x41e91c*=0) returned 0x4fb59
	[0047.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x518fc8
	[0047.020] ReadFile (in: hFile=0x138, lpBuffer=0x518fc8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x41c7e0, lpOverlapped=0x0 | out: lpBuffer=0x518fc8*, lpNumberOfBytesRead=0x41c7e0*=0x7, lpOverlapped=0x0) returned 1
	[0047.020] ReadFile (in: hFile=0x138, lpBuffer=0x518fcf, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x41c7dc, lpOverlapped=0x0 | out: lpBuffer=0x518fcf*, lpNumberOfBytesRead=0x41c7dc*=0x1, lpOverlapped=0x0) returned 1
	[0047.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518fc8 | out: hHeap=0x4f0000) returned 1
	[0047.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x59da48 | out: hHeap=0x4f0000) returned 1
	[0047.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x59eb10 | out: hHeap=0x4f0000) returned 1
	[0047.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5aff68 | out: hHeap=0x4f0000) returned 1
	[0047.021] CloseHandle (hObject=0x138) returned 1
	[0047.021] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Takeaway (2).exe", lpFindFileData=0x427468 | out: lpFindFileData=0x427468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683b4080, ftCreationTime.dwHighDateTime=0x1d59309, ftLastAccessTime.dwLowDateTime=0x68d3d700, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x4c379f00, ftLastWriteTime.dwHighDateTime=0x1d59309, nFileSizeHigh=0x0, nFileSizeLow=0x4fb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Takeaway (2).exe", cAlternateFileName="TAKEAW~1.EXE")) returned 0x57bc50
	[0047.021] FindClose (in: hFindFile=0x57bc50 | out: hFindFile=0x57bc50) returned 1
	[0047.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0xdb0048 | out: hHeap=0x4f0000) returned 1
	[0047.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3270020 | out: hHeap=0x4f0000) returned 1
	[0047.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x36e1858 | out: hHeap=0x4f0000) returned 1
	[0047.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x36b0c50 | out: hHeap=0x4f0000) returned 1
	[0047.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3680048 | out: hHeap=0x4f0000) returned 1
	[0047.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0xe51860 | out: hHeap=0x4f0000) returned 1
	[0047.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0xe20c58 | out: hHeap=0x4f0000) returned 1
	[0047.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0xdf0050 | out: hHeap=0x4f0000) returned 1
	[0047.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5b2188 | out: hHeap=0x4f0000) returned 1
	[0047.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x542058 | out: hHeap=0x4f0000) returned 1
	[0047.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51c928 | out: hHeap=0x4f0000) returned 1
	[0047.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x595878 | out: hHeap=0x4f0000) returned 1
	[0047.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0xe82a98 | out: hHeap=0x4f0000) returned 1
	[0047.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x59fce0 | out: hHeap=0x4f0000) returned 1
	[0047.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58d868 | out: hHeap=0x4f0000) returned 1
	[0047.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57f180 | out: hHeap=0x4f0000) returned 1
	[0047.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57cff0 | out: hHeap=0x4f0000) returned 1
	[0047.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57e0b8 | out: hHeap=0x4f0000) returned 1
	[0047.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5b0ac8 | out: hHeap=0x4f0000) returned 1
	[0047.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5b1628 | out: hHeap=0x4f0000) returned 1
	[0047.067] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1
	[0047.067] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0047.067] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0047.067] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1
	[0047.067] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0047.067] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1
	[0047.067] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1
	[0047.067] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1
	[0047.067] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1
	[0047.067] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1
	[0047.067] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1
	[0047.067] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1
	[0047.067] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1
	[0047.067] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1
	[0047.068] ExpandEnvironmentStringsW (in: lpSrc="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDst=0x40db94, nSize=0x1000 | out: lpDst="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost") returned 0x55
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2
	[0047.068] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x40db94, nSize=0x1000 | out: lpDst="1") returned 0x2
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1
	[0047.068] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1
	[0047.069] ExpandEnvironmentStringsW (in: lpSrc="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDst=0x40db94, nSize=0x1000 | out: lpDst="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost") returned 0x55
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2
	[0047.069] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=".exe", cchCount1=-1, lpString2=".inf", cchCount2=-1) returned 1
	[0047.070] GetFileAttributesW (lpFileName="powershell.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\powershell.exe")) returned 0xffffffff
	[0047.070] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x40cb24 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0047.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\powershell.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\powershell.exe")) returned 0xffffffff
	[0047.070] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46
	[0047.070] ShellExecuteExW (in: pExecInfo=0x40eb64*(cbSize=0x3c, fMask=0x1c0, hwnd=0x0, lpVerb=0x0, lpFile="powershell.exe", lpParameters="-ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x40eb64*(cbSize=0x3c, fMask=0x1c0, hwnd=0x0, lpVerb=0x0, lpFile="powershell.exe", lpParameters="-ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x2a4)) returned 1
	[0052.575] CloseHandle (hObject=0x2a4) returned 1
	[0052.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=".exe", cchCount1=-1, lpString2=".exe", cchCount2=-1) returned 2
	[0052.576] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x40db94, nSize=0x1000 | out: lpDst="1") returned 0x2
	[0052.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3
	[0052.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1
	[0052.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1
	[0052.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3
	[0052.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2
	[0052.576] GetDlgItem (hDlg=0x301bc, nIDDlgItem=1) returned 0x201e4
	[0052.576] GetProcAddress (hModule=0x74f40000, lpProcName="EnableWindow") returned 0x74f62da4
	[0052.576] EnableWindow (hWnd=0x201e4, bEnable=1) returned 0
	[0052.577] GetProcAddress (hModule=0x74f40000, lpProcName="EndDialog") returned 0x74f7b99c
	[0052.577] EndDialog (hDlg=0x301bc, nResult=0x1) returned 1
	[0052.811] IUnknown:AddRef (This=0x757266bc) returned 0x1
	[0052.811] GetProcAddress (hModule=0x755e0000, lpProcName="OleUninitialize") returned 0x755feba1
	[0052.812] OleUninitialize () 
	[0052.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576d88 | out: hHeap=0x4f0000) returned 1
	[0052.812] GetProcAddress (hModule=0x75ad0000, lpProcName="DeleteObject") returned 0x75ae5689
	[0052.812] DeleteObject (ho=0xd01c3) returned 0
	[0052.813] GetProcAddress (hModule=0x75ad0000, lpProcName="DeleteObject") returned 0x75ae5689
	[0052.813] DeleteObject (ho=0xf05027f) returned 1
	[0052.813] OleUninitialize () 
	[0052.912] GetModuleHandleW (lpModuleName=0x0) returned 0xed0000
	[0052.912] GetModuleHandleW (lpModuleName=0x0) returned 0xed0000
	[0052.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57bb88 | out: hHeap=0x4f0000) returned 1
	[0052.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x503e68 | out: hHeap=0x4f0000) returned 1
	[0052.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5008d8 | out: hHeap=0x4f0000) returned 1
	[0052.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x500a70 | out: hHeap=0x4f0000) returned 1
	[0052.914] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0052.914] GetLastError () returned 0x57
	[0052.914] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0052.915] LoadLibraryExW (lpLibFileName="ext-ms-win-kernel32-package-current-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0052.915] GetLastError () returned 0x57
	[0052.915] LoadLibraryExW (lpLibFileName="ext-ms-win-kernel32-package-current-l1-1-0", hFile=0x0, dwFlags=0x0) returned 0x0
	[0052.915] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x43f7d0 | out: phModule=0x43f7d0) returned 0
	[0052.916] ExitProcess (uExitCode=0x0) 
	[0052.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fef38 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 2
	os_tid = 0xa3c

	[0046.942] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0
	[0047.009] SetEvent (hEvent=0x128) returned 1
	[0047.009] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 3
	os_tid = 0xa40

	[0046.942] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0
	[0047.008] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 4
	os_tid = 0xa44

	[0046.978] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0
	[0047.007] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 5
	os_tid = 0xa48

	[0046.984] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0
	[0047.006] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 6
	os_tid = 0xa4c

	[0046.988] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 7
	os_tid = 0xa50

	[0046.989] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 8
	os_tid = 0xa54

	[0046.993] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 9
	os_tid = 0xa58

	[0046.993] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 10
	os_tid = 0xa5c

	[0046.993] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 11
	os_tid = 0xa60

	[0046.994] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 12
	os_tid = 0xa64

	[0046.994] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 13
	os_tid = 0xa68

	[0046.994] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 14
	os_tid = 0xa6c

	[0046.995] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 15
	os_tid = 0xa70

	[0046.995] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 16
	os_tid = 0xa74

	[0046.996] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 17
	os_tid = 0xa78

	[0046.996] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 18
	os_tid = 0xa7c

	[0046.997] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 19
	os_tid = 0xa80

	[0046.997] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 20
	os_tid = 0xa84

	[0046.998] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 21
	os_tid = 0xa88

	[0046.998] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 22
	os_tid = 0xa8c

	[0046.998] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 23
	os_tid = 0xa90

	[0046.999] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 24
	os_tid = 0xa94

	[0046.999] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 25
	os_tid = 0xa98

	[0046.999] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 26
	os_tid = 0xa9c

	[0046.999] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 27
	os_tid = 0xaa0

	[0047.000] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 28
	os_tid = 0xaa4

	[0047.000] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 29
	os_tid = 0xaa8

	[0047.000] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 30
	os_tid = 0xaac

	[0047.000] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 31
	os_tid = 0xab0

	[0047.047] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 32
	os_tid = 0xab4

	[0047.049] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 33
	os_tid = 0xab8

	[0047.053] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 34
	os_tid = 0xabc


Thread:
	id = 35
	os_tid = 0xac0


Thread:
	id = 36
	os_tid = 0xac4


Process:
	id = "2"
	image_name = "powershell.exe"
	filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"
	page_root = "0x4f6bf000"
	os_pid = "0xae8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x97c"
	cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 37
	os_tid = 0xaec

	[0055.147] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0055.329] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe
	[0055.329] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe
	[0055.329] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a
	[0055.329] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a
	[0056.121] GetVersionExW (in: lpVersionInformation=0x4fe0b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x4fe0b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0056.121] GetLastError () returned 0x2
	[0056.122] GetVersionExW (in: lpVersionInformation=0x4fe0b0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x4fe0b0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0056.122] GetLastError () returned 0x2
	[0056.129] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e32c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0056.129] GetLastError () returned 0x2
	[0056.136] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e348, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0056.136] GetLastError () returned 0x2
	[0056.136] GetVersionExW (in: lpVersionInformation=0x4fe0b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x4fe0b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0056.136] GetLastError () returned 0x2
	[0056.137] SetErrorMode (uMode=0x1) returned 0x1
	[0056.139] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x19e7c8 | out: lpFileInformation=0x19e7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1
	[0056.139] GetLastError () returned 0x2
	[0056.139] SetErrorMode (uMode=0x1) returned 0x1
	[0056.142] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x19e84c | out: lpdwHandle=0x19e84c) returned 0x94c
	[0056.144] GetLastError () returned 0x0
	[0056.146] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2b24e08 | out: lpData=0x2b24e08) returned 1
	[0056.149] VerQueryValueW (in: pBlock=0x2b24e08, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19e818, puLen=0x19e814 | out: lplpBuffer=0x19e818*=0x2b24ea4, puLen=0x19e814) returned 1
	[0056.151] lstrlenW (lpString="䅁") returned 1
	[0056.161] VerQueryValueW (in: pBlock=0x2b24e08, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x19e794, puLen=0x19e790 | out: lplpBuffer=0x19e794*=0x2b24f80, puLen=0x19e790) returned 1
	[0056.161] lstrlenW (lpString="Microsoft Corporation") returned 21
	[0056.162] lstrcpyW (in: lpString1=0x4fe098, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation"
	[0056.162] VerQueryValueW (in: pBlock=0x2b24e08, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x19e794, puLen=0x19e790 | out: lplpBuffer=0x19e794*=0x2b24fd4, puLen=0x19e790) returned 1
	[0056.162] lstrlenW (lpString="System.Management.Automation") returned 28
	[0056.163] lstrcpyW (in: lpString1=0x4fe098, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation"
	[0056.163] VerQueryValueW (in: pBlock=0x2b24e08, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x19e794, puLen=0x19e790 | out: lplpBuffer=0x19e794*=0x2b25030, puLen=0x19e790) returned 1
	[0056.163] lstrlenW (lpString="6.1.7601.17514") returned 14
	[0056.163] lstrcpyW (in: lpString1=0x4fe098, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514"
	[0056.163] VerQueryValueW (in: pBlock=0x2b24e08, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x19e794, puLen=0x19e790 | out: lplpBuffer=0x19e794*=0x2b25070, puLen=0x19e790) returned 1
	[0056.163] lstrlenW (lpString="System.Management.Automation.dll") returned 32
	[0056.163] lstrcpyW (in: lpString1=0x4fe098, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll"
	[0056.163] VerQueryValueW (in: pBlock=0x2b24e08, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x19e794, puLen=0x19e790 | out: lplpBuffer=0x19e794*=0x2b250d8, puLen=0x19e790) returned 1
	[0056.163] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57
	[0056.163] lstrcpyW (in: lpString1=0x4fe098, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved."
	[0056.163] VerQueryValueW (in: pBlock=0x2b24e08, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x19e794, puLen=0x19e790 | out: lplpBuffer=0x19e794*=0x2b25174, puLen=0x19e790) returned 1
	[0056.163] lstrlenW (lpString="System.Management.Automation.dll") returned 32
	[0056.163] lstrcpyW (in: lpString1=0x4fe098, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll"
	[0056.163] VerQueryValueW (in: pBlock=0x2b24e08, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x19e794, puLen=0x19e790 | out: lplpBuffer=0x19e794*=0x2b251d8, puLen=0x19e790) returned 1
	[0056.163] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42
	[0056.163] lstrcpyW (in: lpString1=0x4fe098, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System"
	[0056.164] VerQueryValueW (in: pBlock=0x2b24e08, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x19e794, puLen=0x19e790 | out: lplpBuffer=0x19e794*=0x2b25254, puLen=0x19e790) returned 1
	[0056.164] lstrlenW (lpString="6.1.7601.17514") returned 14
	[0056.164] lstrcpyW (in: lpString1=0x4fe098, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514"
	[0056.164] VerQueryValueW (in: pBlock=0x2b24e08, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x19e794, puLen=0x19e790 | out: lplpBuffer=0x19e794*=0x2b24efc, puLen=0x19e790) returned 1
	[0056.164] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49
	[0056.164] lstrcpyW (in: lpString1=0x4fe098, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly"
	[0056.164] VerQueryValueW (in: pBlock=0x2b24e08, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x19e794, puLen=0x19e790 | out: lplpBuffer=0x19e794*=0x0, puLen=0x19e790) returned 0
	[0056.164] VerQueryValueW (in: pBlock=0x2b24e08, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x19e794, puLen=0x19e790 | out: lplpBuffer=0x19e794*=0x0, puLen=0x19e790) returned 0
	[0056.164] VerQueryValueW (in: pBlock=0x2b24e08, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x19e794, puLen=0x19e790 | out: lplpBuffer=0x19e794*=0x0, puLen=0x19e790) returned 0
	[0056.164] VerQueryValueW (in: pBlock=0x2b24e08, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19e788, puLen=0x19e784 | out: lplpBuffer=0x19e788*=0x2b24ea4, puLen=0x19e784) returned 1
	[0056.165] VerLanguageNameW (in: wLang=0x0, szLang=0x4fe098, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10
	[0056.170] VerQueryValueW (in: pBlock=0x2b24e08, lpSubBlock="\\", lplpBuffer=0x19e79c, puLen=0x19e798 | out: lplpBuffer=0x19e79c*=0x2b24e30, puLen=0x19e798) returned 1
	[0056.178] GetCurrentProcessId () returned 0xae8
	[0056.200] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x19dfd4 | out: lpLuid=0x19dfd4*(LowPart=0x14, HighPart=0)) returned 1
	[0056.202] GetLastError () returned 0x0
	[0056.204] GetCurrentProcess () returned 0xffffffff
	[0056.204] GetLastError () returned 0x0
	[0056.206] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x19dfd0 | out: TokenHandle=0x19dfd0*=0x308) returned 1
	[0056.206] GetLastError () returned 0x0
	[0056.209] AdjustTokenPrivileges (in: TokenHandle=0x308, DisableAllPrivileges=0, NewState=0x2b27948*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0056.209] GetLastError () returned 0x0
	[0056.210] CloseHandle (hObject=0x308) returned 1
	[0056.210] GetLastError () returned 0x0
	[0056.219] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xae8) returned 0x308
	[0056.219] GetLastError () returned 0x0
	[0056.229] EnumProcessModules (in: hProcess=0x308, lphModule=0x2b2798c, cb=0x100, lpcbNeeded=0x19e7c4 | out: lphModule=0x2b2798c, lpcbNeeded=0x19e7c4) returned 1
	[0056.230] GetLastError () returned 0x0
	[0056.236] GetModuleInformation (in: hProcess=0x308, hModule=0x21d60000, lpmodinfo=0x2b27acc, cb=0xc | out: lpmodinfo=0x2b27acc*(lpBaseOfDll=0x21d60000, SizeOfImage=0x72000, EntryPoint=0x21d67363)) returned 1
	[0056.236] GetLastError () returned 0x0
	[0056.239] GetModuleBaseNameW (in: hProcess=0x308, hModule=0x21d60000, lpBaseName=0x4fe858, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe
	[0056.239] GetLastError () returned 0x0
	[0056.241] GetModuleFileNameExW (in: hProcess=0x308, hModule=0x21d60000, lpFilename=0x4fe858, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39
	[0056.241] GetLastError () returned 0x0
	[0056.242] CloseHandle (hObject=0x308) returned 1
	[0056.242] GetLastError () returned 0x0
	[0056.246] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xae8) returned 0x308
	[0056.246] GetLastError () returned 0x0
	[0056.249] GetExitCodeProcess (in: hProcess=0x308, lpExitCode=0x2b26f7c | out: lpExitCode=0x2b26f7c*=0x103) returned 1
	[0056.249] GetLastError () returned 0x0
	[0056.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3b25278, Length=0x20000, ResultLength=0x19e80c | out: SystemInformation=0x3b25278, ResultLength=0x19e80c*=0x9ea0) returned 0x0
	[0056.279] EnumWindows (lpEnumFunc=0x2983612, lParam=0x0) returned 0
	[0056.282] GetWindowThreadProcessId (in: hWnd=0x3013e, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x558
	[0056.282] GetLastError () returned 0x0
	[0056.282] GetWindowThreadProcessId (in: hWnd=0x300b2, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x4d0
	[0056.282] GetLastError () returned 0x0
	[0056.282] GetWindowThreadProcessId (in: hWnd=0x300ee, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x4d0
	[0056.282] GetLastError () returned 0x0
	[0056.282] GetWindowThreadProcessId (in: hWnd=0x400c0, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x4d0
	[0056.282] GetLastError () returned 0x0
	[0056.283] GetWindowThreadProcessId (in: hWnd=0x10146, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x538
	[0056.283] GetLastError () returned 0x0
	[0056.283] GetWindowThreadProcessId (in: hWnd=0x20118, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x4d0
	[0056.283] GetLastError () returned 0x0
	[0056.283] GetWindowThreadProcessId (in: hWnd=0x2001e, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x778
	[0056.283] GetLastError () returned 0x0
	[0056.283] GetWindowThreadProcessId (in: hWnd=0x20028, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x778
	[0056.283] GetLastError () returned 0x0
	[0056.283] GetWindowThreadProcessId (in: hWnd=0x1007c, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x4d0
	[0056.283] GetLastError () returned 0x0
	[0056.284] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x4d0
	[0056.284] GetLastError () returned 0x0
	[0056.284] GetWindowThreadProcessId (in: hWnd=0x10066, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x4d0
	[0056.284] GetLastError () returned 0x0
	[0056.284] GetWindowThreadProcessId (in: hWnd=0x10090, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x4d0
	[0056.284] GetLastError () returned 0x0
	[0056.284] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x4d0
	[0056.284] GetLastError () returned 0x0
	[0056.284] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x4d0
	[0056.284] GetLastError () returned 0x0
	[0056.285] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x4d0
	[0056.285] GetLastError () returned 0x0
	[0056.285] GetWindowThreadProcessId (in: hWnd=0x1005e, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x4d0
	[0056.285] GetLastError () returned 0x0
	[0056.285] GetWindowThreadProcessId (in: hWnd=0x10056, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x4d0
	[0056.285] GetLastError () returned 0x0
	[0056.285] GetWindowThreadProcessId (in: hWnd=0x100fa, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x460
	[0056.285] GetLastError () returned 0x0
	[0056.285] GetWindowThreadProcessId (in: hWnd=0x500a2, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x4d0
	[0056.285] GetLastError () returned 0x0
	[0056.286] GetWindowThreadProcessId (in: hWnd=0x10092, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0x4d0
	[0056.286] GetLastError () returned 0x0
	[0056.286] GetWindowThreadProcessId (in: hWnd=0x60122, lpdwProcessId=0x19e460 | out: lpdwProcessId=0x19e460) returned 0xaec
	[0056.286] GetLastError () returned 0x0
	[0056.288] GetWindow (hWnd=0x60122, uCmd=0x4) returned 0x0
	[0056.290] IsWindowVisible (hWnd=0x60122) returned 1
	[0056.290] GetLastError () returned 0x0
	[0056.293] WerSetFlags () returned 0x0
	[0056.320] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1
	[0056.323] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x19e83c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x19e838 | out: pulNumLanguages=0x19e83c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x19e838) returned 1
	[0056.323] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x19e83c, pwszLanguagesBuffer=0x2b3be50, pcchLanguagesBuffer=0x19e838 | out: pulNumLanguages=0x19e83c, pwszLanguagesBuffer=0x2b3be50, pcchLanguagesBuffer=0x19e838) returned 1
	[0056.598] GetUserDefaultLocaleName (in: lpLocaleName=0x4fe098, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6
	[0056.632] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0056.632] GetLastError () returned 0xcb
	[0056.658] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0056.658] GetLastError () returned 0xcb
	[0056.659] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0056.659] GetLastError () returned 0xcb
	[0056.678] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0056.678] GetLastError () returned 0xcb
	[0056.678] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e2c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0056.678] GetLastError () returned 0xcb
	[0056.678] SetErrorMode (uMode=0x1) returned 0x1
	[0056.678] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x19e748 | out: lpFileInformation=0x19e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1
	[0056.678] GetLastError () returned 0xcb
	[0056.678] SetErrorMode (uMode=0x1) returned 0x1
	[0056.678] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x19e7cc | out: lpdwHandle=0x19e7cc) returned 0x94c
	[0056.679] GetLastError () returned 0x0
	[0056.679] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2b3e380 | out: lpData=0x2b3e380) returned 1
	[0056.680] VerQueryValueW (in: pBlock=0x2b3e380, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19e798, puLen=0x19e794 | out: lplpBuffer=0x19e798*=0x2b3e41c, puLen=0x19e794) returned 1
	[0056.680] VerQueryValueW (in: pBlock=0x2b3e380, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x19e714, puLen=0x19e710 | out: lplpBuffer=0x19e714*=0x2b3e4f8, puLen=0x19e710) returned 1
	[0056.680] lstrlenW (lpString="Microsoft Corporation") returned 21
	[0056.680] lstrcpyW (in: lpString1=0x4fe098, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation"
	[0056.681] VerQueryValueW (in: pBlock=0x2b3e380, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x19e714, puLen=0x19e710 | out: lplpBuffer=0x19e714*=0x2b3e54c, puLen=0x19e710) returned 1
	[0056.681] lstrlenW (lpString="System.Management.Automation") returned 28
	[0056.681] lstrcpyW (in: lpString1=0x4fe098, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation"
	[0056.681] VerQueryValueW (in: pBlock=0x2b3e380, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x19e714, puLen=0x19e710 | out: lplpBuffer=0x19e714*=0x2b3e5a8, puLen=0x19e710) returned 1
	[0056.681] lstrlenW (lpString="6.1.7601.17514") returned 14
	[0056.681] lstrcpyW (in: lpString1=0x4fe098, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514"
	[0056.681] VerQueryValueW (in: pBlock=0x2b3e380, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x19e714, puLen=0x19e710 | out: lplpBuffer=0x19e714*=0x2b3e5e8, puLen=0x19e710) returned 1
	[0056.681] lstrlenW (lpString="System.Management.Automation.dll") returned 32
	[0056.681] lstrcpyW (in: lpString1=0x4fe098, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll"
	[0056.681] VerQueryValueW (in: pBlock=0x2b3e380, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x19e714, puLen=0x19e710 | out: lplpBuffer=0x19e714*=0x2b3e650, puLen=0x19e710) returned 1
	[0056.681] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57
	[0056.681] lstrcpyW (in: lpString1=0x4fe098, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved."
	[0056.681] VerQueryValueW (in: pBlock=0x2b3e380, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x19e714, puLen=0x19e710 | out: lplpBuffer=0x19e714*=0x2b3e6ec, puLen=0x19e710) returned 1
	[0056.681] lstrlenW (lpString="System.Management.Automation.dll") returned 32
	[0056.681] lstrcpyW (in: lpString1=0x4fe098, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll"
	[0056.681] VerQueryValueW (in: pBlock=0x2b3e380, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x19e714, puLen=0x19e710 | out: lplpBuffer=0x19e714*=0x2b3e750, puLen=0x19e710) returned 1
	[0056.681] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42
	[0056.681] lstrcpyW (in: lpString1=0x4fe098, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System"
	[0056.682] VerQueryValueW (in: pBlock=0x2b3e380, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x19e714, puLen=0x19e710 | out: lplpBuffer=0x19e714*=0x2b3e7cc, puLen=0x19e710) returned 1
	[0056.682] lstrlenW (lpString="6.1.7601.17514") returned 14
	[0056.682] lstrcpyW (in: lpString1=0x4fe098, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514"
	[0056.682] VerQueryValueW (in: pBlock=0x2b3e380, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x19e714, puLen=0x19e710 | out: lplpBuffer=0x19e714*=0x2b3e474, puLen=0x19e710) returned 1
	[0056.682] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49
	[0056.682] lstrcpyW (in: lpString1=0x4fe098, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly"
	[0056.682] VerQueryValueW (in: pBlock=0x2b3e380, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x19e714, puLen=0x19e710 | out: lplpBuffer=0x19e714*=0x0, puLen=0x19e710) returned 0
	[0056.682] VerQueryValueW (in: pBlock=0x2b3e380, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x19e714, puLen=0x19e710 | out: lplpBuffer=0x19e714*=0x0, puLen=0x19e710) returned 0
	[0056.682] VerQueryValueW (in: pBlock=0x2b3e380, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x19e714, puLen=0x19e710 | out: lplpBuffer=0x19e714*=0x0, puLen=0x19e710) returned 0
	[0056.682] VerQueryValueW (in: pBlock=0x2b3e380, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19e708, puLen=0x19e704 | out: lplpBuffer=0x19e708*=0x2b3e41c, puLen=0x19e704) returned 1
	[0056.682] VerLanguageNameW (in: wLang=0x0, szLang=0x4fe098, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10
	[0056.682] VerQueryValueW (in: pBlock=0x2b3e380, lpSubBlock="\\", lplpBuffer=0x19e71c, puLen=0x19e718 | out: lplpBuffer=0x19e71c*=0x2b3e3a8, puLen=0x19e718) returned 1
	[0056.690] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0056.690] GetLastError () returned 0xcb
	[0056.731] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0056.731] GetLastError () returned 0xcb
	[0056.735] lstrlenW (lpString="䅁") returned 1
	[0056.738] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e6e0 | out: phkResult=0x19e6e0*=0x320) returned 0x0
	[0056.739] RegOpenKeyExW (in: hKey=0x320, lpSubKey="1", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e6e4 | out: phkResult=0x19e6e4*=0x324) returned 0x0
	[0056.739] RegOpenKeyExW (in: hKey=0x324, lpSubKey="PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e718 | out: phkResult=0x19e718*=0x328) returned 0x0
	[0056.742] RegQueryValueExW (in: hKey=0x328, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e758, lpData=0x0, lpcbData=0x19e754*=0x0 | out: lpType=0x19e758*=0x1, lpData=0x0, lpcbData=0x19e754*=0x56) returned 0x0
	[0056.743] RegQueryValueExW (in: hKey=0x328, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e758, lpData=0x4fe098, lpcbData=0x19e754*=0x56 | out: lpType=0x19e758*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x19e754*=0x56) returned 0x0
	[0056.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0056.747] GetLastError () returned 0x0
	[0056.749] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0056.749] GetLastError () returned 0x0
	[0056.760] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0056.760] GetLastError () returned 0x0
	[0056.807] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0056.807] GetLastError () returned 0xcb
	[0057.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x19e220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e
	[0057.594] GetLastError () returned 0x2
	[0057.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x19e220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e
	[0057.594] GetLastError () returned 0x2
	[0057.864] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0057.864] GetLastError () returned 0xcb
	[0057.866] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0057.866] GetLastError () returned 0xcb
	[0057.898] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0057.898] GetLastError () returned 0xcb
	[0057.899] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0057.899] GetLastError () returned 0xcb
	[0057.900] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0057.900] GetLastError () returned 0xcb
	[0058.132] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x19e220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70
	[0058.132] GetLastError () returned 0x0
	[0058.132] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x19e220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70
	[0058.132] GetLastError () returned 0x0
	[0058.313] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0058.313] GetLastError () returned 0xcb
	[0058.319] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0058.319] GetLastError () returned 0xcb
	[0058.385] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0058.385] GetLastError () returned 0x7e
	[0058.385] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0058.385] GetLastError () returned 0x7e
	[0059.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x19e220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
	[0059.890] GetLastError () returned 0x2
	[0059.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x19e220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
	[0059.890] GetLastError () returned 0x2
	[0060.317] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0060.317] GetLastError () returned 0x57
	[0060.318] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0060.318] GetLastError () returned 0x57
	[0061.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x19e220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
	[0061.088] GetLastError () returned 0x2
	[0061.088] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x19e220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
	[0061.088] GetLastError () returned 0x2
	[0061.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x19e220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
	[0061.747] GetLastError () returned 0x2
	[0061.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x19e220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
	[0061.747] GetLastError () returned 0x2
	[0061.841] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0061.841] GetLastError () returned 0xcb
	[0061.842] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0061.842] GetLastError () returned 0xcb
	[0061.842] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e298, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0061.842] GetLastError () returned 0xcb
	[0061.842] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e298, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0061.842] GetLastError () returned 0xcb
	[0061.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e298, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0061.867] GetLastError () returned 0xcb
	[0061.991] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x19e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c
	[0061.991] GetLastError () returned 0x2
	[0061.991] SetErrorMode (uMode=0x1) returned 0x1
	[0061.992] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x19e6d4 | out: lpFileInformation=0x19e6d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0061.992] GetLastError () returned 0x2
	[0061.992] SetErrorMode (uMode=0x1) returned 0x1
	[0062.221] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.221] GetLastError () returned 0x0
	[0062.221] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e298, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.221] GetLastError () returned 0x0
	[0062.222] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e298, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.223] GetLastError () returned 0x0
	[0062.225] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.225] GetLastError () returned 0xcb
	[0062.229] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.229] GetLastError () returned 0xcb
	[0062.229] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.229] GetLastError () returned 0xcb
	[0062.234] CoCreateGuid (in: pguid=0x19e7b4 | out: pguid=0x19e7b4*(Data1=0x19497ae7, Data2=0x9375, Data3=0x4abf, Data4=([0]=0x9f, [1]=0x55, [2]=0x76, [3]=0x3d, [4]=0xad, [5]=0x6f, [6]=0x2f, [7]=0x31))) returned 0x0
	[0062.241] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.241] GetLastError () returned 0xcb
	[0062.244] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.244] GetLastError () returned 0xcb
	[0062.246] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.246] GetLastError () returned 0xcb
	[0062.257] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf
	[0062.258] GetLastError () returned 0x0
	[0062.261] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x19e694 | out: lpConsoleScreenBufferInfo=0x19e694) returned 1
	[0062.261] GetLastError () returned 0x0
	[0062.267] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13
	[0062.267] GetLastError () returned 0x0
	[0062.267] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x19e694 | out: lpConsoleScreenBufferInfo=0x19e694) returned 1
	[0062.267] GetLastError () returned 0x0
	[0062.268] GetVersionExW (in: lpVersionInformation=0x4fe0b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x4fe0b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0062.268] GetLastError () returned 0x0
	[0062.270] GetCurrentProcess () returned 0xffffffff
	[0062.270] GetLastError () returned 0x3f0
	[0062.271] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e6a4 | out: TokenHandle=0x19e6a4*=0x344) returned 1
	[0062.271] GetLastError () returned 0x3f0
	[0062.274] GetTokenInformation (in: TokenHandle=0x344, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19e6fc | out: TokenInformation=0x0, ReturnLength=0x19e6fc) returned 0
	[0062.274] GetLastError () returned 0x7a
	[0062.274] GetTokenInformation (in: TokenHandle=0x344, TokenInformationClass=0x8, TokenInformation=0x50f7f8, TokenInformationLength=0x4, ReturnLength=0x19e6fc | out: TokenInformation=0x50f7f8, ReturnLength=0x19e6fc) returned 1
	[0062.274] GetLastError () returned 0x7a
	[0062.276] DuplicateTokenEx (in: hExistingToken=0x344, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x19e6b4 | out: phNewToken=0x19e6b4*=0x33c) returned 1
	[0062.276] GetLastError () returned 0x7f
	[0062.276] GetTokenInformation (in: TokenHandle=0x344, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19e6fc | out: TokenInformation=0x0, ReturnLength=0x19e6fc) returned 0
	[0062.276] GetLastError () returned 0x7a
	[0062.276] GetTokenInformation (in: TokenHandle=0x344, TokenInformationClass=0x8, TokenInformation=0x50f7d8, TokenInformationLength=0x4, ReturnLength=0x19e6fc | out: TokenInformation=0x50f7d8, ReturnLength=0x19e6fc) returned 1
	[0062.276] GetLastError () returned 0x7a
	[0062.277] CheckTokenMembership (in: TokenHandle=0x33c, SidToCheck=0x2bc11f4*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x19e690 | out: IsMember=0x19e690) returned 1
	[0062.277] GetLastError () returned 0x7a
	[0062.277] CloseHandle (hObject=0x33c) returned 1
	[0062.277] GetLastError () returned 0x7a
	[0062.277] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e1a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.277] GetLastError () returned 0x7a
	[0062.277] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e154, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.277] GetLastError () returned 0x7a
	[0062.277] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e154, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.277] GetLastError () returned 0x7a
	[0062.277] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e154, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.277] GetLastError () returned 0x7a
	[0062.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e1a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.323] GetLastError () returned 0x7a
	[0062.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e154, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.323] GetLastError () returned 0x7a
	[0062.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e154, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.323] GetLastError () returned 0x7a
	[0062.331] GetConsoleTitleW (in: lpConsoleTitle=0x4fe858, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39
	[0062.331] GetLastError () returned 0x7a
	[0062.363] GetConsoleTitleW (in: lpConsoleTitle=0x4fe858, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39
	[0062.363] GetLastError () returned 0x7a
	[0062.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.363] GetLastError () returned 0x7a
	[0062.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.363] GetLastError () returned 0x7a
	[0062.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.363] GetLastError () returned 0x7a
	[0062.369] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 1
	[0062.377] GetLastError () returned 0x7a
	[0062.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e1d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.378] GetLastError () returned 0x7a
	[0062.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e184, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.378] GetLastError () returned 0x7a
	[0062.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e184, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.378] GetLastError () returned 0x7a
	[0062.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e184, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.378] GetLastError () returned 0x7a
	[0062.428] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e1d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.428] GetLastError () returned 0x7a
	[0062.428] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e184, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.428] GetLastError () returned 0x7a
	[0062.428] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e184, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.428] GetLastError () returned 0x7a
	[0062.428] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e1d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.428] GetLastError () returned 0x7a
	[0062.428] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e184, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.428] GetLastError () returned 0x7a
	[0062.429] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e184, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.429] GetLastError () returned 0x7a
	[0062.429] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e1e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.429] GetLastError () returned 0x7a
	[0062.429] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e198, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.429] GetLastError () returned 0x7a
	[0062.429] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e198, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.429] GetLastError () returned 0x7a
	[0062.429] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19e198, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0062.429] GetLastError () returned 0x7a
	[0062.469] SetConsoleCtrlHandler (HandlerRoutine=0x298384a, Add=1) returned 1
	[0062.469] GetLastError () returned 0x7a
	[0062.480] GetFullPathNameW (in: lpFileName="takeaway.ps1", nBufferLength=0x105, lpBuffer=0x19e108, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x32
	[0062.480] GetLastError () returned 0x7a
	[0062.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1", nBufferLength=0x105, lpBuffer=0x19e0f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x32
	[0062.480] GetLastError () returned 0x7a
	[0062.480] SetErrorMode (uMode=0x1) returned 0x1
	[0062.480] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway.ps1"), fInfoLevelId=0x0, lpFileInformation=0x19e574 | out: lpFileInformation=0x19e574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de29640, ftCreationTime.dwHighDateTime=0x1d59309, ftLastAccessTime.dwLowDateTime=0x7de29640, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x45b9a085, ftLastWriteTime.dwHighDateTime=0x1d3ff7f, nFileSizeHigh=0x0, nFileSizeLow=0xd4b)) returned 1
	[0062.480] GetLastError () returned 0x7a
	[0062.480] SetErrorMode (uMode=0x1) returned 0x1
	[0062.492] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.492] GetLastError () returned 0xcb
	[0062.496] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.496] GetLastError () returned 0xcb
	[0062.573] SetEnvironmentVariableW (lpName="PSExecutionPolicyPreference", lpValue="Bypass") returned 1
	[0062.573] GetLastError () returned 0xcb
	[0062.581] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x33c
	[0062.581] GetLastError () returned 0x0
	[0062.583] CoCreateGuid (in: pguid=0x19e6c8 | out: pguid=0x19e6c8*(Data1=0x50f9db0b, Data2=0x1f7a, Data3=0x4ea5, Data4=([0]=0x8c, [1]=0x45, [2]=0x84, [3]=0x32, [4]=0xd1, [5]=0x88, [6]=0x1a, [7]=0xf5))) returned 0x0
	[0062.724] WinSqmIsOptedIn () returned 0x0
	[0062.725] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.725] GetLastError () returned 0xcb
	[0062.728] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.728] GetLastError () returned 0xcb
	[0062.729] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.729] GetLastError () returned 0xcb
	[0062.729] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.729] GetLastError () returned 0xcb
	[0062.730] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.730] GetLastError () returned 0xcb
	[0062.731] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.731] GetLastError () returned 0xcb
	[0062.731] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.732] GetLastError () returned 0xcb
	[0062.732] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.732] GetLastError () returned 0xcb
	[0062.736] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.736] GetLastError () returned 0xcb
	[0062.757] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.757] GetLastError () returned 0xcb
	[0062.760] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.760] GetLastError () returned 0xcb
	[0062.760] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.760] GetLastError () returned 0xcb
	[0063.264] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.265] GetLastError () returned 0xcb
	[0063.265] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.265] GetLastError () returned 0xcb
	[0063.265] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.265] GetLastError () returned 0xcb
	[0063.265] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.265] GetLastError () returned 0xcb
	[0063.334] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.334] GetLastError () returned 0x3
	[0063.335] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.335] GetLastError () returned 0x3
	[0063.335] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.335] GetLastError () returned 0x3
	[0063.335] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.335] GetLastError () returned 0x3
	[0063.335] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.335] GetLastError () returned 0x3
	[0063.335] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.335] GetLastError () returned 0x3
	[0063.335] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.335] GetLastError () returned 0x3
	[0063.335] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.335] GetLastError () returned 0x3
	[0063.335] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.335] GetLastError () returned 0x3
	[0063.335] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.335] GetLastError () returned 0x3
	[0063.335] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.336] GetLastError () returned 0x3
	[0063.336] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0063.336] GetLastError () returned 0x3
	[0063.338] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x33
	[0063.338] GetLastError () returned 0x3
	[0063.341] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x4fe098, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34
	[0063.341] GetLastError () returned 0x3
	[0063.341] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e4e0 | out: phkResult=0x19e4e0*=0x348) returned 0x0
	[0063.341] RegQueryValueExW (in: hKey=0x348, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x19e524, lpData=0x0, lpcbData=0x19e520*=0x0 | out: lpType=0x19e524*=0x2, lpData=0x0, lpcbData=0x19e520*=0x6c) returned 0x0
	[0063.342] RegQueryValueExW (in: hKey=0x348, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x19e524, lpData=0x4fe098, lpcbData=0x19e520*=0x6c | out: lpType=0x19e524*=0x2, lpData="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpcbData=0x19e520*=0x6c) returned 0x0
	[0063.342] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x4fe098, nSize=0x64 | out: lpDst="C:\\Windows") returned 0xb
	[0063.342] GetLastError () returned 0x3
	[0063.342] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x4fe098, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34
	[0063.343] GetLastError () returned 0x3
	[0063.343] RegCloseKey (hKey=0x348) returned 0x0
	[0063.343] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x4fe098, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34
	[0063.343] GetLastError () returned 0x3
	[0063.344] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e4e0 | out: phkResult=0x19e4e0*=0x348) returned 0x0
	[0063.344] RegQueryValueExW (in: hKey=0x348, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x19e524, lpData=0x0, lpcbData=0x19e520*=0x0 | out: lpType=0x19e524*=0x0, lpData=0x0, lpcbData=0x19e520*=0x0) returned 0x2
	[0063.345] RegCloseKey (hKey=0x348) returned 0x0
	[0063.364] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x4fe098 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0
	[0063.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x19e048, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27
	[0063.367] GetLastError () returned 0x3f0
	[0063.367] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 1
	[0063.367] GetLastError () returned 0x3f0
	[0063.379] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0063.380] GetLastError () returned 0xcb
	[0063.387] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e460 | out: phkResult=0x19e460*=0x350) returned 0x0
	[0063.389] RegQueryValueExW (in: hKey=0x350, lpValueName="path", lpReserved=0x0, lpType=0x19e4c8, lpData=0x0, lpcbData=0x19e4c4*=0x0 | out: lpType=0x19e4c8*=0x1, lpData=0x0, lpcbData=0x19e4c4*=0x74) returned 0x0
	[0063.389] RegQueryValueExW (in: hKey=0x350, lpValueName="path", lpReserved=0x0, lpType=0x19e4a8, lpData=0x0, lpcbData=0x19e4a4*=0x0 | out: lpType=0x19e4a8*=0x1, lpData=0x0, lpcbData=0x19e4a4*=0x74) returned 0x0
	[0063.389] RegQueryValueExW (in: hKey=0x350, lpValueName="path", lpReserved=0x0, lpType=0x19e4a8, lpData=0x4fe098, lpcbData=0x19e4a4*=0x74 | out: lpType=0x19e4a8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x19e4a4*=0x74) returned 0x0
	[0063.390] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x19e028, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a
	[0063.390] GetLastError () returned 0xcb
	[0063.390] SetErrorMode (uMode=0x1) returned 0x1
	[0063.390] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x19e4a8 | out: lpFileInformation=0x19e4a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0063.390] GetLastError () returned 0xcb
	[0063.390] SetErrorMode (uMode=0x1) returned 0x1
	[0063.393] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x19e01c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40
	[0063.393] GetLastError () returned 0xcb
	[0063.393] SetErrorMode (uMode=0x1) returned 0x1
	[0063.393] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x19e49c | out: lpFileInformation=0x19e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1
	[0063.394] GetLastError () returned 0xcb
	[0063.394] SetErrorMode (uMode=0x1) returned 0x1
	[0063.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x19e01c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
	[0063.397] GetLastError () returned 0xcb
	[0063.397] SetErrorMode (uMode=0x1) returned 0x1
	[0063.397] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x19e49c | out: lpFileInformation=0x19e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1
	[0063.399] GetLastError () returned 0xcb
	[0063.399] SetErrorMode (uMode=0x1) returned 0x1
	[0063.408] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0063.408] GetLastError () returned 0xcb
	[0063.410] GetACP () returned 0x4e4
	[0063.426] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x19deac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40
	[0063.426] GetLastError () returned 0x0
	[0063.426] SetErrorMode (uMode=0x1) returned 0x1
	[0063.428] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354
	[0063.429] GetLastError () returned 0x0
	[0063.430] GetFileType (hFile=0x354) returned 0x1
	[0063.430] SetErrorMode (uMode=0x1) returned 0x1
	[0063.430] GetFileType (hFile=0x354) returned 0x1
	[0063.432] ReadFile (in: hFile=0x354, lpBuffer=0x2c228c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c228c0*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.435] GetLastError () returned 0x0
	[0063.435] ReadFile (in: hFile=0x354, lpBuffer=0x2c228c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c228c0*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.436] GetLastError () returned 0x0
	[0063.436] ReadFile (in: hFile=0x354, lpBuffer=0x2c228c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c228c0*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.436] GetLastError () returned 0x0
	[0063.437] ReadFile (in: hFile=0x354, lpBuffer=0x2c228c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c228c0*, lpNumberOfBytesRead=0x19e414*=0xcf3, lpOverlapped=0x0) returned 1
	[0063.437] GetLastError () returned 0x0
	[0063.437] ReadFile (in: hFile=0x354, lpBuffer=0x2c21d53, nNumberOfBytesToRead=0x30d, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c21d53*, lpNumberOfBytesRead=0x19e414*=0x0, lpOverlapped=0x0) returned 1
	[0063.437] GetLastError () returned 0x0
	[0063.437] ReadFile (in: hFile=0x354, lpBuffer=0x2c228c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c228c0*, lpNumberOfBytesRead=0x19e414*=0x0, lpOverlapped=0x0) returned 1
	[0063.437] GetLastError () returned 0x0
	[0063.438] CloseHandle (hObject=0x354) returned 1
	[0063.438] GetLastError () returned 0x0
	[0063.439] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x19df74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40
	[0063.439] GetLastError () returned 0x0
	[0063.439] SetErrorMode (uMode=0x1) returned 0x1
	[0063.439] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2c33c34 | out: lpFileInformation=0x2c33c34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1
	[0063.440] GetLastError () returned 0x0
	[0063.440] SetErrorMode (uMode=0x1) returned 0x1
	[0063.442] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x19df40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40
	[0063.442] GetLastError () returned 0x0
	[0063.442] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e398 | out: phkResult=0x19e398*=0x354) returned 0x0
	[0063.442] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e3e0, lpData=0x0, lpcbData=0x19e3dc*=0x0 | out: lpType=0x19e3e0*=0x1, lpData=0x0, lpcbData=0x19e3dc*=0x56) returned 0x0
	[0063.443] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e3e0, lpData=0x4fe098, lpcbData=0x19e3dc*=0x56 | out: lpType=0x19e3e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x19e3dc*=0x56) returned 0x0
	[0063.443] RegCloseKey (hKey=0x354) returned 0x0
	[0063.443] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x19df40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40
	[0063.443] GetLastError () returned 0x0
	[0063.443] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x19ded4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40
	[0063.443] GetLastError () returned 0x0
	[0063.499] GetSystemInfo (in: lpSystemInfo=0x19db18 | out: lpSystemInfo=0x19db18*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0063.500] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.542] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x19deac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
	[0063.542] GetLastError () returned 0x0
	[0063.542] SetErrorMode (uMode=0x1) returned 0x1
	[0063.543] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354
	[0063.543] GetLastError () returned 0x0
	[0063.543] GetFileType (hFile=0x354) returned 0x1
	[0063.543] SetErrorMode (uMode=0x1) returned 0x1
	[0063.543] GetFileType (hFile=0x354) returned 0x1
	[0063.543] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.545] GetLastError () returned 0x0
	[0063.545] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.546] GetLastError () returned 0x0
	[0063.547] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.547] GetLastError () returned 0x0
	[0063.547] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.547] GetLastError () returned 0x0
	[0063.547] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.547] GetLastError () returned 0x0
	[0063.549] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.549] GetLastError () returned 0x0
	[0063.549] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.549] GetLastError () returned 0x0
	[0063.549] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.549] GetLastError () returned 0x0
	[0063.549] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.549] GetLastError () returned 0x0
	[0063.550] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.550] GetLastError () returned 0x0
	[0063.550] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.550] GetLastError () returned 0x0
	[0063.551] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.551] GetLastError () returned 0x0
	[0063.551] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.551] GetLastError () returned 0x0
	[0063.551] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.551] GetLastError () returned 0x0
	[0063.551] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.551] GetLastError () returned 0x0
	[0063.551] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.552] GetLastError () returned 0x0
	[0063.552] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.552] GetLastError () returned 0x0
	[0063.554] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.554] GetLastError () returned 0x0
	[0063.554] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.554] GetLastError () returned 0x0
	[0063.555] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.555] GetLastError () returned 0x0
	[0063.555] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.555] GetLastError () returned 0x0
	[0063.555] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.555] GetLastError () returned 0x0
	[0063.555] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.555] GetLastError () returned 0x0
	[0063.555] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.556] GetLastError () returned 0x0
	[0063.556] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.556] GetLastError () returned 0x0
	[0063.556] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.556] GetLastError () returned 0x0
	[0063.556] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.556] GetLastError () returned 0x0
	[0063.556] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.556] GetLastError () returned 0x0
	[0063.557] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.557] GetLastError () returned 0x0
	[0063.557] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.557] GetLastError () returned 0x0
	[0063.557] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.557] GetLastError () returned 0x0
	[0063.557] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.557] GetLastError () returned 0x0
	[0063.557] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.557] GetLastError () returned 0x0
	[0063.562] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.562] GetLastError () returned 0x0
	[0063.562] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.562] GetLastError () returned 0x0
	[0063.563] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.563] GetLastError () returned 0x0
	[0063.563] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.563] GetLastError () returned 0x0
	[0063.563] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.563] GetLastError () returned 0x0
	[0063.563] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.563] GetLastError () returned 0x0
	[0063.563] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.563] GetLastError () returned 0x0
	[0063.564] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1000, lpOverlapped=0x0) returned 1
	[0063.564] GetLastError () returned 0x0
	[0063.564] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x1b4, lpOverlapped=0x0) returned 1
	[0063.564] GetLastError () returned 0x0
	[0063.564] ReadFile (in: hFile=0x354, lpBuffer=0x2c68044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e414, lpOverlapped=0x0 | out: lpBuffer=0x2c68044*, lpNumberOfBytesRead=0x19e414*=0x0, lpOverlapped=0x0) returned 1
	[0063.564] GetLastError () returned 0x0
	[0063.564] CloseHandle (hObject=0x354) returned 1
	[0063.564] GetLastError () returned 0x0
	[0063.564] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x19df74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
	[0063.564] GetLastError () returned 0x0
	[0063.564] SetErrorMode (uMode=0x1) returned 0x1
	[0063.564] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2c888d4 | out: lpFileInformation=0x2c888d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1
	[0063.565] GetLastError () returned 0x0
	[0063.565] SetErrorMode (uMode=0x1) returned 0x1
	[0063.565] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x19df40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
	[0063.565] GetLastError () returned 0x0
	[0063.565] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e398 | out: phkResult=0x19e398*=0x354) returned 0x0
	[0063.565] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e3e0, lpData=0x0, lpcbData=0x19e3dc*=0x0 | out: lpType=0x19e3e0*=0x1, lpData=0x0, lpcbData=0x19e3dc*=0x56) returned 0x0
	[0063.565] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e3e0, lpData=0x4fe098, lpcbData=0x19e3dc*=0x56 | out: lpType=0x19e3e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x19e3dc*=0x56) returned 0x0
	[0063.565] RegCloseKey (hKey=0x354) returned 0x0
	[0063.565] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x19df40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
	[0063.565] GetLastError () returned 0x0
	[0063.565] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x19ded4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
	[0063.565] GetLastError () returned 0x0
	[0063.756] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.763] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.766] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.766] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.766] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.766] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.767] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.769] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.783] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.783] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.784] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.784] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.784] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.784] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.785] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.785] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.792] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.799] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.799] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.801] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.801] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.802] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.802] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.803] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.803] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.804] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.805] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.805] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.805] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.805] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.808] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.811] VirtualQuery (in: lpAddress=0x19d2d8, lpBuffer=0x19e2d8, dwLength=0x1c | out: lpBuffer=0x19e2d8*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.812] VirtualQuery (in: lpAddress=0x19d2d8, lpBuffer=0x19e2d8, dwLength=0x1c | out: lpBuffer=0x19e2d8*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.812] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.813] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.852] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.852] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.852] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.859] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0063.859] GetLastError () returned 0xcb
	[0063.862] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.871] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.871] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.872] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.872] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.873] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.874] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.877] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.880] VirtualQuery (in: lpAddress=0x19d2d4, lpBuffer=0x19e2d4, dwLength=0x1c | out: lpBuffer=0x19e2d4*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0063.881] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e45c | out: phkResult=0x19e45c*=0x350) returned 0x0
	[0063.881] RegQueryValueExW (in: hKey=0x350, lpValueName="path", lpReserved=0x0, lpType=0x19e4c4, lpData=0x0, lpcbData=0x19e4c0*=0x0 | out: lpType=0x19e4c4*=0x1, lpData=0x0, lpcbData=0x19e4c0*=0x74) returned 0x0
	[0063.881] RegQueryValueExW (in: hKey=0x350, lpValueName="path", lpReserved=0x0, lpType=0x19e4a4, lpData=0x0, lpcbData=0x19e4a0*=0x0 | out: lpType=0x19e4a4*=0x1, lpData=0x0, lpcbData=0x19e4a0*=0x74) returned 0x0
	[0063.882] RegQueryValueExW (in: hKey=0x350, lpValueName="path", lpReserved=0x0, lpType=0x19e4a4, lpData=0x4fe098, lpcbData=0x19e4a0*=0x74 | out: lpType=0x19e4a4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x19e4a0*=0x74) returned 0x0
	[0063.882] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x19e024, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a
	[0063.882] GetLastError () returned 0xcb
	[0063.882] SetErrorMode (uMode=0x1) returned 0x1
	[0063.882] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x19e4a4 | out: lpFileInformation=0x19e4a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0063.882] GetLastError () returned 0xcb
	[0063.882] SetErrorMode (uMode=0x1) returned 0x1
	[0063.882] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x19e018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44
	[0063.882] GetLastError () returned 0xcb
	[0063.883] SetErrorMode (uMode=0x1) returned 0x1
	[0063.883] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x19e498 | out: lpFileInformation=0x19e498*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a02ba41, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a02ba41, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e5e3fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1
	[0063.884] GetLastError () returned 0xcb
	[0063.884] SetErrorMode (uMode=0x1) returned 0x1
	[0063.884] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19e018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e
	[0063.884] GetLastError () returned 0xcb
	[0063.884] SetErrorMode (uMode=0x1) returned 0x1
	[0063.884] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x19e498 | out: lpFileInformation=0x19e498*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1f4ab5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1f4ab5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd374b67c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1
	[0063.885] GetLastError () returned 0xcb
	[0063.885] SetErrorMode (uMode=0x1) returned 0x1
	[0063.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19e018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0063.885] GetLastError () returned 0xcb
	[0063.885] SetErrorMode (uMode=0x1) returned 0x1
	[0063.885] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x19e498 | out: lpFileInformation=0x19e498*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a051ba0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a051ba0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2d2d8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1
	[0063.886] GetLastError () returned 0xcb
	[0063.886] SetErrorMode (uMode=0x1) returned 0x1
	[0063.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19e018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0063.887] GetLastError () returned 0xcb
	[0063.887] SetErrorMode (uMode=0x1) returned 0x1
	[0063.887] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x19e498 | out: lpFileInformation=0x19e498*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a077cff, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a077cff, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e8455c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1
	[0063.887] GetLastError () returned 0xcb
	[0063.887] SetErrorMode (uMode=0x1) returned 0x1
	[0063.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19e018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43
	[0063.888] GetLastError () returned 0xcb
	[0063.888] SetErrorMode (uMode=0x1) returned 0x1
	[0063.888] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x19e498 | out: lpFileInformation=0x19e498*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0c3fbd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0c3fbd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2eaa6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1
	[0063.888] GetLastError () returned 0xcb
	[0063.888] SetErrorMode (uMode=0x1) returned 0x1
	[0063.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19e018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d
	[0063.888] GetLastError () returned 0xcb
	[0063.888] SetErrorMode (uMode=0x1) returned 0x1
	[0063.888] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x19e498 | out: lpFileInformation=0x19e498*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11027b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a11027b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2ed081c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1
	[0063.888] GetLastError () returned 0xcb
	[0063.888] SetErrorMode (uMode=0x1) returned 0x1
	[0063.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19e018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47
	[0063.889] GetLastError () returned 0xcb
	[0063.889] SetErrorMode (uMode=0x1) returned 0x1
	[0063.889] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x19e498 | out: lpFileInformation=0x19e498*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a182698, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a182698, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd368cf9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x15e67)) returned 1
	[0063.889] GetLastError () returned 0xcb
	[0063.889] SetErrorMode (uMode=0x1) returned 0x1
	[0063.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19e018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48
	[0063.889] GetLastError () returned 0xcb
	[0063.889] SetErrorMode (uMode=0x1) returned 0x1
	[0063.889] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x19e498 | out: lpFileInformation=0x19e498*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1a87f7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1a87f7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd36b30fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x48b4)) returned 1
	[0063.889] GetLastError () returned 0xcb
	[0063.890] SetErrorMode (uMode=0x1) returned 0x1
	[0063.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19e018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41
	[0063.890] GetLastError () returned 0xcb
	[0063.890] SetErrorMode (uMode=0x1) returned 0x1
	[0063.890] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x19e498 | out: lpFileInformation=0x19e498*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1ce956, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1ce956, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd372551c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x4e98)) returned 1
	[0063.890] GetLastError () returned 0xcb
	[0063.890] SetErrorMode (uMode=0x1) returned 0x1
	[0063.897] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44
	[0063.897] GetLastError () returned 0xcb
	[0063.897] SetErrorMode (uMode=0x1) returned 0x1
	[0063.897] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320
	[0063.897] GetLastError () returned 0x0
	[0063.897] GetFileType (hFile=0x320) returned 0x1
	[0063.897] SetErrorMode (uMode=0x1) returned 0x1
	[0063.897] GetFileType (hFile=0x320) returned 0x1
	[0063.897] ReadFile (in: hFile=0x320, lpBuffer=0x2f2e450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f2e450*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0063.900] GetLastError () returned 0x0
	[0063.902] ReadFile (in: hFile=0x320, lpBuffer=0x2f2e450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f2e450*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0063.902] GetLastError () returned 0x0
	[0063.903] ReadFile (in: hFile=0x320, lpBuffer=0x2f2e450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f2e450*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0063.903] GetLastError () returned 0x0
	[0063.903] ReadFile (in: hFile=0x320, lpBuffer=0x2f2e450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f2e450*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0063.903] GetLastError () returned 0x0
	[0063.904] ReadFile (in: hFile=0x320, lpBuffer=0x2f2e450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f2e450*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0063.904] GetLastError () returned 0x0
	[0063.904] ReadFile (in: hFile=0x320, lpBuffer=0x2f2e450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f2e450*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0063.904] GetLastError () returned 0x0
	[0063.904] ReadFile (in: hFile=0x320, lpBuffer=0x2f2e450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f2e450*, lpNumberOfBytesRead=0x19e314*=0x9e2, lpOverlapped=0x0) returned 1
	[0063.904] GetLastError () returned 0x0
	[0063.904] ReadFile (in: hFile=0x320, lpBuffer=0x2f2d9d2, nNumberOfBytesToRead=0x21e, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f2d9d2*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0063.904] GetLastError () returned 0x0
	[0063.904] ReadFile (in: hFile=0x320, lpBuffer=0x2f2e450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f2e450*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0063.904] GetLastError () returned 0x0
	[0063.905] CloseHandle (hObject=0x320) returned 1
	[0063.905] GetLastError () returned 0x0
	[0063.905] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44
	[0063.905] GetLastError () returned 0x0
	[0063.905] SetErrorMode (uMode=0x1) returned 0x1
	[0063.905] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2f3f50c | out: lpFileInformation=0x2f3f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a02ba41, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a02ba41, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e5e3fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1
	[0063.905] GetLastError () returned 0x0
	[0063.905] SetErrorMode (uMode=0x1) returned 0x1
	[0063.905] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44
	[0063.905] GetLastError () returned 0x0
	[0063.905] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e298 | out: phkResult=0x19e298*=0x320) returned 0x0
	[0063.906] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x0, lpcbData=0x19e2dc*=0x0 | out: lpType=0x19e2e0*=0x1, lpData=0x0, lpcbData=0x19e2dc*=0x56) returned 0x0
	[0063.906] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x4fe098, lpcbData=0x19e2dc*=0x56 | out: lpType=0x19e2e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x19e2dc*=0x56) returned 0x0
	[0063.906] RegCloseKey (hKey=0x320) returned 0x0
	[0063.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44
	[0063.906] GetLastError () returned 0x0
	[0063.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44
	[0063.906] GetLastError () returned 0x0
	[0063.932] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xfc91b896, Data2=0xc1f8, Data3=0x4d95, Data4=([0]=0xa5, [1]=0x23, [2]=0xdf, [3]=0xa0, [4]=0x93, [5]=0x1d, [6]=0x5, [7]=0x93))) returned 0x0
	[0063.957] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x948f24c5, Data2=0xbd0, Data3=0x4db9, Data4=([0]=0x89, [1]=0x63, [2]=0x27, [3]=0xfd, [4]=0x60, [5]=0x6e, [6]=0xb3, [7]=0xc7))) returned 0x0
	[0063.959] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e
	[0063.959] GetLastError () returned 0x0
	[0063.959] SetErrorMode (uMode=0x1) returned 0x1
	[0063.959] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320
	[0063.959] GetLastError () returned 0x0
	[0063.959] GetFileType (hFile=0x320) returned 0x1
	[0063.959] SetErrorMode (uMode=0x1) returned 0x1
	[0063.960] GetFileType (hFile=0x320) returned 0x1
	[0063.960] ReadFile (in: hFile=0x320, lpBuffer=0x2f527f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f527f4*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0063.962] GetLastError () returned 0x0
	[0063.963] ReadFile (in: hFile=0x320, lpBuffer=0x2f527f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f527f4*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0063.963] GetLastError () returned 0x0
	[0063.963] ReadFile (in: hFile=0x320, lpBuffer=0x2f527f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f527f4*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0063.963] GetLastError () returned 0x0
	[0063.964] ReadFile (in: hFile=0x320, lpBuffer=0x2f527f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f527f4*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0063.964] GetLastError () returned 0x0
	[0063.964] ReadFile (in: hFile=0x320, lpBuffer=0x2f527f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f527f4*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0063.964] GetLastError () returned 0x0
	[0063.998] ReadFile (in: hFile=0x320, lpBuffer=0x2f527f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f527f4*, lpNumberOfBytesRead=0x19e314*=0xfb2, lpOverlapped=0x0) returned 1
	[0063.998] GetLastError () returned 0x0
	[0063.998] ReadFile (in: hFile=0x320, lpBuffer=0x2f51f46, nNumberOfBytesToRead=0x4e, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f51f46*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0063.998] GetLastError () returned 0x0
	[0063.998] ReadFile (in: hFile=0x320, lpBuffer=0x2f527f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f527f4*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0063.998] GetLastError () returned 0x0
	[0063.998] CloseHandle (hObject=0x320) returned 1
	[0064.002] GetLastError () returned 0x0
	[0064.002] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e
	[0064.002] GetLastError () returned 0x0
	[0064.003] SetErrorMode (uMode=0x1) returned 0x1
	[0064.003] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2f73084 | out: lpFileInformation=0x2f73084*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1f4ab5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1f4ab5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd374b67c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1
	[0064.003] GetLastError () returned 0x0
	[0064.003] SetErrorMode (uMode=0x1) returned 0x1
	[0064.003] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e
	[0064.003] GetLastError () returned 0x0
	[0064.003] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e298 | out: phkResult=0x19e298*=0x320) returned 0x0
	[0064.003] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x0, lpcbData=0x19e2dc*=0x0 | out: lpType=0x19e2e0*=0x1, lpData=0x0, lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.004] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x4fe098, lpcbData=0x19e2dc*=0x56 | out: lpType=0x19e2e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.004] RegCloseKey (hKey=0x320) returned 0x0
	[0064.004] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e
	[0064.004] GetLastError () returned 0x0
	[0064.004] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e
	[0064.004] GetLastError () returned 0x0
	[0064.006] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x4e0dcc43, Data2=0xf25, Data3=0x492a, Data4=([0]=0x99, [1]=0x74, [2]=0x97, [3]=0xcb, [4]=0xc5, [5]=0x48, [6]=0x20, [7]=0xf1))) returned 0x0
	[0064.019] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xf955eb11, Data2=0x25da, Data3=0x4038, Data4=([0]=0x8f, [1]=0x4e, [2]=0x5a, [3]=0x5f, [4]=0xfb, [5]=0x2b, [6]=0xec, [7]=0x43))) returned 0x0
	[0064.027] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xb26b8ddb, Data2=0x64e0, Data3=0x4ae5, Data4=([0]=0x9c, [1]=0x6d, [2]=0xfc, [3]=0x10, [4]=0x5d, [5]=0x49, [6]=0x6c, [7]=0xd6))) returned 0x0
	[0064.028] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x17a056d0, Data2=0x114, Data3=0x4b5d, Data4=([0]=0x94, [1]=0x90, [2]=0xc7, [3]=0x8d, [4]=0xb8, [5]=0x4d, [6]=0xf, [7]=0x69))) returned 0x0
	[0064.028] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x17152895, Data2=0xad8f, Data3=0x4a5f, Data4=([0]=0xbf, [1]=0x52, [2]=0x59, [3]=0x25, [4]=0xf, [5]=0xd2, [6]=0xde, [7]=0xa1))) returned 0x0
	[0064.028] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x7be0b1a9, Data2=0xe7ba, Data3=0x43ea, Data4=([0]=0xa8, [1]=0xc4, [2]=0x70, [3]=0x3b, [4]=0xdf, [5]=0x2f, [6]=0x4e, [7]=0x8))) returned 0x0
	[0064.028] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0064.028] GetLastError () returned 0x0
	[0064.028] SetErrorMode (uMode=0x1) returned 0x1
	[0064.029] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320
	[0064.029] GetLastError () returned 0x0
	[0064.029] GetFileType (hFile=0x320) returned 0x1
	[0064.029] SetErrorMode (uMode=0x1) returned 0x1
	[0064.029] GetFileType (hFile=0x320) returned 0x1
	[0064.029] ReadFile (in: hFile=0x320, lpBuffer=0x2f92a2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f92a2c*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.032] GetLastError () returned 0x0
	[0064.033] ReadFile (in: hFile=0x320, lpBuffer=0x2f92a2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f92a2c*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.033] GetLastError () returned 0x0
	[0064.034] ReadFile (in: hFile=0x320, lpBuffer=0x2f92a2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f92a2c*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.034] GetLastError () returned 0x0
	[0064.034] ReadFile (in: hFile=0x320, lpBuffer=0x2f92a2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f92a2c*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.034] GetLastError () returned 0x0
	[0064.035] ReadFile (in: hFile=0x320, lpBuffer=0x2f92a2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f92a2c*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.035] GetLastError () returned 0x0
	[0064.036] ReadFile (in: hFile=0x320, lpBuffer=0x2f92a2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f92a2c*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.036] GetLastError () returned 0x0
	[0064.036] ReadFile (in: hFile=0x320, lpBuffer=0x2f92a2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f92a2c*, lpNumberOfBytesRead=0x19e314*=0xaca, lpOverlapped=0x0) returned 1
	[0064.036] GetLastError () returned 0x0
	[0064.036] ReadFile (in: hFile=0x320, lpBuffer=0x2f92096, nNumberOfBytesToRead=0x136, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f92096*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0064.036] GetLastError () returned 0x0
	[0064.036] ReadFile (in: hFile=0x320, lpBuffer=0x2f92a2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x2f92a2c*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0064.036] GetLastError () returned 0x0
	[0064.036] CloseHandle (hObject=0x320) returned 1
	[0064.036] GetLastError () returned 0x0
	[0064.036] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0064.036] GetLastError () returned 0x0
	[0064.036] SetErrorMode (uMode=0x1) returned 0x1
	[0064.037] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2fb3a28 | out: lpFileInformation=0x2fb3a28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a051ba0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a051ba0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2d2d8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1
	[0064.037] GetLastError () returned 0x0
	[0064.037] SetErrorMode (uMode=0x1) returned 0x1
	[0064.037] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0064.037] GetLastError () returned 0x0
	[0064.037] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e298 | out: phkResult=0x19e298*=0x320) returned 0x0
	[0064.037] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x0, lpcbData=0x19e2dc*=0x0 | out: lpType=0x19e2e0*=0x1, lpData=0x0, lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.037] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x4fe098, lpcbData=0x19e2dc*=0x56 | out: lpType=0x19e2e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.038] RegCloseKey (hKey=0x320) returned 0x0
	[0064.038] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0064.038] GetLastError () returned 0x0
	[0064.038] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0064.038] GetLastError () returned 0x0
	[0064.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3a
	[0064.059] GetLastError () returned 0x0
	[0064.061] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0064.061] GetLastError () returned 0x57
	[0064.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48
	[0064.073] GetLastError () returned 0x57
	[0064.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.075] GetLastError () returned 0x57
	[0064.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e
	[0064.077] GetLastError () returned 0x57
	[0064.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", lpFilePart=0x0) returned 0x52
	[0064.078] GetLastError () returned 0x57
	[0064.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", lpFilePart=0x0) returned 0x74
	[0064.081] GetLastError () returned 0x57
	[0064.082] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70
	[0064.082] GetLastError () returned 0x57
	[0064.084] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", lpFilePart=0x0) returned 0x60
	[0064.084] GetLastError () returned 0x57
	[0064.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
	[0064.086] GetLastError () returned 0x57
	[0064.088] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
	[0064.088] GetLastError () returned 0x57
	[0064.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
	[0064.089] GetLastError () returned 0x57
	[0064.090] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", lpFilePart=0x0) returned 0x50
	[0064.090] GetLastError () returned 0x57
	[0064.091] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", lpFilePart=0x0) returned 0x5e
	[0064.091] GetLastError () returned 0x57
	[0064.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", lpFilePart=0x0) returned 0x6c
	[0064.093] GetLastError () returned 0x57
	[0064.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3a
	[0064.093] GetLastError () returned 0x57
	[0064.094] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0064.094] GetLastError () returned 0x57
	[0064.094] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48
	[0064.094] GetLastError () returned 0x57
	[0064.094] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.094] GetLastError () returned 0x57
	[0064.094] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.094] GetLastError () returned 0x57
	[0064.095] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19daf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.095] GetLastError () returned 0x57
	[0064.095] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19daf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.095] GetLastError () returned 0x57
	[0064.095] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19daf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.095] GetLastError () returned 0x57
	[0064.126] VirtualQuery (in: lpAddress=0x19cff0, lpBuffer=0x19dff0, dwLength=0x1c | out: lpBuffer=0x19dff0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.132] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x26058994, Data2=0x81c7, Data3=0x4a08, Data4=([0]=0x86, [1]=0x46, [2]=0x25, [3]=0xfe, [4]=0x22, [5]=0x17, [6]=0x67, [7]=0x26))) returned 0x0
	[0064.133] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x6f5ff4fe, Data2=0x3edd, Data3=0x4481, Data4=([0]=0x9a, [1]=0xfa, [2]=0x51, [3]=0x93, [4]=0xd, [5]=0xd, [6]=0x3c, [7]=0x1e))) returned 0x0
	[0064.133] VirtualQuery (in: lpAddress=0x19d068, lpBuffer=0x19e068, dwLength=0x1c | out: lpBuffer=0x19e068*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.134] VirtualQuery (in: lpAddress=0x19d068, lpBuffer=0x19e068, dwLength=0x1c | out: lpBuffer=0x19e068*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.134] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xd0c124bc, Data2=0xfbd6, Data3=0x4573, Data4=([0]=0xa4, [1]=0x38, [2]=0xc8, [3]=0x6b, [4]=0xe5, [5]=0x3c, [6]=0x42, [7]=0x8b))) returned 0x0
	[0064.141] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xc77c87c2, Data2=0x131b, Data3=0x482d, Data4=([0]=0xab, [1]=0x18, [2]=0x53, [3]=0x4a, [4]=0xfa, [5]=0x49, [6]=0xcb, [7]=0x6c))) returned 0x0
	[0064.141] VirtualQuery (in: lpAddress=0x19d194, lpBuffer=0x19e194, dwLength=0x1c | out: lpBuffer=0x19e194*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.141] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.142] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.142] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xf27618e9, Data2=0xd15e, Data3=0x4a71, Data4=([0]=0x88, [1]=0xb7, [2]=0x65, [3]=0x94, [4]=0xad, [5]=0x0, [6]=0xc4, [7]=0x69))) returned 0x0
	[0064.142] VirtualQuery (in: lpAddress=0x19d194, lpBuffer=0x19e194, dwLength=0x1c | out: lpBuffer=0x19e194*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.142] VirtualQuery (in: lpAddress=0x19d0ac, lpBuffer=0x19e0ac, dwLength=0x1c | out: lpBuffer=0x19e0ac*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.143] VirtualQuery (in: lpAddress=0x19cd60, lpBuffer=0x19dd60, dwLength=0x1c | out: lpBuffer=0x19dd60*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.144] VirtualQuery (in: lpAddress=0x19cd60, lpBuffer=0x19dd60, dwLength=0x1c | out: lpBuffer=0x19dd60*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.144] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xbefc8a3d, Data2=0xeb9f, Data3=0x41e3, Data4=([0]=0x89, [1]=0x6d, [2]=0x48, [3]=0xae, [4]=0x95, [5]=0xf9, [6]=0xc1, [7]=0xd0))) returned 0x0
	[0064.144] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xdb2f889c, Data2=0x47ab, Data3=0x48cb, Data4=([0]=0x8d, [1]=0x35, [2]=0x0, [3]=0x24, [4]=0x6d, [5]=0xb0, [6]=0xe9, [7]=0x84))) returned 0x0
	[0064.145] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0064.145] GetLastError () returned 0x57
	[0064.145] SetErrorMode (uMode=0x1) returned 0x1
	[0064.145] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320
	[0064.145] GetLastError () returned 0x0
	[0064.145] GetFileType (hFile=0x320) returned 0x1
	[0064.145] SetErrorMode (uMode=0x1) returned 0x1
	[0064.145] GetFileType (hFile=0x320) returned 0x1
	[0064.146] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.160] GetLastError () returned 0x0
	[0064.161] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.161] GetLastError () returned 0x0
	[0064.162] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.162] GetLastError () returned 0x0
	[0064.162] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.162] GetLastError () returned 0x0
	[0064.164] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.164] GetLastError () returned 0x0
	[0064.164] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.164] GetLastError () returned 0x0
	[0064.164] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.164] GetLastError () returned 0x0
	[0064.164] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.164] GetLastError () returned 0x0
	[0064.166] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.166] GetLastError () returned 0x0
	[0064.166] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.166] GetLastError () returned 0x0
	[0064.166] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.166] GetLastError () returned 0x0
	[0064.167] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.167] GetLastError () returned 0x0
	[0064.167] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.167] GetLastError () returned 0x0
	[0064.167] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.167] GetLastError () returned 0x0
	[0064.167] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.167] GetLastError () returned 0x0
	[0064.168] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.168] GetLastError () returned 0x0
	[0064.171] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.171] GetLastError () returned 0x0
	[0064.171] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0xbce, lpOverlapped=0x0) returned 1
	[0064.171] GetLastError () returned 0x0
	[0064.171] ReadFile (in: hFile=0x320, lpBuffer=0x3018296, nNumberOfBytesToRead=0x32, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018296*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0064.171] GetLastError () returned 0x0
	[0064.171] ReadFile (in: hFile=0x320, lpBuffer=0x3018b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3018b28*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0064.171] GetLastError () returned 0x0
	[0064.171] CloseHandle (hObject=0x320) returned 1
	[0064.171] GetLastError () returned 0x0
	[0064.171] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0064.171] GetLastError () returned 0x0
	[0064.171] SetErrorMode (uMode=0x1) returned 0x1
	[0064.171] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x3039b24 | out: lpFileInformation=0x3039b24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a077cff, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a077cff, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e8455c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1
	[0064.172] GetLastError () returned 0x0
	[0064.172] SetErrorMode (uMode=0x1) returned 0x1
	[0064.172] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0064.172] GetLastError () returned 0x0
	[0064.172] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e298 | out: phkResult=0x19e298*=0x320) returned 0x0
	[0064.172] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x0, lpcbData=0x19e2dc*=0x0 | out: lpType=0x19e2e0*=0x1, lpData=0x0, lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.172] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x4fe098, lpcbData=0x19e2dc*=0x56 | out: lpType=0x19e2e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.172] RegCloseKey (hKey=0x320) returned 0x0
	[0064.172] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0064.172] GetLastError () returned 0x0
	[0064.173] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0064.173] GetLastError () returned 0x0
	[0064.177] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x180ab733, Data2=0xcf88, Data3=0x46af, Data4=([0]=0x9e, [1]=0x88, [2]=0x5, [3]=0xc5, [4]=0x38, [5]=0xba, [6]=0x38, [7]=0xf5))) returned 0x0
	[0064.177] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xd89ffcae, Data2=0x7dab, Data3=0x459e, Data4=([0]=0x9b, [1]=0x96, [2]=0xeb, [3]=0x82, [4]=0x56, [5]=0x66, [6]=0xc8, [7]=0x53))) returned 0x0
	[0064.178] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x774132fd, Data2=0x7d33, Data3=0x472f, Data4=([0]=0x87, [1]=0x45, [2]=0x49, [3]=0x13, [4]=0x42, [5]=0x3a, [6]=0x98, [7]=0xf2))) returned 0x0
	[0064.178] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x510b68e1, Data2=0x69e0, Data3=0x4460, Data4=([0]=0x93, [1]=0xbd, [2]=0x99, [3]=0x34, [4]=0x8f, [5]=0x94, [6]=0x40, [7]=0x6b))) returned 0x0
	[0064.178] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x4c176c89, Data2=0x4f65, Data3=0x4f1e, Data4=([0]=0x9b, [1]=0xb, [2]=0x53, [3]=0x28, [4]=0xe7, [5]=0xe4, [6]=0xb5, [7]=0x6))) returned 0x0
	[0064.179] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x388cb3a7, Data2=0x8fc6, Data3=0x4388, Data4=([0]=0x9b, [1]=0x59, [2]=0x1c, [3]=0xb3, [4]=0x2, [5]=0x6c, [6]=0xaf, [7]=0xb1))) returned 0x0
	[0064.179] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.179] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xd525556, Data2=0x684d, Data3=0x4b01, Data4=([0]=0xbb, [1]=0x7b, [2]=0xcd, [3]=0xb5, [4]=0x60, [5]=0xaa, [6]=0x9, [7]=0x72))) returned 0x0
	[0064.180] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.180] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.180] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x4a4191e2, Data2=0x8cd0, Data3=0x49d4, Data4=([0]=0x9b, [1]=0x94, [2]=0xe8, [3]=0x49, [4]=0x49, [5]=0xe2, [6]=0x1, [7]=0xf3))) returned 0x0
	[0064.180] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xaa5bb0ec, Data2=0x5889, Data3=0x458d, Data4=([0]=0x88, [1]=0x82, [2]=0xc, [3]=0xf8, [4]=0xcc, [5]=0xc2, [6]=0xef, [7]=0xd6))) returned 0x0
	[0064.181] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x4ee0b49c, Data2=0x983b, Data3=0x4465, Data4=([0]=0xbd, [1]=0x78, [2]=0xb6, [3]=0x12, [4]=0xf2, [5]=0xeb, [6]=0x56, [7]=0xea))) returned 0x0
	[0064.181] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x4b1dfc7c, Data2=0xedf5, Data3=0x481c, Data4=([0]=0x87, [1]=0x2a, [2]=0x4, [3]=0xac, [4]=0xf5, [5]=0x75, [6]=0x67, [7]=0x4e))) returned 0x0
	[0064.181] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.181] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xcc2b159d, Data2=0x530c, Data3=0x4c71, Data4=([0]=0xa9, [1]=0x5a, [2]=0x38, [3]=0x23, [4]=0x68, [5]=0x2a, [6]=0x4c, [7]=0x4a))) returned 0x0
	[0064.182] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.182] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.183] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.183] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.184] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.185] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x3aefcd0a, Data2=0xb49c, Data3=0x47be, Data4=([0]=0x9e, [1]=0x29, [2]=0xd4, [3]=0x2e, [4]=0x10, [5]=0x59, [6]=0x76, [7]=0xda))) returned 0x0
	[0064.185] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xa9290ae9, Data2=0x7dee, Data3=0x44be, Data4=([0]=0xb5, [1]=0x85, [2]=0x69, [3]=0x1b, [4]=0xa2, [5]=0x21, [6]=0x78, [7]=0x51))) returned 0x0
	[0064.185] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xfd519e3d, Data2=0xd967, Data3=0x4885, Data4=([0]=0x8f, [1]=0xf6, [2]=0xb0, [3]=0xea, [4]=0xb, [5]=0xe7, [6]=0x33, [7]=0x99))) returned 0x0
	[0064.185] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x4401609b, Data2=0xa45b, Data3=0x4fb0, Data4=([0]=0x96, [1]=0x29, [2]=0xce, [3]=0xdf, [4]=0x31, [5]=0x52, [6]=0xef, [7]=0x52))) returned 0x0
	[0064.185] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x51d00712, Data2=0x423d, Data3=0x46fd, Data4=([0]=0x9c, [1]=0xb, [2]=0x5c, [3]=0x90, [4]=0xc2, [5]=0xc8, [6]=0x85, [7]=0x64))) returned 0x0
	[0064.186] VirtualQuery (in: lpAddress=0x19d194, lpBuffer=0x19e194, dwLength=0x1c | out: lpBuffer=0x19e194*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.186] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x8a1e9917, Data2=0xcc56, Data3=0x4c54, Data4=([0]=0x87, [1]=0xea, [2]=0x4a, [3]=0xa3, [4]=0x91, [5]=0x64, [6]=0xa4, [7]=0x65))) returned 0x0
	[0064.186] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x269b2aa6, Data2=0x617f, Data3=0x413b, Data4=([0]=0xa2, [1]=0x74, [2]=0xe9, [3]=0xcc, [4]=0xe7, [5]=0x93, [6]=0x8b, [7]=0xb1))) returned 0x0
	[0064.187] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xe803b352, Data2=0xbed2, Data3=0x4255, Data4=([0]=0xa7, [1]=0x72, [2]=0x91, [3]=0xf0, [4]=0x41, [5]=0xb2, [6]=0xcb, [7]=0x58))) returned 0x0
	[0064.187] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xa6c03050, Data2=0x254f, Data3=0x4259, Data4=([0]=0xbc, [1]=0xde, [2]=0x31, [3]=0xf3, [4]=0x8c, [5]=0xf9, [6]=0x6a, [7]=0x5e))) returned 0x0
	[0064.187] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x5aff2609, Data2=0xc062, Data3=0x467c, Data4=([0]=0x96, [1]=0x89, [2]=0x2f, [3]=0x7e, [4]=0xa0, [5]=0x24, [6]=0x3b, [7]=0x8f))) returned 0x0
	[0064.188] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x9b904ea7, Data2=0x1b8f, Data3=0x4ff4, Data4=([0]=0xad, [1]=0x14, [2]=0x8b, [3]=0xb0, [4]=0x4a, [5]=0x5a, [6]=0x78, [7]=0x7c))) returned 0x0
	[0064.188] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x613c28ef, Data2=0x2cc8, Data3=0x4ebf, Data4=([0]=0x87, [1]=0x4, [2]=0x85, [3]=0x6, [4]=0x9e, [5]=0xc, [6]=0xe9, [7]=0x8e))) returned 0x0
	[0064.188] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x1ddb8329, Data2=0x4cfb, Data3=0x4068, Data4=([0]=0xa5, [1]=0x1c, [2]=0xf3, [3]=0x1e, [4]=0xb6, [5]=0xae, [6]=0xd9, [7]=0x80))) returned 0x0
	[0064.188] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x143c7bfb, Data2=0xe060, Data3=0x4bac, Data4=([0]=0x92, [1]=0xd8, [2]=0x1b, [3]=0x6a, [4]=0x3a, [5]=0x9c, [6]=0x6a, [7]=0x9c))) returned 0x0
	[0064.188] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xaf0b184d, Data2=0x15c1, Data3=0x4c7d, Data4=([0]=0x89, [1]=0xb, [2]=0xb3, [3]=0x7f, [4]=0xd4, [5]=0xff, [6]=0x59, [7]=0x65))) returned 0x0
	[0064.188] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x860f0e3a, Data2=0x1c3e, Data3=0x486f, Data4=([0]=0xbc, [1]=0xbf, [2]=0x7d, [3]=0xad, [4]=0x5c, [5]=0x50, [6]=0x50, [7]=0x8f))) returned 0x0
	[0064.189] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x8012bd94, Data2=0xf856, Data3=0x440d, Data4=([0]=0x9d, [1]=0x2a, [2]=0x41, [3]=0x53, [4]=0xe2, [5]=0x2c, [6]=0xfd, [7]=0xb4))) returned 0x0
	[0064.189] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xf3190e3a, Data2=0xced7, Data3=0x4b3a, Data4=([0]=0xab, [1]=0x38, [2]=0x2b, [3]=0x23, [4]=0xb4, [5]=0xb9, [6]=0xd6, [7]=0xc2))) returned 0x0
	[0064.189] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xff8b284d, Data2=0xa176, Data3=0x4c32, Data4=([0]=0x85, [1]=0xd7, [2]=0x86, [3]=0x43, [4]=0xb3, [5]=0xbf, [6]=0x7d, [7]=0xe5))) returned 0x0
	[0064.190] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x87e0b93d, Data2=0x777a, Data3=0x43d0, Data4=([0]=0xb5, [1]=0x84, [2]=0xea, [3]=0x3, [4]=0x8f, [5]=0xf6, [6]=0xaa, [7]=0x8e))) returned 0x0
	[0064.190] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x67871eb6, Data2=0xd6c3, Data3=0x4839, Data4=([0]=0x8f, [1]=0x7e, [2]=0xf, [3]=0xa2, [4]=0x32, [5]=0xea, [6]=0x87, [7]=0xe7))) returned 0x0
	[0064.190] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x3af72f1b, Data2=0xfa6d, Data3=0x4268, Data4=([0]=0xae, [1]=0x5a, [2]=0x4c, [3]=0xad, [4]=0x83, [5]=0x71, [6]=0x1c, [7]=0x1d))) returned 0x0
	[0064.190] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x6e8eb489, Data2=0x9567, Data3=0x4a47, Data4=([0]=0x93, [1]=0xdd, [2]=0x67, [3]=0x6f, [4]=0x22, [5]=0x53, [6]=0x73, [7]=0xe5))) returned 0x0
	[0064.190] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xd81cbcf3, Data2=0x76ae, Data3=0x4967, Data4=([0]=0x91, [1]=0x8f, [2]=0x7c, [3]=0x2d, [4]=0xe3, [5]=0x79, [6]=0x6d, [7]=0x20))) returned 0x0
	[0064.191] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.191] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.193] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.196] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xcaf3695e, Data2=0x4863, Data3=0x4f7a, Data4=([0]=0xa4, [1]=0x49, [2]=0x42, [3]=0xfd, [4]=0xe7, [5]=0xb1, [6]=0x8c, [7]=0x38))) returned 0x0
	[0064.197] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43
	[0064.197] GetLastError () returned 0x0
	[0064.197] SetErrorMode (uMode=0x1) returned 0x1
	[0064.197] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320
	[0064.197] GetLastError () returned 0x0
	[0064.197] GetFileType (hFile=0x320) returned 0x1
	[0064.197] SetErrorMode (uMode=0x1) returned 0x1
	[0064.197] GetFileType (hFile=0x320) returned 0x1
	[0064.197] ReadFile (in: hFile=0x320, lpBuffer=0x30d6a10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x30d6a10*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.200] GetLastError () returned 0x0
	[0064.201] ReadFile (in: hFile=0x320, lpBuffer=0x30d6a10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x30d6a10*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.201] GetLastError () returned 0x0
	[0064.202] ReadFile (in: hFile=0x320, lpBuffer=0x30d6a10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x30d6a10*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.202] GetLastError () returned 0x0
	[0064.202] ReadFile (in: hFile=0x320, lpBuffer=0x30d6a10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x30d6a10*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.202] GetLastError () returned 0x0
	[0064.203] ReadFile (in: hFile=0x320, lpBuffer=0x30d6a10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x30d6a10*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.203] GetLastError () returned 0x0
	[0064.203] ReadFile (in: hFile=0x320, lpBuffer=0x30d6a10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x30d6a10*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.204] GetLastError () returned 0x0
	[0064.204] ReadFile (in: hFile=0x320, lpBuffer=0x30d6a10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x30d6a10*, lpNumberOfBytesRead=0x19e314*=0x119, lpOverlapped=0x0) returned 1
	[0064.204] GetLastError () returned 0x0
	[0064.204] ReadFile (in: hFile=0x320, lpBuffer=0x30d6a10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x30d6a10*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0064.204] GetLastError () returned 0x0
	[0064.204] CloseHandle (hObject=0x320) returned 1
	[0064.204] GetLastError () returned 0x0
	[0064.204] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43
	[0064.204] GetLastError () returned 0x0
	[0064.204] SetErrorMode (uMode=0x1) returned 0x1
	[0064.204] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x30f7a0c | out: lpFileInformation=0x30f7a0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0c3fbd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0c3fbd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2eaa6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1
	[0064.204] GetLastError () returned 0x0
	[0064.204] SetErrorMode (uMode=0x1) returned 0x1
	[0064.205] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43
	[0064.205] GetLastError () returned 0x0
	[0064.205] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e298 | out: phkResult=0x19e298*=0x320) returned 0x0
	[0064.205] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x0, lpcbData=0x19e2dc*=0x0 | out: lpType=0x19e2e0*=0x1, lpData=0x0, lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.205] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x4fe098, lpcbData=0x19e2dc*=0x56 | out: lpType=0x19e2e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.206] RegCloseKey (hKey=0x320) returned 0x0
	[0064.206] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43
	[0064.206] GetLastError () returned 0x0
	[0064.206] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43
	[0064.206] GetLastError () returned 0x0
	[0064.207] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.207] GetLastError () returned 0x0
	[0064.207] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19daf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.207] GetLastError () returned 0x0
	[0064.208] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19daf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.208] GetLastError () returned 0x0
	[0064.208] VirtualQuery (in: lpAddress=0x19cff0, lpBuffer=0x19dff0, dwLength=0x1c | out: lpBuffer=0x19dff0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.208] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x88171389, Data2=0x6c94, Data3=0x4539, Data4=([0]=0xaa, [1]=0x2c, [2]=0xf2, [3]=0x67, [4]=0x5, [5]=0x76, [6]=0xc9, [7]=0xd7))) returned 0x0
	[0064.209] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.209] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xd464d3cf, Data2=0x618, Data3=0x41ac, Data4=([0]=0xb0, [1]=0x33, [2]=0xb8, [3]=0xc5, [4]=0xb9, [5]=0x6a, [6]=0xf5, [7]=0x6a))) returned 0x0
	[0064.209] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xaec22aa4, Data2=0x6966, Data3=0x4fc2, Data4=([0]=0xbb, [1]=0xc5, [2]=0xdf, [3]=0xb5, [4]=0xec, [5]=0xab, [6]=0xc3, [7]=0x59))) returned 0x0
	[0064.209] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xcaa5eec3, Data2=0x8478, Data3=0x489e, Data4=([0]=0x9f, [1]=0x74, [2]=0xe1, [3]=0x31, [4]=0x9b, [5]=0xc4, [6]=0xa2, [7]=0x8d))) returned 0x0
	[0064.210] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.210] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.210] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d
	[0064.210] GetLastError () returned 0x0
	[0064.210] SetErrorMode (uMode=0x1) returned 0x1
	[0064.211] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320
	[0064.211] GetLastError () returned 0x0
	[0064.211] GetFileType (hFile=0x320) returned 0x1
	[0064.211] SetErrorMode (uMode=0x1) returned 0x1
	[0064.211] GetFileType (hFile=0x320) returned 0x1
	[0064.211] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.214] GetLastError () returned 0x0
	[0064.215] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.215] GetLastError () returned 0x0
	[0064.216] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.216] GetLastError () returned 0x0
	[0064.216] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.216] GetLastError () returned 0x0
	[0064.217] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.217] GetLastError () returned 0x0
	[0064.217] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.217] GetLastError () returned 0x0
	[0064.217] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.217] GetLastError () returned 0x0
	[0064.217] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.218] GetLastError () returned 0x0
	[0064.219] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.219] GetLastError () returned 0x0
	[0064.219] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.220] GetLastError () returned 0x0
	[0064.220] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.220] GetLastError () returned 0x0
	[0064.220] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.220] GetLastError () returned 0x0
	[0064.220] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.220] GetLastError () returned 0x0
	[0064.221] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.221] GetLastError () returned 0x0
	[0064.221] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.224] GetLastError () returned 0x0
	[0064.225] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.225] GetLastError () returned 0x0
	[0064.228] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.228] GetLastError () returned 0x0
	[0064.228] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.228] GetLastError () returned 0x0
	[0064.228] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.228] GetLastError () returned 0x0
	[0064.229] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.229] GetLastError () returned 0x0
	[0064.229] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.229] GetLastError () returned 0x0
	[0064.229] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.229] GetLastError () returned 0x0
	[0064.230] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.230] GetLastError () returned 0x0
	[0064.230] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.230] GetLastError () returned 0x0
	[0064.230] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.230] GetLastError () returned 0x0
	[0064.231] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.231] GetLastError () returned 0x0
	[0064.231] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.231] GetLastError () returned 0x0
	[0064.231] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.231] GetLastError () returned 0x0
	[0064.231] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.232] GetLastError () returned 0x0
	[0064.232] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.232] GetLastError () returned 0x0
	[0064.232] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.232] GetLastError () returned 0x0
	[0064.232] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.232] GetLastError () returned 0x0
	[0064.238] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.238] GetLastError () returned 0x0
	[0064.238] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.238] GetLastError () returned 0x0
	[0064.238] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.239] GetLastError () returned 0x0
	[0064.239] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.239] GetLastError () returned 0x0
	[0064.239] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.239] GetLastError () returned 0x0
	[0064.239] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.239] GetLastError () returned 0x0
	[0064.240] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.240] GetLastError () returned 0x0
	[0064.240] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.240] GetLastError () returned 0x0
	[0064.240] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.240] GetLastError () returned 0x0
	[0064.240] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.240] GetLastError () returned 0x0
	[0064.241] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.241] GetLastError () returned 0x0
	[0064.241] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.241] GetLastError () returned 0x0
	[0064.241] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.241] GetLastError () returned 0x0
	[0064.242] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.242] GetLastError () returned 0x0
	[0064.242] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.242] GetLastError () returned 0x0
	[0064.242] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.242] GetLastError () returned 0x0
	[0064.242] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.242] GetLastError () returned 0x0
	[0064.243] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.243] GetLastError () returned 0x0
	[0064.243] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.243] GetLastError () returned 0x0
	[0064.243] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.243] GetLastError () returned 0x0
	[0064.243] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.244] GetLastError () returned 0x0
	[0064.244] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.244] GetLastError () returned 0x0
	[0064.244] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.244] GetLastError () returned 0x0
	[0064.245] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.245] GetLastError () returned 0x0
	[0064.245] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.245] GetLastError () returned 0x0
	[0064.245] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.245] GetLastError () returned 0x0
	[0064.246] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.246] GetLastError () returned 0x0
	[0064.246] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.246] GetLastError () returned 0x0
	[0064.247] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.247] GetLastError () returned 0x0
	[0064.247] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.247] GetLastError () returned 0x0
	[0064.247] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0xf37, lpOverlapped=0x0) returned 1
	[0064.247] GetLastError () returned 0x0
	[0064.247] ReadFile (in: hFile=0x320, lpBuffer=0x312010b, nNumberOfBytesToRead=0xc9, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x312010b*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0064.247] GetLastError () returned 0x0
	[0064.248] ReadFile (in: hFile=0x320, lpBuffer=0x3120a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3120a34*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0064.248] GetLastError () returned 0x0
	[0064.248] CloseHandle (hObject=0x320) returned 1
	[0064.248] GetLastError () returned 0x0
	[0064.248] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d
	[0064.248] GetLastError () returned 0x0
	[0064.248] SetErrorMode (uMode=0x1) returned 0x1
	[0064.248] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x3141a30 | out: lpFileInformation=0x3141a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11027b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a11027b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2ed081c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1
	[0064.248] GetLastError () returned 0x0
	[0064.248] SetErrorMode (uMode=0x1) returned 0x1
	[0064.248] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d
	[0064.248] GetLastError () returned 0x0
	[0064.249] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e298 | out: phkResult=0x19e298*=0x320) returned 0x0
	[0064.249] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x0, lpcbData=0x19e2dc*=0x0 | out: lpType=0x19e2e0*=0x1, lpData=0x0, lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.249] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x4fe098, lpcbData=0x19e2dc*=0x56 | out: lpType=0x19e2e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.250] RegCloseKey (hKey=0x320) returned 0x0
	[0064.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d
	[0064.250] GetLastError () returned 0x0
	[0064.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d
	[0064.250] GetLastError () returned 0x0
	[0064.267] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x5f3e6e1a, Data2=0xb051, Data3=0x4fe7, Data4=([0]=0x9c, [1]=0xca, [2]=0xd3, [3]=0x86, [4]=0xf4, [5]=0xe4, [6]=0x3a, [7]=0xa7))) returned 0x0
	[0064.267] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x4e362d64, Data2=0x6e0, Data3=0x4461, Data4=([0]=0xb2, [1]=0xb3, [2]=0x1d, [3]=0xc5, [4]=0x23, [5]=0x7b, [6]=0x14, [7]=0x82))) returned 0x0
	[0064.268] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.268] GetLastError () returned 0x0
	[0064.268] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.268] GetLastError () returned 0x0
	[0064.268] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.268] GetLastError () returned 0x0
	[0064.268] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.268] GetLastError () returned 0x0
	[0064.314] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.314] GetLastError () returned 0x0
	[0064.314] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.314] GetLastError () returned 0x0
	[0064.314] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.314] GetLastError () returned 0x0
	[0064.314] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xfb521735, Data2=0xf4bf, Data3=0x4423, Data4=([0]=0x83, [1]=0xb7, [2]=0x2c, [3]=0x56, [4]=0xec, [5]=0x6, [6]=0x5e, [7]=0x90))) returned 0x0
	[0064.314] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.314] GetLastError () returned 0x0
	[0064.314] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.314] GetLastError () returned 0x0
	[0064.314] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.315] GetLastError () returned 0x0
	[0064.315] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.315] GetLastError () returned 0x0
	[0064.315] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.315] GetLastError () returned 0x0
	[0064.315] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.315] GetLastError () returned 0x0
	[0064.315] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.315] GetLastError () returned 0x0
	[0064.315] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.315] GetLastError () returned 0x0
	[0064.315] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.315] GetLastError () returned 0x0
	[0064.315] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.315] GetLastError () returned 0x0
	[0064.316] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.316] GetLastError () returned 0x0
	[0064.316] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.316] GetLastError () returned 0x0
	[0064.316] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.316] GetLastError () returned 0x0
	[0064.316] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.316] GetLastError () returned 0x0
	[0064.316] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.316] GetLastError () returned 0x0
	[0064.316] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.316] GetLastError () returned 0x0
	[0064.316] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.316] GetLastError () returned 0x0
	[0064.316] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.316] GetLastError () returned 0x0
	[0064.318] VirtualQuery (in: lpAddress=0x19cc54, lpBuffer=0x19dc54, dwLength=0x1c | out: lpBuffer=0x19dc54*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.319] VirtualQuery (in: lpAddress=0x19cc90, lpBuffer=0x19dc90, dwLength=0x1c | out: lpBuffer=0x19dc90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.319] GetLastError () returned 0x0
	[0064.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.319] GetLastError () returned 0x0
	[0064.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.319] GetLastError () returned 0x0
	[0064.320] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.320] GetLastError () returned 0x0
	[0064.320] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.320] GetLastError () returned 0x0
	[0064.320] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.320] GetLastError () returned 0x0
	[0064.320] VirtualQuery (in: lpAddress=0x19cfc0, lpBuffer=0x19dfc0, dwLength=0x1c | out: lpBuffer=0x19dfc0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.321] GetLastError () returned 0x0
	[0064.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.321] GetLastError () returned 0x0
	[0064.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.321] GetLastError () returned 0x0
	[0064.321] VirtualQuery (in: lpAddress=0x19cfc0, lpBuffer=0x19dfc0, dwLength=0x1c | out: lpBuffer=0x19dfc0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.321] GetLastError () returned 0x0
	[0064.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.321] GetLastError () returned 0x0
	[0064.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.321] GetLastError () returned 0x0
	[0064.322] VirtualQuery (in: lpAddress=0x19cfc0, lpBuffer=0x19dfc0, dwLength=0x1c | out: lpBuffer=0x19dfc0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.322] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.323] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.325] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.325] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.325] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.326] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.326] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.326] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.326] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.327] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.328] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.328] VirtualQuery (in: lpAddress=0x19cdfc, lpBuffer=0x19ddfc, dwLength=0x1c | out: lpBuffer=0x19ddfc*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.329] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.330] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.330] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.330] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.331] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x38069f24, Data2=0xa491, Data3=0x4274, Data4=([0]=0xb1, [1]=0xe7, [2]=0xc2, [3]=0xc7, [4]=0xdb, [5]=0xa, [6]=0xa5, [7]=0x86))) returned 0x0
	[0064.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.331] GetLastError () returned 0x0
	[0064.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.331] GetLastError () returned 0x0
	[0064.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.331] GetLastError () returned 0x0
	[0064.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.331] GetLastError () returned 0x0
	[0064.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.331] GetLastError () returned 0x0
	[0064.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.331] GetLastError () returned 0x0
	[0064.332] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.332] GetLastError () returned 0x0
	[0064.332] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.332] GetLastError () returned 0x0
	[0064.332] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.332] GetLastError () returned 0x0
	[0064.332] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.332] GetLastError () returned 0x0
	[0064.332] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.332] GetLastError () returned 0x0
	[0064.332] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.332] GetLastError () returned 0x0
	[0064.332] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.333] GetLastError () returned 0x0
	[0064.333] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.333] GetLastError () returned 0x0
	[0064.333] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.333] GetLastError () returned 0x0
	[0064.333] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.333] GetLastError () returned 0x0
	[0064.333] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.333] GetLastError () returned 0x0
	[0064.333] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.333] GetLastError () returned 0x0
	[0064.333] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.333] GetLastError () returned 0x0
	[0064.333] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.333] GetLastError () returned 0x0
	[0064.333] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.333] GetLastError () returned 0x0
	[0064.334] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.334] GetLastError () returned 0x0
	[0064.334] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.334] GetLastError () returned 0x0
	[0064.334] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.334] GetLastError () returned 0x0
	[0064.334] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.334] GetLastError () returned 0x0
	[0064.334] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.334] GetLastError () returned 0x0
	[0064.334] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.334] GetLastError () returned 0x0
	[0064.334] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.334] GetLastError () returned 0x0
	[0064.334] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.334] GetLastError () returned 0x0
	[0064.334] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.335] GetLastError () returned 0x0
	[0064.335] VirtualQuery (in: lpAddress=0x19cfc0, lpBuffer=0x19dfc0, dwLength=0x1c | out: lpBuffer=0x19dfc0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.335] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.335] GetLastError () returned 0x0
	[0064.335] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.335] GetLastError () returned 0x0
	[0064.335] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.336] GetLastError () returned 0x0
	[0064.336] VirtualQuery (in: lpAddress=0x19cfc0, lpBuffer=0x19dfc0, dwLength=0x1c | out: lpBuffer=0x19dfc0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.336] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.336] GetLastError () returned 0x0
	[0064.336] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.336] GetLastError () returned 0x0
	[0064.336] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.336] GetLastError () returned 0x0
	[0064.336] VirtualQuery (in: lpAddress=0x19cfc0, lpBuffer=0x19dfc0, dwLength=0x1c | out: lpBuffer=0x19dfc0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.337] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.337] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.339] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.339] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.339] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.340] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.340] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.340] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.341] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.341] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.342] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.342] VirtualQuery (in: lpAddress=0x19cdfc, lpBuffer=0x19ddfc, dwLength=0x1c | out: lpBuffer=0x19ddfc*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.342] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.344] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.344] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.344] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.344] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x7b5bb8f7, Data2=0x9e4a, Data3=0x4964, Data4=([0]=0x85, [1]=0x74, [2]=0x3d, [3]=0x87, [4]=0x1d, [5]=0x72, [6]=0xc1, [7]=0x69))) returned 0x0
	[0064.345] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.345] GetLastError () returned 0x0
	[0064.345] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.345] GetLastError () returned 0x0
	[0064.345] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.345] GetLastError () returned 0x0
	[0064.345] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.345] GetLastError () returned 0x0
	[0064.345] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.345] GetLastError () returned 0x0
	[0064.345] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.345] GetLastError () returned 0x0
	[0064.346] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xaefd59ca, Data2=0xf2ba, Data3=0x4892, Data4=([0]=0xbb, [1]=0x3e, [2]=0x9e, [3]=0x61, [4]=0x4f, [5]=0xa2, [6]=0xc7, [7]=0x88))) returned 0x0
	[0064.346] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.346] GetLastError () returned 0x0
	[0064.346] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.346] GetLastError () returned 0x0
	[0064.346] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.346] GetLastError () returned 0x0
	[0064.346] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.346] GetLastError () returned 0x0
	[0064.346] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.347] GetLastError () returned 0x0
	[0064.347] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.347] GetLastError () returned 0x0
	[0064.347] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.347] GetLastError () returned 0x0
	[0064.347] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.347] GetLastError () returned 0x0
	[0064.347] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.347] GetLastError () returned 0x0
	[0064.347] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.347] GetLastError () returned 0x0
	[0064.347] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.347] GetLastError () returned 0x0
	[0064.347] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.347] GetLastError () returned 0x0
	[0064.348] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.348] GetLastError () returned 0x0
	[0064.348] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.348] GetLastError () returned 0x0
	[0064.348] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.348] GetLastError () returned 0x0
	[0064.348] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.348] GetLastError () returned 0x0
	[0064.348] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.348] GetLastError () returned 0x0
	[0064.348] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.348] GetLastError () returned 0x0
	[0064.349] VirtualQuery (in: lpAddress=0x19cbb4, lpBuffer=0x19dbb4, dwLength=0x1c | out: lpBuffer=0x19dbb4*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.349] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d740, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.349] GetLastError () returned 0x0
	[0064.349] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.349] GetLastError () returned 0x0
	[0064.349] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.349] GetLastError () returned 0x0
	[0064.349] VirtualQuery (in: lpAddress=0x19cbb4, lpBuffer=0x19dbb4, dwLength=0x1c | out: lpBuffer=0x19dbb4*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.350] VirtualQuery (in: lpAddress=0x19cbf0, lpBuffer=0x19dbf0, dwLength=0x1c | out: lpBuffer=0x19dbf0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.350] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.350] GetLastError () returned 0x0
	[0064.350] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d558, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.350] GetLastError () returned 0x0
	[0064.350] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d558, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.350] GetLastError () returned 0x0
	[0064.350] VirtualQuery (in: lpAddress=0x19cbb4, lpBuffer=0x19dbb4, dwLength=0x1c | out: lpBuffer=0x19dbb4*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.351] VirtualQuery (in: lpAddress=0x19cbf0, lpBuffer=0x19dbf0, dwLength=0x1c | out: lpBuffer=0x19dbf0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.351] GetLastError () returned 0x0
	[0064.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d558, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.351] GetLastError () returned 0x0
	[0064.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d558, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.351] GetLastError () returned 0x0
	[0064.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d740, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.351] GetLastError () returned 0x0
	[0064.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.351] GetLastError () returned 0x0
	[0064.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.351] GetLastError () returned 0x0
	[0064.352] VirtualQuery (in: lpAddress=0x19cbb4, lpBuffer=0x19dbb4, dwLength=0x1c | out: lpBuffer=0x19dbb4*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.352] VirtualQuery (in: lpAddress=0x19cbf0, lpBuffer=0x19dbf0, dwLength=0x1c | out: lpBuffer=0x19dbf0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.352] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.352] GetLastError () returned 0x0
	[0064.352] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d558, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.353] GetLastError () returned 0x0
	[0064.353] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d558, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.353] GetLastError () returned 0x0
	[0064.353] VirtualQuery (in: lpAddress=0x19cbb4, lpBuffer=0x19dbb4, dwLength=0x1c | out: lpBuffer=0x19dbb4*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.353] VirtualQuery (in: lpAddress=0x19cbf0, lpBuffer=0x19dbf0, dwLength=0x1c | out: lpBuffer=0x19dbf0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.353] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d740, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.353] GetLastError () returned 0x0
	[0064.353] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.353] GetLastError () returned 0x0
	[0064.353] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.353] GetLastError () returned 0x0
	[0064.353] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d740, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.353] GetLastError () returned 0x0
	[0064.354] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.354] GetLastError () returned 0x0
	[0064.354] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.354] GetLastError () returned 0x0
	[0064.354] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d740, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.354] GetLastError () returned 0x0
	[0064.354] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.354] GetLastError () returned 0x0
	[0064.354] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.354] GetLastError () returned 0x0
	[0064.354] VirtualQuery (in: lpAddress=0x19cbb4, lpBuffer=0x19dbb4, dwLength=0x1c | out: lpBuffer=0x19dbb4*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.354] VirtualQuery (in: lpAddress=0x19cbf0, lpBuffer=0x19dbf0, dwLength=0x1c | out: lpBuffer=0x19dbf0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.355] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.355] GetLastError () returned 0x0
	[0064.355] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d558, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.355] GetLastError () returned 0x0
	[0064.355] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d558, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.355] GetLastError () returned 0x0
	[0064.355] VirtualQuery (in: lpAddress=0x19cbb4, lpBuffer=0x19dbb4, dwLength=0x1c | out: lpBuffer=0x19dbb4*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.356] VirtualQuery (in: lpAddress=0x19cbf0, lpBuffer=0x19dbf0, dwLength=0x1c | out: lpBuffer=0x19dbf0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.356] GetLastError () returned 0x0
	[0064.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d558, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.356] GetLastError () returned 0x0
	[0064.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d558, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.356] GetLastError () returned 0x0
	[0064.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.356] GetLastError () returned 0x0
	[0064.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.356] GetLastError () returned 0x0
	[0064.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.356] GetLastError () returned 0x0
	[0064.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.357] GetLastError () returned 0x0
	[0064.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.357] GetLastError () returned 0x0
	[0064.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.357] GetLastError () returned 0x0
	[0064.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.357] GetLastError () returned 0x0
	[0064.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.357] GetLastError () returned 0x0
	[0064.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.357] GetLastError () returned 0x0
	[0064.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.357] GetLastError () returned 0x0
	[0064.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.358] GetLastError () returned 0x0
	[0064.358] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.358] GetLastError () returned 0x0
	[0064.358] VirtualQuery (in: lpAddress=0x19d024, lpBuffer=0x19e024, dwLength=0x1c | out: lpBuffer=0x19e024*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.358] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.359] GetLastError () returned 0x0
	[0064.359] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.359] GetLastError () returned 0x0
	[0064.359] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.359] GetLastError () returned 0x0
	[0064.359] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.359] GetLastError () returned 0x0
	[0064.359] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.359] GetLastError () returned 0x0
	[0064.359] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.359] GetLastError () returned 0x0
	[0064.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.360] GetLastError () returned 0x0
	[0064.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.360] GetLastError () returned 0x0
	[0064.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.360] GetLastError () returned 0x0
	[0064.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.360] GetLastError () returned 0x0
	[0064.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.360] GetLastError () returned 0x0
	[0064.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.360] GetLastError () returned 0x0
	[0064.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.360] GetLastError () returned 0x0
	[0064.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.360] GetLastError () returned 0x0
	[0064.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.360] GetLastError () returned 0x0
	[0064.361] VirtualQuery (in: lpAddress=0x19d024, lpBuffer=0x19e024, dwLength=0x1c | out: lpBuffer=0x19e024*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.361] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.361] GetLastError () returned 0x0
	[0064.361] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.361] GetLastError () returned 0x0
	[0064.361] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.361] GetLastError () returned 0x0
	[0064.361] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.362] GetLastError () returned 0x0
	[0064.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.362] GetLastError () returned 0x0
	[0064.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.362] GetLastError () returned 0x0
	[0064.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.362] GetLastError () returned 0x0
	[0064.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.362] GetLastError () returned 0x0
	[0064.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.362] GetLastError () returned 0x0
	[0064.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.362] GetLastError () returned 0x0
	[0064.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.362] GetLastError () returned 0x0
	[0064.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.362] GetLastError () returned 0x0
	[0064.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.363] GetLastError () returned 0x0
	[0064.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.363] GetLastError () returned 0x0
	[0064.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d790, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.363] GetLastError () returned 0x0
	[0064.363] VirtualQuery (in: lpAddress=0x19d024, lpBuffer=0x19e024, dwLength=0x1c | out: lpBuffer=0x19e024*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.363] GetLastError () returned 0x0
	[0064.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.363] GetLastError () returned 0x0
	[0064.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.363] GetLastError () returned 0x0
	[0064.364] VirtualQuery (in: lpAddress=0x19d024, lpBuffer=0x19e024, dwLength=0x1c | out: lpBuffer=0x19e024*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.364] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.364] GetLastError () returned 0x0
	[0064.364] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.364] GetLastError () returned 0x0
	[0064.364] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.364] GetLastError () returned 0x0
	[0064.365] VirtualQuery (in: lpAddress=0x19cc54, lpBuffer=0x19dc54, dwLength=0x1c | out: lpBuffer=0x19dc54*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.365] VirtualQuery (in: lpAddress=0x19cc90, lpBuffer=0x19dc90, dwLength=0x1c | out: lpBuffer=0x19dc90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.365] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.365] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.366] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.366] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.366] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.367] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.367] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.367] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.367] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.367] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.368] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.368] VirtualQuery (in: lpAddress=0x19cdfc, lpBuffer=0x19ddfc, dwLength=0x1c | out: lpBuffer=0x19ddfc*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.368] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.369] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.369] VirtualQuery (in: lpAddress=0x19cf58, lpBuffer=0x19df58, dwLength=0x1c | out: lpBuffer=0x19df58*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.369] VirtualQuery (in: lpAddress=0x19cf94, lpBuffer=0x19df94, dwLength=0x1c | out: lpBuffer=0x19df94*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.370] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x7a7f61d6, Data2=0xf053, Data3=0x491e, Data4=([0]=0x9a, [1]=0x27, [2]=0x5d, [3]=0xdc, [4]=0x74, [5]=0xa2, [6]=0x6c, [7]=0x83))) returned 0x0
	[0064.370] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.370] GetLastError () returned 0x0
	[0064.370] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.370] GetLastError () returned 0x0
	[0064.370] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.370] GetLastError () returned 0x0
	[0064.370] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.371] GetLastError () returned 0x0
	[0064.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.371] GetLastError () returned 0x0
	[0064.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.371] GetLastError () returned 0x0
	[0064.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.371] GetLastError () returned 0x0
	[0064.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.371] GetLastError () returned 0x0
	[0064.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.371] GetLastError () returned 0x0
	[0064.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.371] GetLastError () returned 0x0
	[0064.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.371] GetLastError () returned 0x0
	[0064.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.372] GetLastError () returned 0x0
	[0064.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.372] GetLastError () returned 0x0
	[0064.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.372] GetLastError () returned 0x0
	[0064.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.372] GetLastError () returned 0x0
	[0064.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.372] GetLastError () returned 0x0
	[0064.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.372] GetLastError () returned 0x0
	[0064.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.372] GetLastError () returned 0x0
	[0064.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.372] GetLastError () returned 0x0
	[0064.373] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.373] GetLastError () returned 0x0
	[0064.373] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.373] GetLastError () returned 0x0
	[0064.373] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.373] GetLastError () returned 0x0
	[0064.373] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.373] GetLastError () returned 0x0
	[0064.373] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.373] GetLastError () returned 0x0
	[0064.373] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.373] GetLastError () returned 0x0
	[0064.373] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.373] GetLastError () returned 0x0
	[0064.373] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.373] GetLastError () returned 0x0
	[0064.374] VirtualQuery (in: lpAddress=0x19cc54, lpBuffer=0x19dc54, dwLength=0x1c | out: lpBuffer=0x19dc54*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.374] VirtualQuery (in: lpAddress=0x19cc90, lpBuffer=0x19dc90, dwLength=0x1c | out: lpBuffer=0x19dc90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.374] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.374] GetLastError () returned 0x0
	[0064.375] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.375] GetLastError () returned 0x0
	[0064.375] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.375] GetLastError () returned 0x0
	[0064.375] VirtualQuery (in: lpAddress=0x19cd5c, lpBuffer=0x19dd5c, dwLength=0x1c | out: lpBuffer=0x19dd5c*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.375] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19da44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.375] GetLastError () returned 0x0
	[0064.375] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.375] GetLastError () returned 0x0
	[0064.375] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d9f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.375] GetLastError () returned 0x0
	[0064.376] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x2872b383, Data2=0x1ea4, Data3=0x420c, Data4=([0]=0x9c, [1]=0x44, [2]=0x51, [3]=0x22, [4]=0xf, [5]=0x86, [6]=0x5a, [7]=0x1c))) returned 0x0
	[0064.376] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.376] GetLastError () returned 0x0
	[0064.376] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.376] GetLastError () returned 0x0
	[0064.376] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.376] GetLastError () returned 0x0
	[0064.376] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.376] GetLastError () returned 0x0
	[0064.376] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.376] GetLastError () returned 0x0
	[0064.376] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.376] GetLastError () returned 0x0
	[0064.376] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.376] GetLastError () returned 0x0
	[0064.377] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.377] GetLastError () returned 0x0
	[0064.377] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.377] GetLastError () returned 0x0
	[0064.377] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xf8b8ab3, Data2=0x8521, Data3=0x4155, Data4=([0]=0xbe, [1]=0xd9, [2]=0xfa, [3]=0x3e, [4]=0x3, [5]=0xa9, [6]=0x7a, [7]=0xf2))) returned 0x0
	[0064.377] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.377] GetLastError () returned 0x0
	[0064.377] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.377] GetLastError () returned 0x0
	[0064.377] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.377] GetLastError () returned 0x0
	[0064.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.378] GetLastError () returned 0x0
	[0064.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.378] GetLastError () returned 0x0
	[0064.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.378] GetLastError () returned 0x0
	[0064.378] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xc55f11b7, Data2=0x245e, Data3=0x4e1f, Data4=([0]=0x8c, [1]=0xe6, [2]=0x7a, [3]=0xb6, [4]=0xbb, [5]=0x7d, [6]=0xa0, [7]=0x46))) returned 0x0
	[0064.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.379] GetLastError () returned 0x0
	[0064.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.379] GetLastError () returned 0x0
	[0064.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.379] GetLastError () returned 0x0
	[0064.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.379] GetLastError () returned 0x0
	[0064.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.379] GetLastError () returned 0x0
	[0064.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.379] GetLastError () returned 0x0
	[0064.379] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x2d071003, Data2=0xb9f1, Data3=0x4e6c, Data4=([0]=0xa4, [1]=0x98, [2]=0x55, [3]=0x15, [4]=0x13, [5]=0xf5, [6]=0xb4, [7]=0x6c))) returned 0x0
	[0064.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.380] GetLastError () returned 0x0
	[0064.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.380] GetLastError () returned 0x0
	[0064.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.380] GetLastError () returned 0x0
	[0064.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.380] GetLastError () returned 0x0
	[0064.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.380] GetLastError () returned 0x0
	[0064.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.380] GetLastError () returned 0x0
	[0064.380] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x6768356a, Data2=0x32cc, Data3=0x4333, Data4=([0]=0xb1, [1]=0xe7, [2]=0x1f, [3]=0x3a, [4]=0x50, [5]=0xaf, [6]=0xc7, [7]=0x70))) returned 0x0
	[0064.381] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xd06de5a0, Data2=0xddf9, Data3=0x43a1, Data4=([0]=0x99, [1]=0x13, [2]=0x71, [3]=0x22, [4]=0x43, [5]=0x85, [6]=0x31, [7]=0x88))) returned 0x0
	[0064.381] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xc5930884, Data2=0xa4ec, Data3=0x4afe, Data4=([0]=0xa8, [1]=0x45, [2]=0x33, [3]=0xfc, [4]=0xd3, [5]=0x65, [6]=0x14, [7]=0xc8))) returned 0x0
	[0064.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.381] GetLastError () returned 0x0
	[0064.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.381] GetLastError () returned 0x0
	[0064.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.381] GetLastError () returned 0x0
	[0064.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.381] GetLastError () returned 0x0
	[0064.382] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.382] GetLastError () returned 0x0
	[0064.382] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19db60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.382] GetLastError () returned 0x0
	[0064.382] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xb2818ce6, Data2=0xc75c, Data3=0x4e9a, Data4=([0]=0xae, [1]=0x6, [2]=0x52, [3]=0xbe, [4]=0x2a, [5]=0xca, [6]=0xde, [7]=0x43))) returned 0x0
	[0064.382] VirtualQuery (in: lpAddress=0x19cbb4, lpBuffer=0x19dbb4, dwLength=0x1c | out: lpBuffer=0x19dbb4*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.382] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d740, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.383] GetLastError () returned 0x0
	[0064.383] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.383] GetLastError () returned 0x0
	[0064.383] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.383] GetLastError () returned 0x0
	[0064.383] VirtualQuery (in: lpAddress=0x19cbb4, lpBuffer=0x19dbb4, dwLength=0x1c | out: lpBuffer=0x19dbb4*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.383] VirtualQuery (in: lpAddress=0x19cbf0, lpBuffer=0x19dbf0, dwLength=0x1c | out: lpBuffer=0x19dbf0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.383] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.383] GetLastError () returned 0x0
	[0064.383] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d558, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.383] GetLastError () returned 0x0
	[0064.383] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d558, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.383] GetLastError () returned 0x0
	[0064.384] VirtualQuery (in: lpAddress=0x19cbb4, lpBuffer=0x19dbb4, dwLength=0x1c | out: lpBuffer=0x19dbb4*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.384] VirtualQuery (in: lpAddress=0x19cbf0, lpBuffer=0x19dbf0, dwLength=0x1c | out: lpBuffer=0x19dbf0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.384] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.384] GetLastError () returned 0x0
	[0064.384] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d558, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.384] GetLastError () returned 0x0
	[0064.384] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d558, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.384] GetLastError () returned 0x0
	[0064.384] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d740, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.384] GetLastError () returned 0x0
	[0064.384] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.385] GetLastError () returned 0x0
	[0064.385] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.385] GetLastError () returned 0x0
	[0064.385] VirtualQuery (in: lpAddress=0x19cbb4, lpBuffer=0x19dbb4, dwLength=0x1c | out: lpBuffer=0x19dbb4*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.385] VirtualQuery (in: lpAddress=0x19cbf0, lpBuffer=0x19dbf0, dwLength=0x1c | out: lpBuffer=0x19dbf0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.389] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xd800f4b5, Data2=0x5f3a, Data3=0x472a, Data4=([0]=0x87, [1]=0x59, [2]=0x13, [3]=0x19, [4]=0x8d, [5]=0xbd, [6]=0x39, [7]=0xf6))) returned 0x0
	[0064.394] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x74a12bfd, Data2=0x6826, Data3=0x4f8e, Data4=([0]=0xb6, [1]=0xfa, [2]=0x90, [3]=0x34, [4]=0xb2, [5]=0xe0, [6]=0x94, [7]=0xd5))) returned 0x0
	[0064.397] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x1ef132a4, Data2=0xb251, Data3=0x44ba, Data4=([0]=0xb2, [1]=0xe4, [2]=0xaf, [3]=0x72, [4]=0xf3, [5]=0x4e, [6]=0x1c, [7]=0x3b))) returned 0x0
	[0064.397] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x4b0fb853, Data2=0xe781, Data3=0x4034, Data4=([0]=0x8d, [1]=0xe9, [2]=0xc2, [3]=0xc4, [4]=0xb0, [5]=0xad, [6]=0xad, [7]=0x10))) returned 0x0
	[0064.397] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xf11b3ed9, Data2=0xf8af, Data3=0x4f0e, Data4=([0]=0xae, [1]=0x8, [2]=0xeb, [3]=0x4e, [4]=0x94, [5]=0x9a, [6]=0x9a, [7]=0x15))) returned 0x0
	[0064.398] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x7ec0ba4d, Data2=0x372e, Data3=0x4952, Data4=([0]=0x91, [1]=0x33, [2]=0xda, [3]=0xd4, [4]=0x44, [5]=0x4b, [6]=0x67, [7]=0x6f))) returned 0x0
	[0064.399] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x136b0c91, Data2=0x5e15, Data3=0x4a3f, Data4=([0]=0xa1, [1]=0xe4, [2]=0x8d, [3]=0x65, [4]=0x4a, [5]=0xc1, [6]=0x77, [7]=0x75))) returned 0x0
	[0064.399] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x3ba251f1, Data2=0x252b, Data3=0x4d18, Data4=([0]=0xa4, [1]=0xda, [2]=0xdf, [3]=0xd8, [4]=0xc9, [5]=0xe6, [6]=0x8e, [7]=0xee))) returned 0x0
	[0064.399] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x923a74da, Data2=0x81c0, Data3=0x4c94, Data4=([0]=0xa5, [1]=0xb3, [2]=0xc0, [3]=0x7c, [4]=0xbe, [5]=0x27, [6]=0xa7, [7]=0xab))) returned 0x0
	[0064.400] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x3cef15e4, Data2=0x77b9, Data3=0x45a3, Data4=([0]=0xba, [1]=0x53, [2]=0x4e, [3]=0xfa, [4]=0x2a, [5]=0x61, [6]=0x7f, [7]=0x15))) returned 0x0
	[0064.400] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320
	[0064.400] GetLastError () returned 0x0
	[0064.400] GetFileType (hFile=0x320) returned 0x1
	[0064.400] SetErrorMode (uMode=0x1) returned 0x1
	[0064.401] GetFileType (hFile=0x320) returned 0x1
	[0064.401] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.404] GetLastError () returned 0x0
	[0064.404] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.404] GetLastError () returned 0x0
	[0064.405] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.405] GetLastError () returned 0x0
	[0064.405] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.405] GetLastError () returned 0x0
	[0064.405] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.406] GetLastError () returned 0x0
	[0064.407] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.407] GetLastError () returned 0x0
	[0064.407] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.407] GetLastError () returned 0x0
	[0064.407] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.407] GetLastError () returned 0x0
	[0064.407] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.407] GetLastError () returned 0x0
	[0064.409] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.409] GetLastError () returned 0x0
	[0064.409] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.409] GetLastError () returned 0x0
	[0064.409] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.409] GetLastError () returned 0x0
	[0064.410] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.410] GetLastError () returned 0x0
	[0064.410] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.410] GetLastError () returned 0x0
	[0064.410] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.410] GetLastError () returned 0x0
	[0064.411] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.411] GetLastError () returned 0x0
	[0064.411] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.411] GetLastError () returned 0x0
	[0064.414] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.414] GetLastError () returned 0x0
	[0064.414] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.414] GetLastError () returned 0x0
	[0064.414] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.414] GetLastError () returned 0x0
	[0064.414] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.414] GetLastError () returned 0x0
	[0064.415] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0xe67, lpOverlapped=0x0) returned 1
	[0064.415] GetLastError () returned 0x0
	[0064.415] ReadFile (in: hFile=0x320, lpBuffer=0x33ecbb3, nNumberOfBytesToRead=0x199, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ecbb3*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0064.415] GetLastError () returned 0x0
	[0064.415] ReadFile (in: hFile=0x320, lpBuffer=0x33ed5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x33ed5ac*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0064.415] GetLastError () returned 0x0
	[0064.415] CloseHandle (hObject=0x320) returned 1
	[0064.415] GetLastError () returned 0x0
	[0064.416] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e298 | out: phkResult=0x19e298*=0x320) returned 0x0
	[0064.417] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x0, lpcbData=0x19e2dc*=0x0 | out: lpType=0x19e2e0*=0x1, lpData=0x0, lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.417] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x4fe098, lpcbData=0x19e2dc*=0x56 | out: lpType=0x19e2e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.417] RegCloseKey (hKey=0x320) returned 0x0
	[0064.422] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x57f2b51d, Data2=0x8b4d, Data3=0x4790, Data4=([0]=0xae, [1]=0x9d, [2]=0x10, [3]=0xc0, [4]=0x47, [5]=0x2a, [6]=0xcb, [7]=0xcb))) returned 0x0
	[0064.422] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xfba4df9a, Data2=0xf658, Data3=0x46ee, Data4=([0]=0xbe, [1]=0xf7, [2]=0x25, [3]=0x60, [4]=0x93, [5]=0xbd, [6]=0xbb, [7]=0x82))) returned 0x0
	[0064.422] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xa756df05, Data2=0x79ec, Data3=0x4173, Data4=([0]=0x99, [1]=0xa2, [2]=0x3a, [3]=0xf3, [4]=0x36, [5]=0xab, [6]=0x23, [7]=0x28))) returned 0x0
	[0064.422] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x81f882e1, Data2=0xf868, Data3=0x4de6, Data4=([0]=0xbb, [1]=0x82, [2]=0x94, [3]=0xa0, [4]=0xcf, [5]=0x6c, [6]=0x34, [7]=0x19))) returned 0x0
	[0064.423] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x513414aa, Data2=0xf0ac, Data3=0x4e8e, Data4=([0]=0x81, [1]=0xf5, [2]=0x3, [3]=0x36, [4]=0x86, [5]=0xd6, [6]=0xdf, [7]=0x4b))) returned 0x0
	[0064.423] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x90fe87bd, Data2=0xd00, Data3=0x4deb, Data4=([0]=0x9b, [1]=0x7d, [2]=0xe0, [3]=0x33, [4]=0x8, [5]=0x89, [6]=0xfa, [7]=0x48))) returned 0x0
	[0064.423] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xfc409e3b, Data2=0x1974, Data3=0x4d84, Data4=([0]=0x86, [1]=0xfb, [2]=0x10, [3]=0x66, [4]=0x97, [5]=0xd3, [6]=0x78, [7]=0x55))) returned 0x0
	[0064.423] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x698a6402, Data2=0x4b32, Data3=0x4453, Data4=([0]=0x9f, [1]=0xa5, [2]=0xc1, [3]=0xc5, [4]=0x2e, [5]=0x1e, [6]=0x75, [7]=0x2d))) returned 0x0
	[0064.424] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xd195bc29, Data2=0x91d4, Data3=0x468c, Data4=([0]=0x83, [1]=0xa8, [2]=0x73, [3]=0x47, [4]=0x3c, [5]=0xad, [6]=0x99, [7]=0xe8))) returned 0x0
	[0064.424] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x52eb71a6, Data2=0x59f0, Data3=0x4c9d, Data4=([0]=0x92, [1]=0xa3, [2]=0xbc, [3]=0x51, [4]=0x45, [5]=0x96, [6]=0x5f, [7]=0x4f))) returned 0x0
	[0064.424] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x733de845, Data2=0x3cd0, Data3=0x43c2, Data4=([0]=0xab, [1]=0x80, [2]=0xb2, [3]=0x3, [4]=0x8f, [5]=0x60, [6]=0x71, [7]=0xc7))) returned 0x0
	[0064.424] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x7ad21ca4, Data2=0x57a4, Data3=0x4429, Data4=([0]=0xb4, [1]=0x8d, [2]=0xb6, [3]=0xd2, [4]=0x4f, [5]=0x1c, [6]=0x73, [7]=0x26))) returned 0x0
	[0064.425] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x333c7b30, Data2=0x1f78, Data3=0x497e, Data4=([0]=0xaa, [1]=0xeb, [2]=0x7d, [3]=0x1f, [4]=0x36, [5]=0x78, [6]=0xe9, [7]=0xfb))) returned 0x0
	[0064.425] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x2e1b3065, Data2=0xf234, Data3=0x4711, Data4=([0]=0x9a, [1]=0xe2, [2]=0x45, [3]=0x30, [4]=0xe3, [5]=0xbc, [6]=0xcd, [7]=0x89))) returned 0x0
	[0064.425] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x2f5be6c7, Data2=0x6c2c, Data3=0x480e, Data4=([0]=0x95, [1]=0x96, [2]=0x6c, [3]=0x91, [4]=0x56, [5]=0x7f, [6]=0x7a, [7]=0xf3))) returned 0x0
	[0064.425] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xae1ec19a, Data2=0x4b6f, Data3=0x4c40, Data4=([0]=0xb1, [1]=0x2f, [2]=0xad, [3]=0x61, [4]=0x2f, [5]=0x95, [6]=0x66, [7]=0xbc))) returned 0x0
	[0064.425] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x1f9ff2e5, Data2=0x5e9f, Data3=0x4568, Data4=([0]=0x98, [1]=0xa5, [2]=0x27, [3]=0x94, [4]=0xa6, [5]=0x95, [6]=0x6d, [7]=0x42))) returned 0x0
	[0064.425] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x29fff69c, Data2=0x4f1f, Data3=0x49b6, Data4=([0]=0xa3, [1]=0x60, [2]=0xf9, [3]=0xba, [4]=0x7b, [5]=0x97, [6]=0xea, [7]=0xd8))) returned 0x0
	[0064.426] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x3ae37716, Data2=0xd8a8, Data3=0x47df, Data4=([0]=0x9b, [1]=0x32, [2]=0xeb, [3]=0x54, [4]=0xbd, [5]=0xe6, [6]=0xcf, [7]=0xcd))) returned 0x0
	[0064.427] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xf95a7ba9, Data2=0x4978, Data3=0x409f, Data4=([0]=0xb4, [1]=0x66, [2]=0x35, [3]=0xdf, [4]=0xc8, [5]=0xe0, [6]=0xbc, [7]=0xca))) returned 0x0
	[0064.428] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x5953311e, Data2=0xa2e1, Data3=0x4a0e, Data4=([0]=0xa9, [1]=0xfa, [2]=0xda, [3]=0xb8, [4]=0xea, [5]=0x8d, [6]=0x95, [7]=0x3d))) returned 0x0
	[0064.428] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xe2999aef, Data2=0xe1b8, Data3=0x4e4e, Data4=([0]=0x86, [1]=0x6f, [2]=0x3b, [3]=0x82, [4]=0x78, [5]=0xe9, [6]=0x42, [7]=0xee))) returned 0x0
	[0064.428] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xa82072b2, Data2=0x61da, Data3=0x428b, Data4=([0]=0xaa, [1]=0xf9, [2]=0x99, [3]=0xe8, [4]=0x61, [5]=0x88, [6]=0x72, [7]=0xc6))) returned 0x0
	[0064.429] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xb793b96f, Data2=0x6c3, Data3=0x4c6c, Data4=([0]=0xa7, [1]=0x15, [2]=0xb, [3]=0x4f, [4]=0x26, [5]=0x1a, [6]=0x25, [7]=0x18))) returned 0x0
	[0064.429] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x44051729, Data2=0x94d1, Data3=0x466b, Data4=([0]=0xb4, [1]=0x3b, [2]=0x9f, [3]=0xba, [4]=0xd1, [5]=0x9c, [6]=0xbb, [7]=0x69))) returned 0x0
	[0064.429] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x842fcc93, Data2=0x5692, Data3=0x4d07, Data4=([0]=0x89, [1]=0x91, [2]=0x99, [3]=0x45, [4]=0x96, [5]=0xfb, [6]=0x5f, [7]=0xc1))) returned 0x0
	[0064.429] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x483ac2f5, Data2=0x8309, Data3=0x4279, Data4=([0]=0xa4, [1]=0x54, [2]=0x5e, [3]=0xdc, [4]=0xe7, [5]=0x1b, [6]=0x81, [7]=0xed))) returned 0x0
	[0064.429] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xa3991e54, Data2=0xb01a, Data3=0x447b, Data4=([0]=0xb0, [1]=0x75, [2]=0x84, [3]=0x85, [4]=0xc8, [5]=0x82, [6]=0xd, [7]=0xd))) returned 0x0
	[0064.430] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x7aa8c8e6, Data2=0xf123, Data3=0x418e, Data4=([0]=0xa1, [1]=0xce, [2]=0x50, [3]=0xf6, [4]=0x5a, [5]=0x8d, [6]=0xeb, [7]=0x4a))) returned 0x0
	[0064.430] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xa8b7bc39, Data2=0xb51, Data3=0x4827, Data4=([0]=0xac, [1]=0x18, [2]=0xc5, [3]=0xcb, [4]=0x68, [5]=0x58, [6]=0x45, [7]=0x8d))) returned 0x0
	[0064.430] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xe10fbf0e, Data2=0x94bc, Data3=0x4929, Data4=([0]=0xaf, [1]=0xe8, [2]=0x12, [3]=0x6d, [4]=0x6f, [5]=0xcd, [6]=0x10, [7]=0xc8))) returned 0x0
	[0064.431] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x73a796b9, Data2=0x82af, Data3=0x4d3c, Data4=([0]=0xa3, [1]=0xf7, [2]=0x51, [3]=0xa9, [4]=0x10, [5]=0xe5, [6]=0x35, [7]=0x7))) returned 0x0
	[0064.431] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xbafc6771, Data2=0xae99, Data3=0x4203, Data4=([0]=0x8a, [1]=0x51, [2]=0xb5, [3]=0x8c, [4]=0x9f, [5]=0xa8, [6]=0x79, [7]=0x65))) returned 0x0
	[0064.436] VirtualQuery (in: lpAddress=0x19d060, lpBuffer=0x19e060, dwLength=0x1c | out: lpBuffer=0x19e060*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.442] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xc5e5b66e, Data2=0x5822, Data3=0x429b, Data4=([0]=0xa0, [1]=0x79, [2]=0x47, [3]=0xbf, [4]=0x6b, [5]=0x83, [6]=0x62, [7]=0xe7))) returned 0x0
	[0064.442] VirtualQuery (in: lpAddress=0x19d060, lpBuffer=0x19e060, dwLength=0x1c | out: lpBuffer=0x19e060*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.443] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x47d11498, Data2=0x3469, Data3=0x4aa7, Data4=([0]=0x8f, [1]=0xc4, [2]=0x5, [3]=0x5c, [4]=0xb4, [5]=0x8c, [6]=0xd9, [7]=0xb7))) returned 0x0
	[0064.443] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xbb663486, Data2=0x6e50, Data3=0x4793, Data4=([0]=0xbd, [1]=0xda, [2]=0x50, [3]=0x56, [4]=0x5c, [5]=0x24, [6]=0xbd, [7]=0x49))) returned 0x0
	[0064.443] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x9f279aca, Data2=0xa24d, Data3=0x4d70, Data4=([0]=0xa2, [1]=0x4d, [2]=0x61, [3]=0x4, [4]=0x3a, [5]=0x59, [6]=0xdb, [7]=0xe))) returned 0x0
	[0064.443] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xec177c3f, Data2=0x3a91, Data3=0x4f58, Data4=([0]=0xa4, [1]=0x70, [2]=0xbb, [3]=0xec, [4]=0x1a, [5]=0xf, [6]=0x50, [7]=0x82))) returned 0x0
	[0064.444] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xb5216a7b, Data2=0x7c14, Data3=0x4ad7, Data4=([0]=0x83, [1]=0x20, [2]=0x8b, [3]=0x64, [4]=0x35, [5]=0xcc, [6]=0xf4, [7]=0x15))) returned 0x0
	[0064.444] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xdb24be6a, Data2=0x7d0d, Data3=0x49b4, Data4=([0]=0x82, [1]=0x39, [2]=0xbf, [3]=0xd5, [4]=0xaf, [5]=0xa9, [6]=0xd5, [7]=0x3a))) returned 0x0
	[0064.444] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x507170a4, Data2=0x13e2, Data3=0x4ec9, Data4=([0]=0xb7, [1]=0xbc, [2]=0xe4, [3]=0x91, [4]=0xc0, [5]=0xb6, [6]=0x24, [7]=0x93))) returned 0x0
	[0064.445] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.445] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x33c7b3ce, Data2=0x6c23, Data3=0x44de, Data4=([0]=0xbb, [1]=0x73, [2]=0x38, [3]=0xc7, [4]=0xe5, [5]=0x84, [6]=0x6b, [7]=0x67))) returned 0x0
	[0064.446] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x793d79bd, Data2=0x6b32, Data3=0x4d80, Data4=([0]=0xab, [1]=0x53, [2]=0x54, [3]=0x41, [4]=0x3c, [5]=0xa7, [6]=0xfd, [7]=0xb9))) returned 0x0
	[0064.446] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x95b9f574, Data2=0xdf65, Data3=0x4a25, Data4=([0]=0xaf, [1]=0xd8, [2]=0x46, [3]=0x47, [4]=0x44, [5]=0xd0, [6]=0x61, [7]=0x2b))) returned 0x0
	[0064.446] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x9f88295, Data2=0x380c, Data3=0x41a3, Data4=([0]=0x93, [1]=0x4, [2]=0xa1, [3]=0x8, [4]=0xb6, [5]=0xdb, [6]=0x9d, [7]=0xbc))) returned 0x0
	[0064.446] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xd2717af5, Data2=0x1ed4, Data3=0x43c0, Data4=([0]=0xbc, [1]=0xa0, [2]=0xa0, [3]=0x8c, [4]=0x4, [5]=0x74, [6]=0x74, [7]=0xea))) returned 0x0
	[0064.447] VirtualQuery (in: lpAddress=0x19d040, lpBuffer=0x19e040, dwLength=0x1c | out: lpBuffer=0x19e040*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.447] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x349bf52a, Data2=0xf266, Data3=0x4a00, Data4=([0]=0xa7, [1]=0xc0, [2]=0x86, [3]=0x85, [4]=0xbf, [5]=0x4a, [6]=0x96, [7]=0xfe))) returned 0x0
	[0064.447] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x35018bd5, Data2=0xabd, Data3=0x481a, Data4=([0]=0xa5, [1]=0x68, [2]=0x92, [3]=0x97, [4]=0x50, [5]=0x3c, [6]=0x2c, [7]=0x5b))) returned 0x0
	[0064.447] VirtualQuery (in: lpAddress=0x19d068, lpBuffer=0x19e068, dwLength=0x1c | out: lpBuffer=0x19e068*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.448] VirtualQuery (in: lpAddress=0x19d068, lpBuffer=0x19e068, dwLength=0x1c | out: lpBuffer=0x19e068*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.448] VirtualQuery (in: lpAddress=0x19d068, lpBuffer=0x19e068, dwLength=0x1c | out: lpBuffer=0x19e068*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.448] VirtualQuery (in: lpAddress=0x19d068, lpBuffer=0x19e068, dwLength=0x1c | out: lpBuffer=0x19e068*(BaseAddress=0x19d000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.449] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48
	[0064.449] GetLastError () returned 0x0
	[0064.449] SetErrorMode (uMode=0x1) returned 0x1
	[0064.449] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320
	[0064.450] GetLastError () returned 0x0
	[0064.450] GetFileType (hFile=0x320) returned 0x1
	[0064.450] SetErrorMode (uMode=0x1) returned 0x1
	[0064.450] GetFileType (hFile=0x320) returned 0x1
	[0064.450] ReadFile (in: hFile=0x320, lpBuffer=0x34ddf84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x34ddf84*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.453] GetLastError () returned 0x0
	[0064.453] ReadFile (in: hFile=0x320, lpBuffer=0x34ddf84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x34ddf84*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.454] GetLastError () returned 0x0
	[0064.454] ReadFile (in: hFile=0x320, lpBuffer=0x34ddf84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x34ddf84*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.454] GetLastError () returned 0x0
	[0064.454] ReadFile (in: hFile=0x320, lpBuffer=0x34ddf84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x34ddf84*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.454] GetLastError () returned 0x0
	[0064.456] ReadFile (in: hFile=0x320, lpBuffer=0x34ddf84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x34ddf84*, lpNumberOfBytesRead=0x19e314*=0x8b4, lpOverlapped=0x0) returned 1
	[0064.456] GetLastError () returned 0x0
	[0064.456] ReadFile (in: hFile=0x320, lpBuffer=0x34dd3d8, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x34dd3d8*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0064.456] GetLastError () returned 0x0
	[0064.456] ReadFile (in: hFile=0x320, lpBuffer=0x34ddf84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x34ddf84*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0064.456] GetLastError () returned 0x0
	[0064.456] CloseHandle (hObject=0x320) returned 1
	[0064.456] GetLastError () returned 0x0
	[0064.456] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48
	[0064.456] GetLastError () returned 0x0
	[0064.456] SetErrorMode (uMode=0x1) returned 0x1
	[0064.456] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x34fef80 | out: lpFileInformation=0x34fef80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1a87f7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1a87f7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd36b30fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x48b4)) returned 1
	[0064.457] GetLastError () returned 0x0
	[0064.457] SetErrorMode (uMode=0x1) returned 0x1
	[0064.457] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48
	[0064.457] GetLastError () returned 0x0
	[0064.457] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e298 | out: phkResult=0x19e298*=0x320) returned 0x0
	[0064.457] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x0, lpcbData=0x19e2dc*=0x0 | out: lpType=0x19e2e0*=0x1, lpData=0x0, lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.457] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x4fe098, lpcbData=0x19e2dc*=0x56 | out: lpType=0x19e2e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.457] RegCloseKey (hKey=0x320) returned 0x0
	[0064.457] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48
	[0064.457] GetLastError () returned 0x0
	[0064.458] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48
	[0064.458] GetLastError () returned 0x0
	[0064.459] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x38878690, Data2=0xbbd4, Data3=0x4807, Data4=([0]=0xa7, [1]=0x95, [2]=0x6d, [3]=0x22, [4]=0xdd, [5]=0x7b, [6]=0x2e, [7]=0xf1))) returned 0x0
	[0064.460] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x9d3ed19e, Data2=0x7671, Data3=0x4e29, Data4=([0]=0x94, [1]=0xa, [2]=0x55, [3]=0x1e, [4]=0x88, [5]=0xae, [6]=0xd9, [7]=0x6f))) returned 0x0
	[0064.460] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41
	[0064.460] GetLastError () returned 0x0
	[0064.460] SetErrorMode (uMode=0x1) returned 0x1
	[0064.460] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320
	[0064.460] GetLastError () returned 0x0
	[0064.460] GetFileType (hFile=0x320) returned 0x1
	[0064.460] SetErrorMode (uMode=0x1) returned 0x1
	[0064.461] GetFileType (hFile=0x320) returned 0x1
	[0064.461] ReadFile (in: hFile=0x320, lpBuffer=0x3514e90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3514e90*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.463] GetLastError () returned 0x0
	[0064.463] ReadFile (in: hFile=0x320, lpBuffer=0x3514e90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3514e90*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.464] GetLastError () returned 0x0
	[0064.464] ReadFile (in: hFile=0x320, lpBuffer=0x3514e90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3514e90*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.465] GetLastError () returned 0x0
	[0064.465] ReadFile (in: hFile=0x320, lpBuffer=0x3514e90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3514e90*, lpNumberOfBytesRead=0x19e314*=0x1000, lpOverlapped=0x0) returned 1
	[0064.465] GetLastError () returned 0x0
	[0064.466] ReadFile (in: hFile=0x320, lpBuffer=0x3514e90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3514e90*, lpNumberOfBytesRead=0x19e314*=0xe98, lpOverlapped=0x0) returned 1
	[0064.466] GetLastError () returned 0x0
	[0064.466] ReadFile (in: hFile=0x320, lpBuffer=0x35144c8, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x35144c8*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0064.466] GetLastError () returned 0x0
	[0064.466] ReadFile (in: hFile=0x320, lpBuffer=0x3514e90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e314, lpOverlapped=0x0 | out: lpBuffer=0x3514e90*, lpNumberOfBytesRead=0x19e314*=0x0, lpOverlapped=0x0) returned 1
	[0064.466] GetLastError () returned 0x0
	[0064.466] CloseHandle (hObject=0x320) returned 1
	[0064.466] GetLastError () returned 0x0
	[0064.466] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41
	[0064.467] GetLastError () returned 0x0
	[0064.467] SetErrorMode (uMode=0x1) returned 0x1
	[0064.467] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x3535e8c | out: lpFileInformation=0x3535e8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1ce956, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1ce956, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd372551c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x4e98)) returned 1
	[0064.467] GetLastError () returned 0x0
	[0064.467] SetErrorMode (uMode=0x1) returned 0x1
	[0064.467] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41
	[0064.467] GetLastError () returned 0x0
	[0064.467] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e298 | out: phkResult=0x19e298*=0x320) returned 0x0
	[0064.467] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x0, lpcbData=0x19e2dc*=0x0 | out: lpType=0x19e2e0*=0x1, lpData=0x0, lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.468] RegQueryValueExW (in: hKey=0x320, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e2e0, lpData=0x4fe098, lpcbData=0x19e2dc*=0x56 | out: lpType=0x19e2e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x19e2dc*=0x56) returned 0x0
	[0064.468] RegCloseKey (hKey=0x320) returned 0x0
	[0064.468] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19de40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41
	[0064.468] GetLastError () returned 0x0
	[0064.468] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x19ddd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41
	[0064.468] GetLastError () returned 0x0
	[0064.470] VirtualQuery (in: lpAddress=0x19cff0, lpBuffer=0x19dff0, dwLength=0x1c | out: lpBuffer=0x19dff0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.470] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0x94ce413a, Data2=0x1e22, Data3=0x4076, Data4=([0]=0x83, [1]=0xc0, [2]=0x87, [3]=0x25, [4]=0x9e, [5]=0x12, [6]=0x31, [7]=0x97))) returned 0x0
	[0064.470] CoCreateGuid (in: pguid=0x19e308 | out: pguid=0x19e308*(Data1=0xd76d7228, Data2=0xe65d, Data3=0x4b6b, Data4=([0]=0xae, [1]=0x80, [2]=0x8b, [3]=0x6, [4]=0x5e, [5]=0xb6, [6]=0x7, [7]=0xb5))) returned 0x0
	[0064.500] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x19dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e
	[0064.500] GetLastError () returned 0x57
	[0064.501] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x19dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e
	[0064.501] GetLastError () returned 0x57
	[0064.504] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x19dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70
	[0064.504] GetLastError () returned 0x57
	[0064.505] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x19dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70
	[0064.505] GetLastError () returned 0x57
	[0064.507] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.507] GetLastError () returned 0x57
	[0064.507] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.507] GetLastError () returned 0x57
	[0064.509] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x19dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
	[0064.509] GetLastError () returned 0x57
	[0064.510] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x19dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
	[0064.510] GetLastError () returned 0x57
	[0064.512] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0064.512] GetLastError () returned 0x57
	[0064.512] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x19dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0064.512] GetLastError () returned 0x57
	[0064.514] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x19dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
	[0064.515] GetLastError () returned 0x57
	[0064.515] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x19dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
	[0064.515] GetLastError () returned 0x57
	[0064.517] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x19dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
	[0064.517] GetLastError () returned 0x57
	[0064.517] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x19dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
	[0064.517] GetLastError () returned 0x57
	[0064.523] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.523] GetLastError () returned 0xcb
	[0064.525] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.525] GetLastError () returned 0xcb
	[0064.536] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.536] GetLastError () returned 0xcb
	[0064.540] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.540] GetLastError () returned 0xcb
	[0064.542] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.542] GetLastError () returned 0xcb
	[0064.546] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e38c | out: phkResult=0x19e38c*=0x320) returned 0x0
	[0064.549] RegQueryInfoKeyW (in: hKey=0x320, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x19e3dc, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19e3e0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x19e3dc*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19e3e0*=0x2, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.551] RegEnumValueW (in: hKey=0x320, dwIndex=0x0, lpValueName=0x4fe098, lpcchValueName=0x19e404, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x19e404, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
	[0064.551] RegEnumValueW (in: hKey=0x320, dwIndex=0x1, lpValueName=0x4fe098, lpcchValueName=0x19e404, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x19e404, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
	[0064.551] RegQueryValueExW (in: hKey=0x320, lpValueName="StackVersion", lpReserved=0x0, lpType=0x19e3e4, lpData=0x0, lpcbData=0x19e3e0*=0x0 | out: lpType=0x19e3e4*=0x1, lpData=0x0, lpcbData=0x19e3e0*=0x8) returned 0x0
	[0064.552] RegQueryValueExW (in: hKey=0x320, lpValueName="StackVersion", lpReserved=0x0, lpType=0x19e3e4, lpData=0x4fe098, lpcbData=0x19e3e0*=0x8 | out: lpType=0x19e3e4*=0x1, lpData="2.0", lpcbData=0x19e3e0*=0x8) returned 0x0
	[0064.658] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e348 | out: phkResult=0x19e348*=0x324) returned 0x0
	[0064.658] RegQueryInfoKeyW (in: hKey=0x324, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x19e398, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19e39c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x19e398*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19e39c*=0x2, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.658] RegEnumValueW (in: hKey=0x324, dwIndex=0x0, lpValueName=0x4fe098, lpcchValueName=0x19e3c0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x19e3c0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
	[0064.658] RegEnumValueW (in: hKey=0x324, dwIndex=0x1, lpValueName=0x4fe098, lpcchValueName=0x19e3c0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x19e3c0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
	[0064.658] RegQueryValueExW (in: hKey=0x324, lpValueName="StackVersion", lpReserved=0x0, lpType=0x19e3a0, lpData=0x0, lpcbData=0x19e39c*=0x0 | out: lpType=0x19e3a0*=0x1, lpData=0x0, lpcbData=0x19e39c*=0x8) returned 0x0
	[0064.659] RegQueryValueExW (in: hKey=0x324, lpValueName="StackVersion", lpReserved=0x0, lpType=0x19e3a0, lpData=0x4fe098, lpcbData=0x19e39c*=0x8 | out: lpType=0x19e3a0*=0x1, lpData="2.0", lpcbData=0x19e39c*=0x8) returned 0x0
	[0064.660] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.660] GetLastError () returned 0xcb
	[0064.664] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.664] GetLastError () returned 0xcb
	[0064.736] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e308 | out: phkResult=0x19e308*=0x328) returned 0x0
	[0064.737] RegQueryInfoKeyW (in: hKey=0x328, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x19e370, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19e36c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x19e370*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19e36c*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.738] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x0, lpName=0x4fe098, lpcchName=0x19e38c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x19e38c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.738] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x1, lpName=0x4fe098, lpcchName=0x19e38c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x19e38c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.738] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x2, lpName=0x4fe098, lpcchName=0x19e38c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x19e38c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.738] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x3, lpName=0x4fe098, lpcchName=0x19e38c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x19e38c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.739] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x4, lpName=0x4fe098, lpcchName=0x19e38c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x19e38c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.739] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x5, lpName=0x4fe098, lpcchName=0x19e38c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x19e38c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.739] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x6, lpName=0x4fe098, lpcchName=0x19e38c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x19e38c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.739] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x7, lpName=0x4fe098, lpcchName=0x19e38c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x19e38c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.739] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x8, lpName=0x4fe098, lpcchName=0x19e38c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x19e38c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.740] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x344) returned 0x0
	[0064.740] RegOpenKeyExW (in: hKey=0x344, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x0) returned 0x2
	[0064.740] RegOpenKeyExW (in: hKey=0x328, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x354) returned 0x0
	[0064.741] RegOpenKeyExW (in: hKey=0x354, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x0) returned 0x2
	[0064.741] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x358) returned 0x0
	[0064.741] RegOpenKeyExW (in: hKey=0x358, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x0) returned 0x2
	[0064.741] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x35c) returned 0x0
	[0064.741] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x0) returned 0x2
	[0064.742] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x360) returned 0x0
	[0064.742] RegOpenKeyExW (in: hKey=0x360, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x0) returned 0x2
	[0064.742] RegOpenKeyExW (in: hKey=0x328, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x364) returned 0x0
	[0064.742] RegOpenKeyExW (in: hKey=0x364, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x0) returned 0x2
	[0064.743] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x368) returned 0x0
	[0064.743] RegOpenKeyExW (in: hKey=0x368, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x0) returned 0x2
	[0064.743] RegOpenKeyExW (in: hKey=0x328, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x36c) returned 0x0
	[0064.743] RegOpenKeyExW (in: hKey=0x36c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x0) returned 0x2
	[0064.743] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x370) returned 0x0
	[0064.744] RegOpenKeyExW (in: hKey=0x370, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e338 | out: phkResult=0x19e338*=0x374) returned 0x0
	[0064.744] RegCloseKey (hKey=0x374) returned 0x0
	[0064.744] RegCloseKey (hKey=0x328) returned 0x0
	[0064.745] RegCloseKey (hKey=0x370) returned 0x0
	[0064.764] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x4fe858, nSize=0x19e484 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x19e484) returned 0x1
	[0064.767] GetLastError () returned 0x3
	[0064.769] GetUserNameW (in: lpBuffer=0x4fe098, pcbBuffer=0x19e48c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x19e48c) returned 1
	[0064.813] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e2ec | out: phkResult=0x19e2ec*=0x328) returned 0x0
	[0064.813] RegQueryInfoKeyW (in: hKey=0x328, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x19e354, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19e350, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x19e354*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19e350*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.813] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x0, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.813] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x1, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.813] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x2, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.814] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x3, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.814] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x4, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.814] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x5, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.814] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x6, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.814] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x7, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.815] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x8, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.815] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x374) returned 0x0
	[0064.815] RegOpenKeyExW (in: hKey=0x374, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.816] RegOpenKeyExW (in: hKey=0x328, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x378) returned 0x0
	[0064.816] RegOpenKeyExW (in: hKey=0x378, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.816] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x37c) returned 0x0
	[0064.816] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.816] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x380) returned 0x0
	[0064.817] RegOpenKeyExW (in: hKey=0x380, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.817] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x384) returned 0x0
	[0064.817] RegOpenKeyExW (in: hKey=0x384, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.817] RegOpenKeyExW (in: hKey=0x328, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x388) returned 0x0
	[0064.818] RegOpenKeyExW (in: hKey=0x388, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.818] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x38c) returned 0x0
	[0064.818] RegOpenKeyExW (in: hKey=0x38c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.818] RegOpenKeyExW (in: hKey=0x328, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x390) returned 0x0
	[0064.818] RegOpenKeyExW (in: hKey=0x390, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.819] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x394) returned 0x0
	[0064.819] RegOpenKeyExW (in: hKey=0x394, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x398) returned 0x0
	[0064.819] RegCloseKey (hKey=0x398) returned 0x0
	[0064.819] RegCloseKey (hKey=0x328) returned 0x0
	[0064.819] RegCloseKey (hKey=0x394) returned 0x0
	[0064.819] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e2ec | out: phkResult=0x19e2ec*=0x394) returned 0x0
	[0064.820] RegQueryInfoKeyW (in: hKey=0x394, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x19e354, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19e350, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x19e354*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19e350*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.820] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x0, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.820] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x1, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.820] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x2, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.820] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x3, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.820] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x4, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.821] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x5, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.821] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x6, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.821] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x7, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.821] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x8, lpName=0x4fe098, lpcchName=0x19e370, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x19e370, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.822] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x328) returned 0x0
	[0064.822] RegOpenKeyExW (in: hKey=0x328, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.822] RegOpenKeyExW (in: hKey=0x394, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x398) returned 0x0
	[0064.822] RegOpenKeyExW (in: hKey=0x398, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.822] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x39c) returned 0x0
	[0064.823] RegOpenKeyExW (in: hKey=0x39c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.823] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x3a0) returned 0x0
	[0064.824] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.824] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x3a4) returned 0x0
	[0064.824] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.824] RegOpenKeyExW (in: hKey=0x394, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x3a8) returned 0x0
	[0064.824] RegOpenKeyExW (in: hKey=0x3a8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.825] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x3ac) returned 0x0
	[0064.825] RegOpenKeyExW (in: hKey=0x3ac, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.825] RegOpenKeyExW (in: hKey=0x394, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x3b0) returned 0x0
	[0064.825] RegOpenKeyExW (in: hKey=0x3b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x0) returned 0x2
	[0064.825] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x3b4) returned 0x0
	[0064.826] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e31c | out: phkResult=0x19e31c*=0x3b8) returned 0x0
	[0064.826] RegCloseKey (hKey=0x3b8) returned 0x0
	[0064.826] RegCloseKey (hKey=0x394) returned 0x0
	[0064.827] RegCloseKey (hKey=0x3b4) returned 0x0
	[0064.827] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e2e0 | out: phkResult=0x19e2e0*=0x3b4) returned 0x0
	[0064.827] RegQueryInfoKeyW (in: hKey=0x3b4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x19e348, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19e344, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x19e348*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19e344*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.827] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x0, lpName=0x4fe098, lpcchName=0x19e364, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x19e364, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.827] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x1, lpName=0x4fe098, lpcchName=0x19e364, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x19e364, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.827] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x2, lpName=0x4fe098, lpcchName=0x19e364, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x19e364, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.828] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x3, lpName=0x4fe098, lpcchName=0x19e364, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x19e364, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.828] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x4, lpName=0x4fe098, lpcchName=0x19e364, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x19e364, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.828] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x5, lpName=0x4fe098, lpcchName=0x19e364, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x19e364, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.828] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x6, lpName=0x4fe098, lpcchName=0x19e364, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x19e364, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.828] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x7, lpName=0x4fe098, lpcchName=0x19e364, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x19e364, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.828] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x8, lpName=0x4fe098, lpcchName=0x19e364, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x19e364, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0064.828] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x394) returned 0x0
	[0064.828] RegOpenKeyExW (in: hKey=0x394, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x0) returned 0x2
	[0064.828] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x3b8) returned 0x0
	[0064.829] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x0) returned 0x2
	[0064.829] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x3bc) returned 0x0
	[0064.829] RegOpenKeyExW (in: hKey=0x3bc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x0) returned 0x2
	[0064.829] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x3c0) returned 0x0
	[0064.829] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x0) returned 0x2
	[0064.829] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x3c4) returned 0x0
	[0064.830] RegOpenKeyExW (in: hKey=0x3c4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x0) returned 0x2
	[0064.830] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x3c8) returned 0x0
	[0064.830] RegOpenKeyExW (in: hKey=0x3c8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x0) returned 0x2
	[0064.830] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x3cc) returned 0x0
	[0064.830] RegOpenKeyExW (in: hKey=0x3cc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x0) returned 0x2
	[0064.830] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x3d0) returned 0x0
	[0064.831] RegOpenKeyExW (in: hKey=0x3d0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x0) returned 0x2
	[0064.831] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x3d4) returned 0x0
	[0064.831] RegOpenKeyExW (in: hKey=0x3d4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e310 | out: phkResult=0x19e310*=0x3d8) returned 0x0
	[0064.831] RegCloseKey (hKey=0x3d8) returned 0x0
	[0064.831] RegCloseKey (hKey=0x3b4) returned 0x0
	[0064.831] RegCloseKey (hKey=0x3d4) returned 0x0
	[0064.836] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x4f50004
	[0064.842] GetLastError () returned 0x0
	[0064.843] ReportEventW (hEventLog=0x4f50004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x35adca0*="WSMan", lpRawData=0x35adb48) returned 1
	[0064.850] GetLastError () returned 0x0
	[0064.851] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.851] GetLastError () returned 0xcb
	[0064.852] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.852] GetLastError () returned 0xcb
	[0064.852] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.852] GetLastError () returned 0xcb
	[0064.852] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.852] GetLastError () returned 0xcb
	[0064.852] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x4fe858, nSize=0x19e484 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x19e484) returned 0x1
	[0064.853] GetLastError () returned 0xcb
	[0064.853] GetUserNameW (in: lpBuffer=0x4fe098, pcbBuffer=0x19e48c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x19e48c) returned 1
	[0064.853] ReportEventW (hEventLog=0x4f50004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x35b1b7c*="Alias", lpRawData=0x35b1a38) returned 1
	[0064.854] GetLastError () returned 0x0
	[0064.855] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.855] GetLastError () returned 0xcb
	[0064.856] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.856] GetLastError () returned 0xcb
	[0064.857] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.857] GetLastError () returned 0xcb
	[0064.857] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.857] GetLastError () returned 0xcb
	[0064.857] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x4fe858, nSize=0x19e484 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x19e484) returned 0x1
	[0064.857] GetLastError () returned 0xcb
	[0064.857] GetUserNameW (in: lpBuffer=0x4fe098, pcbBuffer=0x19e48c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x19e48c) returned 1
	[0064.858] ReportEventW (hEventLog=0x4f50004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x35b5b10*="Environment", lpRawData=0x35b59cc) returned 1
	[0064.858] GetLastError () returned 0x0
	[0064.860] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.860] GetLastError () returned 0xcb
	[0064.861] GetEnvironmentVariableW (in: lpName="HOMEDRIVE", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="C:") returned 0x2
	[0064.861] GetLastError () returned 0xcb
	[0064.861] GetEnvironmentVariableW (in: lpName="HOMEPATH", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1b
	[0064.861] GetLastError () returned 0xcb
	[0064.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x19dfb4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d
	[0064.861] GetLastError () returned 0xcb
	[0064.861] SetErrorMode (uMode=0x1) returned 0x1
	[0064.861] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x19e434 | out: lpFileInformation=0x19e434*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0064.861] GetLastError () returned 0xcb
	[0064.861] SetErrorMode (uMode=0x1) returned 0x1
	[0064.864] GetLogicalDrives () returned 0x4
	[0064.864] GetLastError () returned 0xcb
	[0064.866] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x19ded8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0064.866] GetLastError () returned 0xcb
	[0064.868] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0064.868] GetLastError () returned 0xcb
	[0064.868] SetErrorMode (uMode=0x1) returned 0x1
	[0064.870] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x4fe198, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x19e400, lpMaximumComponentLength=0x19e3fc, lpFileSystemFlags=0x19e3f8, lpFileSystemNameBuffer=0x4fe098, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x19e400*=0x9c354b42, lpMaximumComponentLength=0x19e3fc*=0xff, lpFileSystemFlags=0x19e3f8*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1
	[0064.870] GetLastError () returned 0xcb
	[0064.870] SetErrorMode (uMode=0x1) returned 0x1
	[0064.870] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0064.871] GetLastError () returned 0xcb
	[0064.871] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x19df60, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0064.871] GetLastError () returned 0xcb
	[0064.871] SetErrorMode (uMode=0x1) returned 0x1
	[0064.871] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x35b6d48 | out: lpFileInformation=0x35b6d48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0064.871] GetLastError () returned 0xcb
	[0064.871] SetErrorMode (uMode=0x1) returned 0x1
	[0064.871] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x19df60, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0064.871] GetLastError () returned 0xcb
	[0064.871] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x19deec, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0064.871] GetLastError () returned 0xcb
	[0064.871] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0064.871] GetLastError () returned 0xcb
	[0064.872] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x19dea8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0064.872] GetLastError () returned 0xcb
	[0064.872] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0064.872] GetLastError () returned 0xcb
	[0064.873] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x19deb0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0064.873] GetLastError () returned 0xcb
	[0064.873] SetErrorMode (uMode=0x1) returned 0x1
	[0064.874] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x35b79a0 | out: lpFileInformation=0x35b79a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0064.874] GetLastError () returned 0xcb
	[0064.874] SetErrorMode (uMode=0x1) returned 0x1
	[0064.874] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x19deb8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0064.874] GetLastError () returned 0xcb
	[0064.874] SetErrorMode (uMode=0x1) returned 0x1
	[0064.874] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x35b7af0 | out: lpFileInformation=0x35b7af0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0064.874] GetLastError () returned 0xcb
	[0064.874] SetErrorMode (uMode=0x1) returned 0x1
	[0064.874] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x19defc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0064.874] GetLastError () returned 0xcb
	[0064.874] SetErrorMode (uMode=0x1) returned 0x1
	[0064.874] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x35b7c90 | out: lpFileInformation=0x35b7c90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0064.875] GetLastError () returned 0xcb
	[0064.875] SetErrorMode (uMode=0x1) returned 0x1
	[0064.875] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x4fe858, nSize=0x19e484 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x19e484) returned 0x1
	[0064.875] GetLastError () returned 0xcb
	[0064.875] GetUserNameW (in: lpBuffer=0x4fe098, pcbBuffer=0x19e48c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x19e48c) returned 1
	[0064.876] ReportEventW (hEventLog=0x4f50004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x35baa18*="FileSystem", lpRawData=0x35ba8d4) returned 1
	[0064.876] GetLastError () returned 0x0
	[0064.877] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.877] GetLastError () returned 0xcb
	[0064.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.878] GetLastError () returned 0xcb
	[0064.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.878] GetLastError () returned 0xcb
	[0064.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.878] GetLastError () returned 0xcb
	[0064.878] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x4fe858, nSize=0x19e484 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x19e484) returned 0x1
	[0064.878] GetLastError () returned 0xcb
	[0064.879] GetUserNameW (in: lpBuffer=0x4fe098, pcbBuffer=0x19e48c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x19e48c) returned 1
	[0064.879] ReportEventW (hEventLog=0x4f50004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x35beb08*="Function", lpRawData=0x35be9c4) returned 1
	[0064.879] GetLastError () returned 0x0
	[0064.882] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.882] GetLastError () returned 0xcb
	[0064.892] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de98, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.892] GetLastError () returned 0xcb
	[0064.893] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.893] GetLastError () returned 0xcb
	[0064.893] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.893] GetLastError () returned 0xcb
	[0064.893] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.893] GetLastError () returned 0xcb
	[0064.982] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de98, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.982] GetLastError () returned 0xcb
	[0064.982] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.982] GetLastError () returned 0xcb
	[0064.982] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.982] GetLastError () returned 0xcb
	[0064.986] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x4fe858, nSize=0x19e484 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x19e484) returned 0x1
	[0064.987] GetLastError () returned 0xcb
	[0064.987] GetUserNameW (in: lpBuffer=0x4fe098, pcbBuffer=0x19e48c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x19e48c) returned 1
	[0064.989] ReportEventW (hEventLog=0x4f50004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x35d7bc4*="Registry", lpRawData=0x35d7a80) returned 1
	[0064.989] GetLastError () returned 0x0
	[0064.991] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.991] GetLastError () returned 0x0
	[0064.991] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.991] GetLastError () returned 0x0
	[0064.991] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19de34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.991] GetLastError () returned 0x0
	[0064.993] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x4fe858, nSize=0x19e484 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x19e484) returned 0x1
	[0064.993] GetLastError () returned 0x0
	[0064.993] GetUserNameW (in: lpBuffer=0x4fe098, pcbBuffer=0x19e48c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x19e48c) returned 1
	[0064.994] ReportEventW (hEventLog=0x4f50004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x35db9ac*="Variable", lpRawData=0x35db868) returned 1
	[0064.994] GetLastError () returned 0x0
	[0064.996] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.996] GetLastError () returned 0xcb
	[0064.999] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.999] GetLastError () returned 0xcb
	[0065.002] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x19de84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
	[0065.002] GetLastError () returned 0xcb
	[0065.002] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x19de34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
	[0065.002] GetLastError () returned 0xcb
	[0065.002] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x19de34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
	[0065.002] GetLastError () returned 0xcb
	[0065.002] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x19de34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
	[0065.002] GetLastError () returned 0xcb
	[0065.080] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x4fe858, nSize=0x19e484 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x19e484) returned 0x1
	[0065.081] GetLastError () returned 0x3
	[0065.081] GetUserNameW (in: lpBuffer=0x4fe098, pcbBuffer=0x19e48c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x19e48c) returned 1
	[0065.081] ReportEventW (hEventLog=0x4f50004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x35e9778*="Certificate", lpRawData=0x35e9634) returned 1
	[0065.082] GetLastError () returned 0x0
	[0065.097] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.097] GetLastError () returned 0xcb
	[0065.099] GetLogicalDrives () returned 0x4
	[0065.099] GetLastError () returned 0xcb
	[0065.099] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x19dffc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0065.099] GetLastError () returned 0xcb
	[0065.100] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0065.100] GetLastError () returned 0xcb
	[0065.101] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x4fe098 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0065.101] GetLastError () returned 0xcb
	[0065.102] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.102] GetLastError () returned 0xcb
	[0065.103] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.103] GetLastError () returned 0xcb
	[0065.127] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.127] GetLastError () returned 0xcb
	[0065.131] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.131] GetLastError () returned 0xcb
	[0065.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x19de44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0065.132] GetLastError () returned 0xcb
	[0065.132] SetErrorMode (uMode=0x1) returned 0x1
	[0065.132] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x35f10e4 | out: lpFileInformation=0x35f10e4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7dee7d20, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x7dee7d20, ftLastWriteTime.dwHighDateTime=0x1d59309, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.132] GetLastError () returned 0xcb
	[0065.132] SetErrorMode (uMode=0x1) returned 0x1
	[0065.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x19de4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0065.132] GetLastError () returned 0xcb
	[0065.132] SetErrorMode (uMode=0x1) returned 0x1
	[0065.132] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x35f1298 | out: lpFileInformation=0x35f1298*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7dee7d20, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x7dee7d20, ftLastWriteTime.dwHighDateTime=0x1d59309, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.132] GetLastError () returned 0xcb
	[0065.132] SetErrorMode (uMode=0x1) returned 0x1
	[0065.138] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.138] GetLastError () returned 0xcb
	[0065.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x19df94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0065.149] GetLastError () returned 0xcb
	[0065.150] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x19df10, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0065.150] GetLastError () returned 0xcb
	[0065.150] SetErrorMode (uMode=0x1) returned 0x1
	[0065.150] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x19e390 | out: lpFileInformation=0x19e390*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.150] GetLastError () returned 0xcb
	[0065.150] SetErrorMode (uMode=0x1) returned 0x1
	[0065.150] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x19df10, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0065.150] GetLastError () returned 0xcb
	[0065.150] SetErrorMode (uMode=0x1) returned 0x1
	[0065.150] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x19e390 | out: lpFileInformation=0x19e390*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.150] GetLastError () returned 0xcb
	[0065.150] SetErrorMode (uMode=0x1) returned 0x1
	[0065.150] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x19df24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0065.150] GetLastError () returned 0xcb
	[0065.150] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x19dec0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0065.150] GetLastError () returned 0xcb
	[0065.151] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x19df10, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
	[0065.151] GetLastError () returned 0xcb
	[0065.151] SetErrorMode (uMode=0x1) returned 0x1
	[0065.151] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x19e390 | out: lpFileInformation=0x19e390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0065.151] GetLastError () returned 0xcb
	[0065.151] SetErrorMode (uMode=0x1) returned 0x1
	[0065.151] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x19df10, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
	[0065.151] GetLastError () returned 0xcb
	[0065.151] SetErrorMode (uMode=0x1) returned 0x1
	[0065.151] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x19e390 | out: lpFileInformation=0x19e390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0065.151] GetLastError () returned 0xcb
	[0065.151] SetErrorMode (uMode=0x1) returned 0x1
	[0065.151] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x19df24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
	[0065.151] GetLastError () returned 0xcb
	[0065.152] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x19dec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
	[0065.152] GetLastError () returned 0xcb
	[0065.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x19df10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d
	[0065.152] GetLastError () returned 0xcb
	[0065.152] SetErrorMode (uMode=0x1) returned 0x1
	[0065.152] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x19e390 | out: lpFileInformation=0x19e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.152] GetLastError () returned 0xcb
	[0065.152] SetErrorMode (uMode=0x1) returned 0x1
	[0065.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x19df10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d
	[0065.152] GetLastError () returned 0xcb
	[0065.152] SetErrorMode (uMode=0x1) returned 0x1
	[0065.152] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x19e390 | out: lpFileInformation=0x19e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.152] GetLastError () returned 0xcb
	[0065.152] SetErrorMode (uMode=0x1) returned 0x1
	[0065.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x19df24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d
	[0065.152] GetLastError () returned 0xcb
	[0065.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\.", nBufferLength=0x105, lpBuffer=0x19dec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d
	[0065.152] GetLastError () returned 0xcb
	[0065.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x19df10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0065.153] GetLastError () returned 0xcb
	[0065.153] SetErrorMode (uMode=0x1) returned 0x1
	[0065.153] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x19e390 | out: lpFileInformation=0x19e390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7dee7d20, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x7dee7d20, ftLastWriteTime.dwHighDateTime=0x1d59309, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.153] GetLastError () returned 0xcb
	[0065.153] SetErrorMode (uMode=0x1) returned 0x1
	[0065.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x19df10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0065.153] GetLastError () returned 0xcb
	[0065.153] SetErrorMode (uMode=0x1) returned 0x1
	[0065.153] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x19e390 | out: lpFileInformation=0x19e390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7dee7d20, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x7dee7d20, ftLastWriteTime.dwHighDateTime=0x1d59309, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.153] GetLastError () returned 0xcb
	[0065.153] SetErrorMode (uMode=0x1) returned 0x1
	[0065.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x19df24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0065.153] GetLastError () returned 0xcb
	[0065.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x19dec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0065.153] GetLastError () returned 0xcb
	[0065.154] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x19df1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
	[0065.154] GetLastError () returned 0xcb
	[0065.154] SetErrorMode (uMode=0x1) returned 0x1
	[0065.154] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x19e39c | out: lpFileInformation=0x19e39c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0065.154] GetLastError () returned 0xcb
	[0065.154] SetErrorMode (uMode=0x1) returned 0x1
	[0065.154] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x19df1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
	[0065.154] GetLastError () returned 0xcb
	[0065.154] SetErrorMode (uMode=0x1) returned 0x1
	[0065.154] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x19e39c | out: lpFileInformation=0x19e39c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0065.154] GetLastError () returned 0xcb
	[0065.154] SetErrorMode (uMode=0x1) returned 0x1
	[0065.154] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x19df30, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
	[0065.154] GetLastError () returned 0xcb
	[0065.154] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x19decc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
	[0065.154] GetLastError () returned 0xcb
	[0065.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x19df1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d
	[0065.155] GetLastError () returned 0xcb
	[0065.155] SetErrorMode (uMode=0x1) returned 0x1
	[0065.155] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x19e39c | out: lpFileInformation=0x19e39c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.155] GetLastError () returned 0xcb
	[0065.155] SetErrorMode (uMode=0x1) returned 0x1
	[0065.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x19df1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d
	[0065.155] GetLastError () returned 0xcb
	[0065.155] SetErrorMode (uMode=0x1) returned 0x1
	[0065.155] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x19e39c | out: lpFileInformation=0x19e39c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.155] GetLastError () returned 0xcb
	[0065.155] SetErrorMode (uMode=0x1) returned 0x1
	[0065.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x19df30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d
	[0065.155] GetLastError () returned 0xcb
	[0065.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\.", nBufferLength=0x105, lpBuffer=0x19decc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d
	[0065.155] GetLastError () returned 0xcb
	[0065.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x19df1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0065.155] GetLastError () returned 0xcb
	[0065.156] SetErrorMode (uMode=0x1) returned 0x1
	[0065.156] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x19e39c | out: lpFileInformation=0x19e39c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7dee7d20, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x7dee7d20, ftLastWriteTime.dwHighDateTime=0x1d59309, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.156] GetLastError () returned 0xcb
	[0065.156] SetErrorMode (uMode=0x1) returned 0x1
	[0065.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x19df1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0065.156] GetLastError () returned 0xcb
	[0065.156] SetErrorMode (uMode=0x1) returned 0x1
	[0065.156] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x19e39c | out: lpFileInformation=0x19e39c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7dee7d20, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x7dee7d20, ftLastWriteTime.dwHighDateTime=0x1d59309, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.156] GetLastError () returned 0xcb
	[0065.156] SetErrorMode (uMode=0x1) returned 0x1
	[0065.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x19df30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0065.156] GetLastError () returned 0xcb
	[0065.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x19decc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0065.156] GetLastError () returned 0xcb
	[0065.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x19dfec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0065.205] GetLastError () returned 0xcb
	[0065.205] SetErrorMode (uMode=0x1) returned 0x1
	[0065.205] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2ec0198 | out: lpFileInformation=0x2ec0198*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7dee7d20, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x7dee7d20, ftLastWriteTime.dwHighDateTime=0x1d59309, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.205] GetLastError () returned 0xcb
	[0065.206] SetErrorMode (uMode=0x1) returned 0x1
	[0065.208] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e034, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.208] GetLastError () returned 0xcb
	[0065.208] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.208] GetLastError () returned 0xcb
	[0065.208] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.208] GetLastError () returned 0xcb
	[0065.208] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.208] GetLastError () returned 0xcb
	[0065.275] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x4fe858, nSize=0x19e588 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x19e588) returned 0x1
	[0065.276] GetLastError () returned 0xcb
	[0065.276] GetUserNameW (in: lpBuffer=0x4fe098, pcbBuffer=0x19e590 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x19e590) returned 1
	[0065.278] ReportEventW (hEventLog=0x4f50004, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2ee0e40*="Available", lpRawData=0x2ee0cfc) returned 1
	[0065.278] GetLastError () returned 0x0
	[0065.279] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.279] GetLastError () returned 0xcb
	[0065.280] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.280] GetLastError () returned 0xcb
	[0065.289] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e068, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.289] GetLastError () returned 0xcb
	[0065.289] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.289] GetLastError () returned 0xcb
	[0065.290] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.290] GetLastError () returned 0xcb
	[0065.295] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e00c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.295] GetLastError () returned 0xcb
	[0065.295] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.295] GetLastError () returned 0xcb
	[0065.295] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.295] GetLastError () returned 0xcb
	[0065.295] GetEnvironmentVariableW (in: lpName="HomeDrive", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="C:") returned 0x2
	[0065.295] GetLastError () returned 0xcb
	[0065.295] GetEnvironmentVariableW (in: lpName="HomePath", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1b
	[0065.295] GetLastError () returned 0xcb
	[0065.295] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e00c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.295] GetLastError () returned 0xcb
	[0065.295] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.295] GetLastError () returned 0xcb
	[0065.296] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.296] GetLastError () returned 0xcb
	[0065.296] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e00c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.296] GetLastError () returned 0xcb
	[0065.296] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.296] GetLastError () returned 0xcb
	[0065.296] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.296] GetLastError () returned 0xcb
	[0065.296] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e00c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.296] GetLastError () returned 0xcb
	[0065.296] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.296] GetLastError () returned 0xcb
	[0065.296] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.296] GetLastError () returned 0xcb
	[0065.296] GetCurrentProcessId () returned 0xae8
	[0065.296] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e00c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.296] GetLastError () returned 0xcb
	[0065.297] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.297] GetLastError () returned 0xcb
	[0065.297] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.297] GetLastError () returned 0xcb
	[0065.297] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dff8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.297] GetLastError () returned 0xcb
	[0065.297] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.297] GetLastError () returned 0xcb
	[0065.297] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.297] GetLastError () returned 0xcb
	[0065.298] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dff8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.298] GetLastError () returned 0xcb
	[0065.298] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.298] GetLastError () returned 0xcb
	[0065.298] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.298] GetLastError () returned 0xcb
	[0065.298] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e00c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.298] GetLastError () returned 0xcb
	[0065.298] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.298] GetLastError () returned 0xcb
	[0065.298] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.298] GetLastError () returned 0xcb
	[0065.299] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e51c | out: phkResult=0x19e51c*=0x350) returned 0x0
	[0065.299] RegQueryValueExW (in: hKey=0x350, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e564, lpData=0x0, lpcbData=0x19e560*=0x0 | out: lpType=0x19e564*=0x1, lpData=0x0, lpcbData=0x19e560*=0x56) returned 0x0
	[0065.299] RegQueryValueExW (in: hKey=0x350, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e564, lpData=0x4fe098, lpcbData=0x19e560*=0x56 | out: lpType=0x19e564*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x19e560*=0x56) returned 0x0
	[0065.300] RegCloseKey (hKey=0x350) returned 0x0
	[0065.300] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19e00c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.300] GetLastError () returned 0xcb
	[0065.300] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.300] GetLastError () returned 0xcb
	[0065.300] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.300] GetLastError () returned 0xcb
	[0065.301] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dff4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.301] GetLastError () returned 0xcb
	[0065.301] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.301] GetLastError () returned 0xcb
	[0065.301] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19dfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.301] GetLastError () returned 0xcb
	[0065.317] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d684, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.317] GetLastError () returned 0xcb
	[0065.317] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d634, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.317] GetLastError () returned 0xcb
	[0065.317] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d634, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.318] GetLastError () returned 0xcb
	[0065.318] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d684, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.318] GetLastError () returned 0xcb
	[0065.318] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d634, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.318] GetLastError () returned 0xcb
	[0065.318] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d634, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.318] GetLastError () returned 0xcb
	[0065.318] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d684, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.318] GetLastError () returned 0xcb
	[0065.318] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d634, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.318] GetLastError () returned 0xcb
	[0065.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d634, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.319] GetLastError () returned 0xcb
	[0065.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d684, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.319] GetLastError () returned 0xcb
	[0065.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d634, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.319] GetLastError () returned 0xcb
	[0065.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d634, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.319] GetLastError () returned 0xcb
	[0065.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d684, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.319] GetLastError () returned 0xcb
	[0065.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d634, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.319] GetLastError () returned 0xcb
	[0065.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d634, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.319] GetLastError () returned 0xcb
	[0065.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d684, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.319] GetLastError () returned 0xcb
	[0065.320] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d634, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.320] GetLastError () returned 0xcb
	[0065.320] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d634, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.320] GetLastError () returned 0xcb
	[0065.320] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d684, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.320] GetLastError () returned 0xcb
	[0065.320] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d634, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.320] GetLastError () returned 0xcb
	[0065.320] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d634, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.320] GetLastError () returned 0xcb
	[0065.320] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d680, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.320] GetLastError () returned 0xcb
	[0065.320] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.320] GetLastError () returned 0xcb
	[0065.320] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.320] GetLastError () returned 0xcb
	[0065.320] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d680, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.320] GetLastError () returned 0xcb
	[0065.320] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.320] GetLastError () returned 0xcb
	[0065.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.321] GetLastError () returned 0xcb
	[0065.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d680, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.321] GetLastError () returned 0xcb
	[0065.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.321] GetLastError () returned 0xcb
	[0065.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.321] GetLastError () returned 0xcb
	[0065.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d680, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.321] GetLastError () returned 0xcb
	[0065.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.321] GetLastError () returned 0xcb
	[0065.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.321] GetLastError () returned 0xcb
	[0065.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d680, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.321] GetLastError () returned 0xcb
	[0065.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.321] GetLastError () returned 0xcb
	[0065.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.322] GetLastError () returned 0xcb
	[0065.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d680, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.322] GetLastError () returned 0xcb
	[0065.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.322] GetLastError () returned 0xcb
	[0065.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.322] GetLastError () returned 0xcb
	[0065.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d680, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.322] GetLastError () returned 0xcb
	[0065.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.322] GetLastError () returned 0xcb
	[0065.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.322] GetLastError () returned 0xcb
	[0065.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d680, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.322] GetLastError () returned 0xcb
	[0065.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.323] GetLastError () returned 0xcb
	[0065.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.323] GetLastError () returned 0xcb
	[0065.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d680, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.323] GetLastError () returned 0xcb
	[0065.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.323] GetLastError () returned 0xcb
	[0065.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d630, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.323] GetLastError () returned 0xcb
	[0065.325] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d664, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.325] GetLastError () returned 0xcb
	[0065.325] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d614, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.325] GetLastError () returned 0xcb
	[0065.325] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d614, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.325] GetLastError () returned 0xcb
	[0065.325] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d614, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.325] GetLastError () returned 0xcb
	[0065.346] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d664, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.346] GetLastError () returned 0xcb
	[0065.346] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d614, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.346] GetLastError () returned 0xcb
	[0065.346] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d614, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.346] GetLastError () returned 0xcb
	[0065.346] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d664, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.346] GetLastError () returned 0xcb
	[0065.346] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d614, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.346] GetLastError () returned 0xcb
	[0065.346] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d614, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.346] GetLastError () returned 0xcb
	[0065.347] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0065.348] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.348] GetLastError () returned 0xcb
	[0065.356] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0065.381] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.381] GetLastError () returned 0xcb
	[0065.382] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.382] GetLastError () returned 0xcb
	[0065.385] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.385] GetLastError () returned 0xcb
	[0065.393] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.393] GetLastError () returned 0xcb
	[0065.400] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.400] GetLastError () returned 0xcb
	[0065.408] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0065.410] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0065.484] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.484] GetLastError () returned 0xcb
	[0065.530] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0065.538] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.538] GetLastError () returned 0xcb
	[0066.045] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x4f1668
	[0066.045] GetLastError () returned 0x0
	[0066.047] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x4f16f0
	[0066.047] GetLastError () returned 0x0
	[0066.205] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.275] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.278] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.278] VirtualQuery (in: lpAddress=0x19c244, lpBuffer=0x19d244, dwLength=0x1c | out: lpBuffer=0x19d244*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.316] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.316] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.316] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.316] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.316] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.317] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.317] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.317] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.317] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.317] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.317] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.317] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.317] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.317] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.317] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.317] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.318] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.318] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.318] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.318] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.318] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.318] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.318] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.318] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.318] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.318] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.318] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.318] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.318] VirtualQuery (in: lpAddress=0x19cb90, lpBuffer=0x19db90, dwLength=0x1c | out: lpBuffer=0x19db90*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.331] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.331] GetLastError () returned 0xcb
	[0066.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d98c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.331] GetLastError () returned 0xcb
	[0066.332] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d93c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.332] GetLastError () returned 0xcb
	[0066.332] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d93c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.332] GetLastError () returned 0xcb
	[0066.332] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d93c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.332] GetLastError () returned 0xcb
	[0066.364] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d98c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.364] GetLastError () returned 0xcb
	[0066.365] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d93c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.365] GetLastError () returned 0xcb
	[0066.365] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d93c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.365] GetLastError () returned 0xcb
	[0066.365] VirtualQuery (in: lpAddress=0x19ceb8, lpBuffer=0x19deb8, dwLength=0x1c | out: lpBuffer=0x19deb8*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.366] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d98c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.366] GetLastError () returned 0xcb
	[0066.366] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d93c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.366] GetLastError () returned 0xcb
	[0066.366] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x19d93c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.366] GetLastError () returned 0xcb
	[0066.366] VirtualQuery (in: lpAddress=0x19ceb0, lpBuffer=0x19deb0, dwLength=0x1c | out: lpBuffer=0x19deb0*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.367] VirtualQuery (in: lpAddress=0x19cb64, lpBuffer=0x19db64, dwLength=0x1c | out: lpBuffer=0x19db64*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.367] VirtualQuery (in: lpAddress=0x19cb64, lpBuffer=0x19db64, dwLength=0x1c | out: lpBuffer=0x19db64*(BaseAddress=0x19c000, AllocationBase=0x160000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.370] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e5ec | out: phkResult=0x19e5ec*=0x39c) returned 0x0
	[0066.370] RegQueryValueExW (in: hKey=0x39c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e634, lpData=0x0, lpcbData=0x19e630*=0x0 | out: lpType=0x19e634*=0x1, lpData=0x0, lpcbData=0x19e630*=0x56) returned 0x0
	[0066.370] RegQueryValueExW (in: hKey=0x39c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e634, lpData=0x4fe098, lpcbData=0x19e630*=0x56 | out: lpType=0x19e634*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x19e630*=0x56) returned 0x0
	[0066.370] RegCloseKey (hKey=0x39c) returned 0x0
	[0066.370] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e5ec | out: phkResult=0x19e5ec*=0x39c) returned 0x0
	[0066.370] RegQueryValueExW (in: hKey=0x39c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e634, lpData=0x0, lpcbData=0x19e630*=0x0 | out: lpType=0x19e634*=0x1, lpData=0x0, lpcbData=0x19e630*=0x56) returned 0x0
	[0066.371] RegQueryValueExW (in: hKey=0x39c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x19e634, lpData=0x4fe098, lpcbData=0x19e630*=0x56 | out: lpType=0x19e634*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x19e630*=0x56) returned 0x0
	[0066.371] RegCloseKey (hKey=0x39c) returned 0x0
	[0066.372] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x4fe098 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0
	[0066.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x19e184, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27
	[0066.373] GetLastError () returned 0x3f0
	[0066.373] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x4fe098 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0
	[0066.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x19e184, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27
	[0066.373] GetLastError () returned 0x3f0
	[0066.374] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.375] GetLastError () returned 0xcb
	[0066.380] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.380] GetLastError () returned 0xcb
	[0066.383] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.383] GetLastError () returned 0xcb
	[0066.385] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.385] GetLastError () returned 0xcb
	[0066.386] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.386] GetLastError () returned 0xcb
	[0066.387] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x39c
	[0066.387] GetLastError () returned 0x0
	[0066.387] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3a0
	[0066.387] GetLastError () returned 0x0
	[0066.387] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a4
	[0066.387] GetLastError () returned 0x0
	[0066.387] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a8
	[0066.387] GetLastError () returned 0x0
	[0066.387] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3ac
	[0066.387] GetLastError () returned 0x0
	[0066.387] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3b0
	[0066.387] GetLastError () returned 0x0
	[0066.388] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3d0
	[0066.388] GetLastError () returned 0x0
	[0066.388] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x394
	[0066.388] GetLastError () returned 0x0
	[0066.388] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b8
	[0066.388] GetLastError () returned 0x0
	[0066.388] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3bc
	[0066.388] GetLastError () returned 0x0
	[0066.388] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x320
	[0066.388] GetLastError () returned 0x0
	[0066.388] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x324
	[0066.388] GetLastError () returned 0x0
	[0066.390] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.390] GetLastError () returned 0xcb
	[0066.391] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.391] GetLastError () returned 0xcb
	[0066.407] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3
	[0066.407] GetLastError () returned 0xcb
	[0066.408] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x19e6dc | out: lpMode=0x19e6dc) returned 1
	[0066.409] GetLastError () returned 0xcb
	[0066.410] SetEvent (hEvent=0x3a8) returned 1
	[0066.410] GetLastError () returned 0xcb
	[0066.410] SetEvent (hEvent=0x39c) returned 1
	[0066.410] GetLastError () returned 0xcb
	[0066.410] SetEvent (hEvent=0x3a0) returned 1
	[0066.410] GetLastError () returned 0xcb
	[0066.410] SetEvent (hEvent=0x3a4) returned 1
	[0066.410] GetLastError () returned 0xcb
	[0066.410] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3c0
	[0066.410] GetLastError () returned 0x0
	[0066.411] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x4fe098, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.411] GetLastError () returned 0xcb
	[0066.412] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e540 | out: phkResult=0x19e540*=0x344) returned 0x0
	[0066.412] RegQueryValueExW (in: hKey=0x344, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x19e588, lpData=0x0, lpcbData=0x19e584*=0x0 | out: lpType=0x19e588*=0x0, lpData=0x0, lpcbData=0x19e584*=0x0) returned 0x2

Thread:
	id = 38
	os_tid = 0xb00


Thread:
	id = 39
	os_tid = 0xb04


Thread:
	id = 40
	os_tid = 0xb08


Thread:
	id = 41
	os_tid = 0xb0c


Thread:
	id = 42
	os_tid = 0xb14


Thread:
	id = 43
	os_tid = 0xb18

	[0055.149] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0063.644] LocalFree (hMem=0x50f7d8) returned 0x0
	[0063.644] GetLastError () returned 0x0
	[0063.644] CloseHandle (hObject=0x344) returned 1
	[0063.644] GetLastError () returned 0x0
	[0063.644] CloseHandle (hObject=0x13) returned 1
	[0063.645] GetLastError () returned 0x0
	[0063.645] CloseHandle (hObject=0xf) returned 1
	[0063.645] GetLastError () returned 0x0
	[0063.645] RegCloseKey (hKey=0x328) returned 0x0
	[0063.646] RegCloseKey (hKey=0x324) returned 0x0
	[0063.646] RegCloseKey (hKey=0x320) returned 0x0
	[0063.646] LocalFree (hMem=0x50f7f8) returned 0x0
	[0063.646] GetLastError () returned 0x0
	[0063.646] RegCloseKey (hKey=0x350) returned 0x0
	[0065.188] RegCloseKey (hKey=0x3c8) returned 0x0
	[0065.188] RegCloseKey (hKey=0x390) returned 0x0
	[0065.188] RegCloseKey (hKey=0x38c) returned 0x0
	[0065.189] RegCloseKey (hKey=0x388) returned 0x0
	[0065.189] RegCloseKey (hKey=0x384) returned 0x0
	[0065.189] RegCloseKey (hKey=0x380) returned 0x0
	[0065.189] RegCloseKey (hKey=0x37c) returned 0x0
	[0065.190] RegCloseKey (hKey=0x378) returned 0x0
	[0065.190] RegCloseKey (hKey=0x374) returned 0x0
	[0065.190] RegCloseKey (hKey=0x3c4) returned 0x0
	[0065.190] RegCloseKey (hKey=0x36c) returned 0x0
	[0065.191] RegCloseKey (hKey=0x368) returned 0x0
	[0065.191] RegCloseKey (hKey=0x364) returned 0x0
	[0065.191] RegCloseKey (hKey=0x360) returned 0x0
	[0065.191] RegCloseKey (hKey=0x35c) returned 0x0
	[0065.192] RegCloseKey (hKey=0x358) returned 0x0
	[0065.192] RegCloseKey (hKey=0x354) returned 0x0
	[0065.192] RegCloseKey (hKey=0x344) returned 0x0
	[0065.192] RegCloseKey (hKey=0x3c0) returned 0x0
	[0065.193] RegCloseKey (hKey=0x324) returned 0x0
	[0065.193] RegCloseKey (hKey=0x320) returned 0x0
	[0065.193] RegCloseKey (hKey=0x3bc) returned 0x0
	[0065.193] RegCloseKey (hKey=0x3b8) returned 0x0
	[0065.194] RegCloseKey (hKey=0x394) returned 0x0
	[0065.194] RegCloseKey (hKey=0x3d0) returned 0x0
	[0065.194] RegCloseKey (hKey=0x3b0) returned 0x0
	[0065.194] RegCloseKey (hKey=0x3ac) returned 0x0
	[0065.195] RegCloseKey (hKey=0x3a8) returned 0x0
	[0065.195] RegCloseKey (hKey=0x3a4) returned 0x0
	[0065.195] RegCloseKey (hKey=0x3a0) returned 0x0
	[0065.196] RegCloseKey (hKey=0x39c) returned 0x0
	[0065.196] RegCloseKey (hKey=0x398) returned 0x0
	[0065.196] RegCloseKey (hKey=0x328) returned 0x0
	[0065.196] RegCloseKey (hKey=0x3cc) returned 0x0
	[0065.196] RegCloseKey (hKey=0x350) returned 0x0
	[0066.550] RegCloseKey (hKey=0x344) returned 0x0
	[0068.904] CloseServiceHandle (hSCObject=0x535570) returned 1
	[0068.904] GetLastError () returned 0x0

Thread:
	id = 44
	os_tid = 0xb28

	[0066.421] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0066.455] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0066.466] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.466] GetLastError () returned 0xcb
	[0066.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1", nBufferLength=0x105, lpBuffer=0x5f4e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x32
	[0066.481] GetLastError () returned 0x0
	[0066.481] SetErrorMode (uMode=0x1) returned 0x1
	[0066.481] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway.ps1"), fInfoLevelId=0x0, lpFileInformation=0x30ae01c | out: lpFileInformation=0x30ae01c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de29640, ftCreationTime.dwHighDateTime=0x1d59309, ftLastAccessTime.dwLowDateTime=0x7de29640, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x45b9a085, ftLastWriteTime.dwHighDateTime=0x1d3ff7f, nFileSizeHigh=0x0, nFileSizeLow=0xd4b)) returned 1
	[0066.481] GetLastError () returned 0x0
	[0066.481] SetErrorMode (uMode=0x1) returned 0x1
	[0066.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1", nBufferLength=0x105, lpBuffer=0x5f4e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x32
	[0066.485] GetLastError () returned 0x0
	[0066.485] SetErrorMode (uMode=0x1) returned 0x1
	[0066.486] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway.ps1"), fInfoLevelId=0x0, lpFileInformation=0x5f4ee70 | out: lpFileInformation=0x5f4ee70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de29640, ftCreationTime.dwHighDateTime=0x1d59309, ftLastAccessTime.dwLowDateTime=0x7de29640, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x45b9a085, ftLastWriteTime.dwHighDateTime=0x1d3ff7f, nFileSizeHigh=0x0, nFileSizeLow=0xd4b)) returned 1
	[0066.486] GetLastError () returned 0x0
	[0066.486] SetErrorMode (uMode=0x1) returned 0x1
	[0066.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1", nBufferLength=0x105, lpBuffer=0x5f4e9b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x32
	[0066.488] GetLastError () returned 0x0
	[0066.488] SetErrorMode (uMode=0x1) returned 0x1
	[0066.488] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway.ps1"), fInfoLevelId=0x0, lpFileInformation=0x5f4ee38 | out: lpFileInformation=0x5f4ee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de29640, ftCreationTime.dwHighDateTime=0x1d59309, ftLastAccessTime.dwLowDateTime=0x7de29640, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x45b9a085, ftLastWriteTime.dwHighDateTime=0x1d3ff7f, nFileSizeHigh=0x0, nFileSizeLow=0xd4b)) returned 1
	[0066.489] GetLastError () returned 0x0
	[0066.489] SetErrorMode (uMode=0x1) returned 0x1
	[0066.489] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1", nBufferLength=0x105, lpBuffer=0x5f4e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x32
	[0066.489] GetLastError () returned 0x0
	[0066.489] SetErrorMode (uMode=0x1) returned 0x1
	[0066.489] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway.ps1"), fInfoLevelId=0x0, lpFileInformation=0x30afbf0 | out: lpFileInformation=0x30afbf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de29640, ftCreationTime.dwHighDateTime=0x1d59309, ftLastAccessTime.dwLowDateTime=0x7de29640, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x45b9a085, ftLastWriteTime.dwHighDateTime=0x1d3ff7f, nFileSizeHigh=0x0, nFileSizeLow=0xd4b)) returned 1
	[0066.489] GetLastError () returned 0x0
	[0066.489] SetErrorMode (uMode=0x1) returned 0x1
	[0066.490] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1", nBufferLength=0x105, lpBuffer=0x5f4e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x32
	[0066.490] GetLastError () returned 0x0
	[0066.490] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5f4edbc | out: phkResult=0x5f4edbc*=0x0) returned 0x2
	[0066.491] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5f4edbc | out: phkResult=0x5f4edbc*=0x0) returned 0x2
	[0066.491] GetEnvironmentVariableW (in: lpName="PSExecutionPolicyPreference", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="Bypass") returned 0x6
	[0066.491] GetLastError () returned 0x0
	[0066.491] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1", nBufferLength=0x105, lpBuffer=0x5f4e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x32
	[0066.491] GetLastError () returned 0x0
	[0066.491] SetErrorMode (uMode=0x1) returned 0x1
	[0066.492] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\takeaway.ps1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x368
	[0066.492] GetLastError () returned 0x0
	[0066.492] GetFileType (hFile=0x368) returned 0x1
	[0066.492] SetErrorMode (uMode=0x1) returned 0x1
	[0066.492] GetFileType (hFile=0x368) returned 0x1
	[0066.493] ReadFile (in: hFile=0x368, lpBuffer=0x30b179c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5f4ee44, lpOverlapped=0x0 | out: lpBuffer=0x30b179c*, lpNumberOfBytesRead=0x5f4ee44*=0xd4b, lpOverlapped=0x0) returned 1
	[0066.493] GetLastError () returned 0x0
	[0066.494] ReadFile (in: hFile=0x368, lpBuffer=0x30b0c87, nNumberOfBytesToRead=0x2b5, lpNumberOfBytesRead=0x5f4ee44, lpOverlapped=0x0 | out: lpBuffer=0x30b0c87*, lpNumberOfBytesRead=0x5f4ee44*=0x0, lpOverlapped=0x0) returned 1
	[0066.494] GetLastError () returned 0x0
	[0066.494] ReadFile (in: hFile=0x368, lpBuffer=0x30b179c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5f4ee44, lpOverlapped=0x0 | out: lpBuffer=0x30b179c*, lpNumberOfBytesRead=0x5f4ee44*=0x0, lpOverlapped=0x0) returned 1
	[0066.494] GetLastError () returned 0x0
	[0066.494] CloseHandle (hObject=0x368) returned 1
	[0066.495] GetLastError () returned 0x0
	[0066.496] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.496] GetLastError () returned 0xcb
	[0066.515] VirtualQuery (in: lpAddress=0x5f4de4c, lpBuffer=0x5f4ee4c, dwLength=0x1c | out: lpBuffer=0x5f4ee4c*(BaseAddress=0x5f4d000, AllocationBase=0x55c0000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.560] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.560] GetLastError () returned 0xcb
	[0066.571] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.571] GetLastError () returned 0xcb
	[0066.585] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.585] GetLastError () returned 0xcb
	[0066.616] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.616] GetLastError () returned 0xcb
	[0066.619] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.619] GetLastError () returned 0xcb
	[0066.620] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.620] GetLastError () returned 0xcb
	[0066.624] VirtualQuery (in: lpAddress=0x5f4e05c, lpBuffer=0x5f4f05c, dwLength=0x1c | out: lpBuffer=0x5f4f05c*(BaseAddress=0x5f4e000, AllocationBase=0x55c0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0066.625] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.625] GetLastError () returned 0xcb
	[0066.627] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.627] GetLastError () returned 0xcb
	[0066.627] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.627] GetLastError () returned 0xcb
	[0066.663] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.663] GetLastError () returned 0xcb
	[0066.694] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.694] GetLastError () returned 0xcb
	[0066.732] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.732] GetLastError () returned 0xcb
	[0066.734] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.734] GetLastError () returned 0xcb
	[0066.735] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.735] GetLastError () returned 0xcb
	[0066.737] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.737] GetLastError () returned 0xcb
	[0066.738] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.738] GetLastError () returned 0xcb
	[0066.739] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.739] GetLastError () returned 0xcb
	[0066.741] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.741] GetLastError () returned 0xcb
	[0066.766] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x559698, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.766] GetLastError () returned 0xcb
	[0066.972] SetConsoleTitleW (lpConsoleTitle="Running the payload winhost v.1.0.1 08.05.2018") returned 1
	[0066.977] GetLastError () returned 0xcb
	[0066.996] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf
	[0066.996] GetLastError () returned 0xcb
	[0066.996] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5f4ec54 | out: lpConsoleScreenBufferInfo=0x5f4ec54) returned 1
	[0066.997] GetLastError () returned 0xcb
	[0066.999] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xf) returned 1
	[0067.000] GetLastError () returned 0xcb
	[0067.003] CloseHandle (hObject=0xf) returned 1
	[0067.004] GetLastError () returned 0xcb
	[0067.014] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf
	[0067.015] GetLastError () returned 0xcb
	[0067.015] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5f4ec54 | out: lpConsoleScreenBufferInfo=0x5f4ec54) returned 1
	[0067.015] GetLastError () returned 0xcb
	[0067.015] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xbf) returned 1
	[0067.015] GetLastError () returned 0xcb
	[0067.016] CloseHandle (hObject=0xf) returned 1
	[0067.017] GetLastError () returned 0xcb
	[0067.035] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5596f0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0067.035] GetLastError () returned 0xcb
	[0067.112] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5596f0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0067.112] GetLastError () returned 0xcb
	[0067.165] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf
	[0067.167] GetLastError () returned 0xcb
	[0067.167] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5f4ea3c | out: lpConsoleScreenBufferInfo=0x5f4ea3c) returned 1
	[0067.167] GetLastError () returned 0xcb
	[0067.176] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13
	[0067.176] GetLastError () returned 0xcb
	[0067.176] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x5f4ea3c | out: lpConsoleScreenBufferInfo=0x5f4ea3c) returned 1
	[0067.177] GetLastError () returned 0xcb
	[0067.214] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17
	[0067.216] GetLastError () returned 0xcb
	[0067.216] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x17, lpConsoleScreenBufferInfo=0x5f4ea28 | out: lpConsoleScreenBufferInfo=0x5f4ea28) returned 1
	[0067.216] GetLastError () returned 0xcb
	[0067.218] SetConsoleCursorPosition (hConsoleOutput=0x17, dwCursorPosition=0x0) returned 1
	[0067.219] GetLastError () returned 0xcb
	[0067.220] CloseHandle (hObject=0x17) returned 1
	[0067.220] GetLastError () returned 0xcb
	[0067.275] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17
	[0067.276] GetLastError () returned 0xcb
	[0067.276] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x17, lpConsoleScreenBufferInfo=0x5f4e8ec | out: lpConsoleScreenBufferInfo=0x5f4e8ec) returned 1
	[0067.276] GetLastError () returned 0xcb
	[0067.278] FillConsoleOutputCharacterW (in: hConsoleOutput=0x17, cCharacter=0x20, nLength=0x5dc0, dwWriteCoord=0x0, lpNumberOfCharsWritten=0x5f4e92c | out: lpNumberOfCharsWritten=0x5f4e92c) returned 1
	[0067.279] GetLastError () returned 0xcb
	[0067.280] FillConsoleOutputAttribute (in: hConsoleOutput=0x17, wAttribute=0xbf, nLength=0x5dc0, dwWriteCoord=0x0, lpNumberOfAttrsWritten=0x5f4e92c | out: lpNumberOfAttrsWritten=0x5f4e92c) returned 1
	[0067.290] GetLastError () returned 0xcb
	[0067.291] CloseHandle (hObject=0x17) returned 1
	[0067.292] GetLastError () returned 0xcb
	[0067.302] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5596f0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0067.302] GetLastError () returned 0xcb
	[0067.344] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17
	[0067.344] GetLastError () returned 0xcb
	[0067.344] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x17, lpConsoleScreenBufferInfo=0x5f4ebb8 | out: lpConsoleScreenBufferInfo=0x5f4ebb8) returned 1
	[0067.345] GetLastError () returned 0xcb
	[0067.350] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b
	[0067.350] GetLastError () returned 0xcb
	[0067.350] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1b, lpConsoleScreenBufferInfo=0x5f4ebb8 | out: lpConsoleScreenBufferInfo=0x5f4ebb8) returned 1
	[0067.351] GetLastError () returned 0xcb
	[0067.358] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f
	[0067.358] GetLastError () returned 0xcb
	[0067.358] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5f4eba8 | out: lpConsoleScreenBufferInfo=0x5f4eba8) returned 1
	[0067.359] GetLastError () returned 0xcb
	[0067.363] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23
	[0067.364] GetLastError () returned 0xcb
	[0067.364] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5f4eba8 | out: lpConsoleScreenBufferInfo=0x5f4eba8) returned 1
	[0067.364] GetLastError () returned 0xcb
	[0067.369] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27
	[0067.370] GetLastError () returned 0xcb
	[0067.370] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5f4ebb0 | out: lpConsoleScreenBufferInfo=0x5f4ebb0) returned 1
	[0067.370] GetLastError () returned 0xcb
	[0067.370] SetConsoleTextAttribute (hConsoleOutput=0x27, wAttributes=0xbf) returned 1
	[0067.371] GetLastError () returned 0xcb
	[0067.371] CloseHandle (hObject=0x27) returned 1
	[0067.371] GetLastError () returned 0xcb
	[0067.377] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27
	[0067.377] GetLastError () returned 0xcb
	[0067.377] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5f4ebb0 | out: lpConsoleScreenBufferInfo=0x5f4ebb0) returned 1
	[0067.378] GetLastError () returned 0xcb
	[0067.378] SetConsoleTextAttribute (hConsoleOutput=0x27, wAttributes=0xbf) returned 1
	[0067.378] GetLastError () returned 0xcb
	[0067.378] CloseHandle (hObject=0x27) returned 1
	[0067.379] GetLastError () returned 0xcb
	[0067.379] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0067.379] GetLastError () returned 0xcb
	[0067.379] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x5f4ec18 | out: lpMode=0x5f4ec18) returned 1
	[0067.379] GetLastError () returned 0xcb
	[0067.385] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27
	[0067.385] GetLastError () returned 0xcb
	[0067.385] GetConsoleMode (in: hConsoleHandle=0x27, lpMode=0x5f4ebfc | out: lpMode=0x5f4ebfc) returned 1
	[0067.386] GetLastError () returned 0xcb
	[0067.389] WriteConsoleW (in: hConsoleOutput=0x27, lpBuffer=0x2ca92b0*, nNumberOfCharsToWrite=0xb, lpNumberOfCharsWritten=0x5f4ebfc, lpReserved=0x0 | out: lpBuffer=0x2ca92b0*, lpNumberOfCharsWritten=0x5f4ebfc*=0xb) returned 1
	[0067.390] GetLastError () returned 0xcb
	[0067.391] CloseHandle (hObject=0x27) returned 1
	[0067.392] GetLastError () returned 0xcb
	[0067.397] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27
	[0067.397] GetLastError () returned 0xcb
	[0067.397] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5f4ebac | out: lpConsoleScreenBufferInfo=0x5f4ebac) returned 1
	[0067.398] GetLastError () returned 0xcb
	[0067.398] SetConsoleTextAttribute (hConsoleOutput=0x27, wAttributes=0xbf) returned 1
	[0067.398] GetLastError () returned 0xcb
	[0067.404] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27
	[0067.404] GetLastError () returned 0xcb
	[0067.404] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5f4ebac | out: lpConsoleScreenBufferInfo=0x5f4ebac) returned 1
	[0067.404] GetLastError () returned 0xcb
	[0067.404] SetConsoleTextAttribute (hConsoleOutput=0x27, wAttributes=0xbf) returned 1
	[0067.405] GetLastError () returned 0xcb
	[0067.410] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27
	[0067.410] GetLastError () returned 0xcb
	[0067.410] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5f4ebe4 | out: lpConsoleScreenBufferInfo=0x5f4ebe4) returned 1
	[0067.411] GetLastError () returned 0xcb
	[0067.416] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b
	[0067.416] GetLastError () returned 0xcb
	[0067.416] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2b, lpConsoleScreenBufferInfo=0x5f4ebe4 | out: lpConsoleScreenBufferInfo=0x5f4ebe4) returned 1
	[0067.417] GetLastError () returned 0xcb
	[0067.422] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f
	[0067.422] GetLastError () returned 0xcb
	[0067.422] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5f4ebec | out: lpConsoleScreenBufferInfo=0x5f4ebec) returned 1
	[0067.422] GetLastError () returned 0xcb
	[0067.423] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0xbf) returned 1
	[0067.423] GetLastError () returned 0xcb
	[0067.428] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f
	[0067.429] GetLastError () returned 0xcb
	[0067.429] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5f4ebec | out: lpConsoleScreenBufferInfo=0x5f4ebec) returned 1
	[0067.430] GetLastError () returned 0xcb
	[0067.430] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0xbf) returned 1
	[0067.430] GetLastError () returned 0xcb
	[0067.436] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f
	[0067.436] GetLastError () returned 0xcb
	[0067.436] GetConsoleMode (in: hConsoleHandle=0x2f, lpMode=0x5f4ec38 | out: lpMode=0x5f4ec38) returned 1
	[0067.436] GetLastError () returned 0xcb
	[0067.437] WriteConsoleW (in: hConsoleOutput=0x2f, lpBuffer=0x2d57f7c*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5f4ec38, lpReserved=0x0 | out: lpBuffer=0x2d57f7c*, lpNumberOfCharsWritten=0x5f4ec38*=0x1) returned 1
	[0067.437] GetLastError () returned 0xcb
	[0067.442] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f
	[0067.443] GetLastError () returned 0xcb
	[0067.443] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5f4ebe8 | out: lpConsoleScreenBufferInfo=0x5f4ebe8) returned 1
	[0067.443] GetLastError () returned 0xcb
	[0067.443] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0xbf) returned 1
	[0067.443] GetLastError () returned 0xcb
	[0067.451] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f
	[0067.451] GetLastError () returned 0xcb
	[0067.451] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5f4ebe8 | out: lpConsoleScreenBufferInfo=0x5f4ebe8) returned 1
	[0067.451] GetLastError () returned 0xcb
	[0067.451] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0xbf) returned 1
	[0067.452] GetLastError () returned 0xcb
	[0067.457] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f
	[0067.479] GetLastError () returned 0xcb
	[0067.479] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5f4eba8 | out: lpConsoleScreenBufferInfo=0x5f4eba8) returned 1
	[0067.479] GetLastError () returned 0xcb
	[0067.484] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33
	[0067.486] GetLastError () returned 0xcb
	[0067.486] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x33, lpConsoleScreenBufferInfo=0x5f4eba8 | out: lpConsoleScreenBufferInfo=0x5f4eba8) returned 1
	[0067.486] GetLastError () returned 0xcb
	[0067.490] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37
	[0067.491] GetLastError () returned 0xcb
	[0067.491] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5f4ebb0 | out: lpConsoleScreenBufferInfo=0x5f4ebb0) returned 1
	[0067.492] GetLastError () returned 0xcb
	[0067.492] SetConsoleTextAttribute (hConsoleOutput=0x37, wAttributes=0xbf) returned 1
	[0067.492] GetLastError () returned 0xcb
	[0067.498] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37
	[0067.498] GetLastError () returned 0xcb
	[0067.498] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5f4ebb0 | out: lpConsoleScreenBufferInfo=0x5f4ebb0) returned 1
	[0067.498] GetLastError () returned 0xcb
	[0067.498] SetConsoleTextAttribute (hConsoleOutput=0x37, wAttributes=0xbf) returned 1
	[0067.499] GetLastError () returned 0xcb
	[0067.503] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37
	[0067.504] GetLastError () returned 0xcb
	[0067.504] GetConsoleMode (in: hConsoleHandle=0x37, lpMode=0x5f4ebfc | out: lpMode=0x5f4ebfc) returned 1
	[0067.504] GetLastError () returned 0xcb
	[0067.504] WriteConsoleW (in: hConsoleOutput=0x37, lpBuffer=0x2ca9424*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x5f4ebfc, lpReserved=0x0 | out: lpBuffer=0x2ca9424*, lpNumberOfCharsWritten=0x5f4ebfc*=0x7) returned 1
	[0067.504] GetLastError () returned 0xcb
	[0067.510] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37
	[0067.510] GetLastError () returned 0xcb
	[0067.510] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5f4ebac | out: lpConsoleScreenBufferInfo=0x5f4ebac) returned 1
	[0067.510] GetLastError () returned 0xcb
	[0067.511] SetConsoleTextAttribute (hConsoleOutput=0x37, wAttributes=0xbf) returned 1
	[0067.511] GetLastError () returned 0xcb
	[0067.517] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37
	[0067.517] GetLastError () returned 0xcb
	[0067.517] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5f4ebac | out: lpConsoleScreenBufferInfo=0x5f4ebac) returned 1
	[0067.518] GetLastError () returned 0xcb
	[0067.518] SetConsoleTextAttribute (hConsoleOutput=0x37, wAttributes=0xbf) returned 1
	[0067.518] GetLastError () returned 0xcb
	[0067.524] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37
	[0067.525] GetLastError () returned 0xcb
	[0067.525] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5f4ebe4 | out: lpConsoleScreenBufferInfo=0x5f4ebe4) returned 1
	[0067.525] GetLastError () returned 0xcb
	[0067.530] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b
	[0067.531] GetLastError () returned 0xcb
	[0067.531] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5f4ebe4 | out: lpConsoleScreenBufferInfo=0x5f4ebe4) returned 1
	[0067.531] GetLastError () returned 0xcb
	[0067.536] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f
	[0067.537] GetLastError () returned 0xcb
	[0067.537] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5f4ebec | out: lpConsoleScreenBufferInfo=0x5f4ebec) returned 1
	[0067.537] GetLastError () returned 0xcb
	[0067.537] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0xbf) returned 1
	[0067.537] GetLastError () returned 0xcb
	[0067.543] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f
	[0067.544] GetLastError () returned 0xcb
	[0067.544] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5f4ebec | out: lpConsoleScreenBufferInfo=0x5f4ebec) returned 1
	[0067.544] GetLastError () returned 0xcb
	[0067.544] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0xbf) returned 1
	[0067.545] GetLastError () returned 0xcb
	[0067.550] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f
	[0067.551] GetLastError () returned 0xcb
	[0067.551] GetConsoleMode (in: hConsoleHandle=0x3f, lpMode=0x5f4ec38 | out: lpMode=0x5f4ec38) returned 1
	[0067.551] GetLastError () returned 0xcb
	[0067.551] WriteConsoleW (in: hConsoleOutput=0x3f, lpBuffer=0x2d57f7c*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5f4ec38, lpReserved=0x0 | out: lpBuffer=0x2d57f7c*, lpNumberOfCharsWritten=0x5f4ec38*=0x1) returned 1
	[0067.551] GetLastError () returned 0xcb
	[0067.557] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f
	[0067.567] GetLastError () returned 0xcb
	[0067.579] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5f4ebe8 | out: lpConsoleScreenBufferInfo=0x5f4ebe8) returned 1
	[0067.579] GetLastError () returned 0xcb
	[0067.579] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0xbf) returned 1
	[0067.580] GetLastError () returned 0xcb
	[0067.586] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f
	[0067.595] GetLastError () returned 0xcb
	[0067.595] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5f4ebe8 | out: lpConsoleScreenBufferInfo=0x5f4ebe8) returned 1
	[0067.596] GetLastError () returned 0xcb
	[0067.596] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0xbf) returned 1
	[0067.596] GetLastError () returned 0xcb
	[0067.602] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f
	[0067.618] GetLastError () returned 0xcb
	[0067.618] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5f4eba8 | out: lpConsoleScreenBufferInfo=0x5f4eba8) returned 1
	[0067.618] GetLastError () returned 0xcb
	[0067.628] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43
	[0067.637] GetLastError () returned 0xcb
	[0067.637] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x43, lpConsoleScreenBufferInfo=0x5f4eba8 | out: lpConsoleScreenBufferInfo=0x5f4eba8) returned 1
	[0067.637] GetLastError () returned 0xcb
	[0067.649] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47
	[0067.649] GetLastError () returned 0xcb
	[0067.650] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5f4ebb0 | out: lpConsoleScreenBufferInfo=0x5f4ebb0) returned 1
	[0067.650] GetLastError () returned 0xcb
	[0067.650] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0xbf) returned 1
	[0067.650] GetLastError () returned 0xcb
	[0067.665] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47
	[0067.666] GetLastError () returned 0xcb
	[0067.666] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5f4ebb0 | out: lpConsoleScreenBufferInfo=0x5f4ebb0) returned 1
	[0067.669] GetLastError () returned 0xcb
	[0067.669] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0xbf) returned 1
	[0067.670] GetLastError () returned 0xcb
	[0067.682] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47
	[0067.696] GetLastError () returned 0xcb
	[0067.696] GetConsoleMode (in: hConsoleHandle=0x47, lpMode=0x5f4ebfc | out: lpMode=0x5f4ebfc) returned 1
	[0067.697] GetLastError () returned 0xcb
	[0067.697] WriteConsoleW (in: hConsoleOutput=0x47, lpBuffer=0x2ca9570*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0x5f4ebfc, lpReserved=0x0 | out: lpBuffer=0x2ca9570*, lpNumberOfCharsWritten=0x5f4ebfc*=0x9) returned 1
	[0067.697] GetLastError () returned 0xcb
	[0067.703] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47
	[0067.745] GetLastError () returned 0xcb
	[0067.745] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5f4ebac | out: lpConsoleScreenBufferInfo=0x5f4ebac) returned 1
	[0067.745] GetLastError () returned 0xcb
	[0067.745] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0xbf) returned 1
	[0067.746] GetLastError () returned 0xcb
	[0067.751] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47
	[0067.752] GetLastError () returned 0xcb
	[0067.752] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5f4ebac | out: lpConsoleScreenBufferInfo=0x5f4ebac) returned 1
	[0067.752] GetLastError () returned 0xcb
	[0067.752] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0xbf) returned 1
	[0067.753] GetLastError () returned 0xcb
	[0067.774] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47
	[0067.775] GetLastError () returned 0xcb
	[0067.775] GetConsoleMode (in: hConsoleHandle=0x47, lpMode=0x5f4eca0 | out: lpMode=0x5f4eca0) returned 1
	[0067.775] GetLastError () returned 0xcb
	[0067.775] WriteConsoleW (in: hConsoleOutput=0x47, lpBuffer=0x2b299d8*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5f4eca0, lpReserved=0x0 | out: lpBuffer=0x2b299d8*, lpNumberOfCharsWritten=0x5f4eca0*=0x1) returned 1
	[0067.775] GetLastError () returned 0xcb
	[0068.354] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5596f0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0068.354] GetLastError () returned 0xcb
	[0068.375] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5596f0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0068.375] GetLastError () returned 0xcb
	[0068.491] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x535570
	[0068.494] GetLastError () returned 0x0
	[0068.499] EnumServicesStatusW (in: hSCManager=0x535570, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.503] GetLastError () returned 0xea
	[0068.503] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x55e498
	[0068.504] EnumServicesStatusW (in: hSCManager=0x535570, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x55e498, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x55e498*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.506] GetLastError () returned 0xea
	[0068.511] LocalFree (hMem=0x55e498) returned 0x0
	[0068.511] GetLastError () returned 0xea
	[0068.511] CloseServiceHandle (hSCObject=0x535570) returned 1
	[0068.513] GetLastError () returned 0xea
	[0068.641] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x535570
	[0068.641] GetLastError () returned 0x0
	[0068.643] GetServiceKeyNameW (in: hSCManager=0x535570, lpDisplayName="WinDefend", lpServiceName=0x55e4a0, lpcchBuffer=0x5f4e9a4 | out: lpServiceName="", lpcchBuffer=0x5f4e9a4) returned 0
	[0068.648] GetLastError () returned 0x424
	[0068.648] GetServiceDisplayNameW (in: hSCManager=0x535570, lpServiceName="WinDefend", lpDisplayName=0x55e4a0, lpcchBuffer=0x5f4e9a4 | out: lpDisplayName="Windows Defender", lpcchBuffer=0x5f4e9a4) returned 1
	[0068.648] GetLastError () returned 0x424
	[0068.650] OpenServiceW (hSCManager=0x535570, lpServiceName="WinDefend", dwDesiredAccess=0x4) returned 0x5499f8
	[0068.651] GetLastError () returned 0x0
	[0068.651] QueryServiceStatus (in: hService=0x5499f8, lpServiceStatus=0x5f4e9cc | out: lpServiceStatus=0x5f4e9cc*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0068.651] GetLastError () returned 0x0
	[0068.651] CloseServiceHandle (hSCObject=0x5499f8) returned 1
	[0068.651] GetLastError () returned 0x0
	[0068.666] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x5f4e52c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
	[0068.666] GetLastError () returned 0x0
	[0068.666] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x5f4e4dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
	[0068.666] GetLastError () returned 0x0
	[0068.666] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x5f4e4dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
	[0068.666] GetLastError () returned 0x0
	[0068.666] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x5f4e4dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
	[0068.666] GetLastError () returned 0x0
	[0068.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5f4e4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0068.745] GetLastError () returned 0x3
	[0068.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5f4e490, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0068.745] GetLastError () returned 0x3
	[0068.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5f4e490, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0068.745] GetLastError () returned 0x3
	[0068.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5f4e490, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0068.745] GetLastError () returned 0x3
	[0068.787] OpenServiceW (hSCManager=0x535570, lpServiceName="WinDefend", dwDesiredAccess=0x20) returned 0x54ab98
	[0068.787] GetLastError () returned 0x0
	[0068.787] OpenServiceW (hSCManager=0x535570, lpServiceName="WinDefend", dwDesiredAccess=0x8) returned 0x55ed80
	[0068.788] GetLastError () returned 0x0
	[0068.789] EnumDependentServicesW (in: hService=0x55ed80, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4ea30, lpServicesReturned=0x5f4ea2c | out: lpServices=0x0, pcbBytesNeeded=0x5f4ea30, lpServicesReturned=0x5f4ea2c) returned 1
	[0068.789] GetLastError () returned 0x0
	[0068.790] CloseServiceHandle (hSCObject=0x55ed80) returned 1
	[0068.790] GetLastError () returned 0x0
	[0068.791] ControlService (in: hService=0x54ab98, dwControl=0x1, lpServiceStatus=0x5f4ea70 | out: lpServiceStatus=0x5f4ea70*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0
	[0068.791] GetLastError () returned 0x426
	[0068.796] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x426, dwLanguageId=0x0, lpBuffer=0x55e4a0, nSize=0x101, Arguments=0x0 | out: lpBuffer="The service has not been started.\r\n") returned 0x23
	[0068.799] GetLastError () returned 0x426
	[0068.839] CloseServiceHandle (hSCObject=0x54ab98) returned 1
	[0068.839] GetLastError () returned 0x426
	[0068.841] OpenServiceW (hSCManager=0x535570, lpServiceName="WinDefend", dwDesiredAccess=0x4) returned 0x55ed58
	[0068.841] GetLastError () returned 0x0
	[0068.841] QueryServiceStatus (in: hService=0x55ed58, lpServiceStatus=0x5f4e9e0 | out: lpServiceStatus=0x5f4e9e0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0068.841] GetLastError () returned 0x0
	[0068.841] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.842] GetLastError () returned 0x0
	[0068.843] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.843] GetLastError () returned 0x0
	[0068.843] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.844] GetLastError () returned 0xea
	[0068.844] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.844] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.845] GetLastError () returned 0xea
	[0068.851] LocalFree (hMem=0x563df0) returned 0x0
	[0068.851] GetLastError () returned 0xea
	[0068.851] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.851] GetLastError () returned 0xea
	[0068.852] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.852] GetLastError () returned 0x0
	[0068.852] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.852] GetLastError () returned 0xea
	[0068.852] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.853] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.854] GetLastError () returned 0xea
	[0068.854] LocalFree (hMem=0x563df0) returned 0x0
	[0068.854] GetLastError () returned 0xea
	[0068.854] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.854] GetLastError () returned 0xea
	[0068.855] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.855] GetLastError () returned 0x0
	[0068.855] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.855] GetLastError () returned 0xea
	[0068.855] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.855] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.856] GetLastError () returned 0xea
	[0068.857] LocalFree (hMem=0x563df0) returned 0x0
	[0068.857] GetLastError () returned 0xea
	[0068.857] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.857] GetLastError () returned 0xea
	[0068.857] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.858] GetLastError () returned 0x0
	[0068.858] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.858] GetLastError () returned 0xea
	[0068.858] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.858] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.859] GetLastError () returned 0xea
	[0068.859] LocalFree (hMem=0x563df0) returned 0x0
	[0068.859] GetLastError () returned 0xea
	[0068.859] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.859] GetLastError () returned 0xea
	[0068.860] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.860] GetLastError () returned 0x0
	[0068.860] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.861] GetLastError () returned 0xea
	[0068.861] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.861] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.862] GetLastError () returned 0xea
	[0068.862] LocalFree (hMem=0x563df0) returned 0x0
	[0068.862] GetLastError () returned 0xea
	[0068.862] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.862] GetLastError () returned 0xea
	[0068.863] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.863] GetLastError () returned 0x0
	[0068.863] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.863] GetLastError () returned 0xea
	[0068.863] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.863] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.865] GetLastError () returned 0xea
	[0068.865] LocalFree (hMem=0x563df0) returned 0x0
	[0068.865] GetLastError () returned 0xea
	[0068.865] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.865] GetLastError () returned 0xea
	[0068.866] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.866] GetLastError () returned 0x0
	[0068.866] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.867] GetLastError () returned 0xea
	[0068.867] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.867] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.868] GetLastError () returned 0xea
	[0068.868] LocalFree (hMem=0x563df0) returned 0x0
	[0068.868] GetLastError () returned 0xea
	[0068.868] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.868] GetLastError () returned 0xea
	[0068.868] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.869] GetLastError () returned 0x0
	[0068.869] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.869] GetLastError () returned 0xea
	[0068.869] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.869] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.870] GetLastError () returned 0xea
	[0068.871] LocalFree (hMem=0x563df0) returned 0x0
	[0068.871] GetLastError () returned 0xea
	[0068.871] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.871] GetLastError () returned 0xea
	[0068.871] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.872] GetLastError () returned 0x0
	[0068.872] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.872] GetLastError () returned 0xea
	[0068.872] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.872] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.873] GetLastError () returned 0xea
	[0068.874] LocalFree (hMem=0x563df0) returned 0x0
	[0068.874] GetLastError () returned 0xea
	[0068.874] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.874] GetLastError () returned 0xea
	[0068.874] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.875] GetLastError () returned 0x0
	[0068.875] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.875] GetLastError () returned 0xea
	[0068.875] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.875] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.876] GetLastError () returned 0xea
	[0068.876] LocalFree (hMem=0x563df0) returned 0x0
	[0068.876] GetLastError () returned 0xea
	[0068.876] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.876] GetLastError () returned 0xea
	[0068.877] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.877] GetLastError () returned 0x0
	[0068.877] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.878] GetLastError () returned 0xea
	[0068.878] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.878] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.879] GetLastError () returned 0xea
	[0068.879] LocalFree (hMem=0x563df0) returned 0x0
	[0068.879] GetLastError () returned 0xea
	[0068.879] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.879] GetLastError () returned 0xea
	[0068.880] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.880] GetLastError () returned 0x0
	[0068.880] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.880] GetLastError () returned 0xea
	[0068.880] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.880] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.881] GetLastError () returned 0xea
	[0068.882] LocalFree (hMem=0x563df0) returned 0x0
	[0068.882] GetLastError () returned 0xea
	[0068.882] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.882] GetLastError () returned 0xea
	[0068.882] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.883] GetLastError () returned 0x0
	[0068.883] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.883] GetLastError () returned 0xea
	[0068.883] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.883] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.884] GetLastError () returned 0xea
	[0068.904] LocalFree (hMem=0x563df0) returned 0x0
	[0068.904] GetLastError () returned 0xea
	[0068.904] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.909] GetLastError () returned 0xea
	[0068.909] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.910] GetLastError () returned 0x0
	[0068.910] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.911] GetLastError () returned 0xea
	[0068.911] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.911] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.912] GetLastError () returned 0xea
	[0068.912] LocalFree (hMem=0x563df0) returned 0x0
	[0068.912] GetLastError () returned 0xea
	[0068.912] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.913] GetLastError () returned 0xea
	[0068.913] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.914] GetLastError () returned 0x0
	[0068.914] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.914] GetLastError () returned 0xea
	[0068.914] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.914] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.915] GetLastError () returned 0xea
	[0068.915] LocalFree (hMem=0x563df0) returned 0x0
	[0068.915] GetLastError () returned 0xea
	[0068.915] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.916] GetLastError () returned 0xea
	[0068.916] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.917] GetLastError () returned 0x0
	[0068.917] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.917] GetLastError () returned 0xea
	[0068.917] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.917] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.918] GetLastError () returned 0xea
	[0068.918] LocalFree (hMem=0x563df0) returned 0x0
	[0068.918] GetLastError () returned 0xea
	[0068.918] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.919] GetLastError () returned 0xea
	[0068.919] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.920] GetLastError () returned 0x0
	[0068.920] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.920] GetLastError () returned 0xea
	[0068.920] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.920] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.921] GetLastError () returned 0xea
	[0068.921] LocalFree (hMem=0x563df0) returned 0x0
	[0068.921] GetLastError () returned 0xea
	[0068.921] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.921] GetLastError () returned 0xea
	[0068.922] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.922] GetLastError () returned 0x0
	[0068.922] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.923] GetLastError () returned 0xea
	[0068.923] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.923] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.924] GetLastError () returned 0xea
	[0068.924] LocalFree (hMem=0x563df0) returned 0x0
	[0068.924] GetLastError () returned 0xea
	[0068.924] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.924] GetLastError () returned 0xea
	[0068.925] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.925] GetLastError () returned 0x0
	[0068.925] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.926] GetLastError () returned 0xea
	[0068.926] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.926] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.927] GetLastError () returned 0xea
	[0068.927] LocalFree (hMem=0x563df0) returned 0x0
	[0068.927] GetLastError () returned 0xea
	[0068.927] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.927] GetLastError () returned 0xea
	[0068.928] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.928] GetLastError () returned 0x0
	[0068.928] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.929] GetLastError () returned 0xea
	[0068.929] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.929] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.930] GetLastError () returned 0xea
	[0068.930] LocalFree (hMem=0x563df0) returned 0x0
	[0068.930] GetLastError () returned 0xea
	[0068.930] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.930] GetLastError () returned 0xea
	[0068.931] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.931] GetLastError () returned 0x0
	[0068.931] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.931] GetLastError () returned 0xea
	[0068.932] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.932] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.933] GetLastError () returned 0xea
	[0068.933] LocalFree (hMem=0x563df0) returned 0x0
	[0068.933] GetLastError () returned 0xea
	[0068.933] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.933] GetLastError () returned 0xea
	[0068.934] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.934] GetLastError () returned 0x0
	[0068.934] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.934] GetLastError () returned 0xea
	[0068.934] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.934] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.936] GetLastError () returned 0xea
	[0068.936] LocalFree (hMem=0x563df0) returned 0x0
	[0068.936] GetLastError () returned 0xea
	[0068.936] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.936] GetLastError () returned 0xea
	[0068.937] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.937] GetLastError () returned 0x0
	[0068.937] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.937] GetLastError () returned 0xea
	[0068.937] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.937] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.938] GetLastError () returned 0xea
	[0068.939] LocalFree (hMem=0x563df0) returned 0x0
	[0068.939] GetLastError () returned 0xea
	[0068.939] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.939] GetLastError () returned 0xea
	[0068.939] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.940] GetLastError () returned 0x0
	[0068.940] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.940] GetLastError () returned 0xea
	[0068.940] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.940] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.941] GetLastError () returned 0xea
	[0068.941] LocalFree (hMem=0x563df0) returned 0x0
	[0068.941] GetLastError () returned 0xea
	[0068.941] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.942] GetLastError () returned 0xea
	[0068.942] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.943] GetLastError () returned 0x0
	[0068.943] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.943] GetLastError () returned 0xea
	[0068.943] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.943] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.944] GetLastError () returned 0xea
	[0068.944] LocalFree (hMem=0x563df0) returned 0x0
	[0068.944] GetLastError () returned 0xea
	[0068.944] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.944] GetLastError () returned 0xea
	[0068.945] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.945] GetLastError () returned 0x0
	[0068.945] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.946] GetLastError () returned 0xea
	[0068.946] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.946] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.947] GetLastError () returned 0xea
	[0068.947] LocalFree (hMem=0x563df0) returned 0x0
	[0068.947] GetLastError () returned 0xea
	[0068.947] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.947] GetLastError () returned 0xea
	[0068.948] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.948] GetLastError () returned 0x0
	[0068.948] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.949] GetLastError () returned 0xea
	[0068.949] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.949] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.950] GetLastError () returned 0xea
	[0068.950] LocalFree (hMem=0x563df0) returned 0x0
	[0068.950] GetLastError () returned 0xea
	[0068.950] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.950] GetLastError () returned 0xea
	[0068.951] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.951] GetLastError () returned 0x0
	[0068.951] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.951] GetLastError () returned 0xea
	[0068.951] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.951] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.952] GetLastError () returned 0xea
	[0068.953] LocalFree (hMem=0x563df0) returned 0x0
	[0068.953] GetLastError () returned 0xea
	[0068.953] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.953] GetLastError () returned 0xea
	[0068.953] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.954] GetLastError () returned 0x0
	[0068.954] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.954] GetLastError () returned 0xea
	[0068.954] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.954] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.955] GetLastError () returned 0xea
	[0068.955] LocalFree (hMem=0x563df0) returned 0x0
	[0068.955] GetLastError () returned 0xea
	[0068.956] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.956] GetLastError () returned 0xea
	[0068.956] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.957] GetLastError () returned 0x0
	[0068.957] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.957] GetLastError () returned 0xea
	[0068.957] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.957] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.958] GetLastError () returned 0xea
	[0068.958] LocalFree (hMem=0x563df0) returned 0x0
	[0068.959] GetLastError () returned 0xea
	[0068.959] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.959] GetLastError () returned 0xea
	[0068.959] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ed58
	[0068.960] GetLastError () returned 0x0
	[0068.960] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x0, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 0
	[0068.960] GetLastError () returned 0xea
	[0068.960] LocalAlloc (uFlags=0x0, uBytes=0x4374) returned 0x563df0
	[0068.960] EnumServicesStatusW (in: hSCManager=0x55ed58, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x563df0, cbBufSize=0x4374, pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60 | out: lpServices=0x563df0*(lpServiceName="AdobeFlashPlayerUpdateSvc", lpDisplayName="Adobe Flash Player Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x5f4eb68, lpServicesReturned=0x5f4eb64, lpResumeHandle=0x5f4eb60) returned 1
	[0068.961] GetLastError () returned 0xea
	[0068.961] LocalFree (hMem=0x563df0) returned 0x0
	[0068.961] GetLastError () returned 0xea
	[0068.961] CloseServiceHandle (hSCObject=0x55ed58) returned 1
	[0068.962] GetLastError () returned 0xea
	[0068.962] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5f4ebb8 | out: lpConsoleScreenBufferInfo=0x5f4ebb8) returned 1
	[0068.963] GetLastError () returned 0xea
	[0068.968] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13
	[0068.968] GetLastError () returned 0xea
	[0068.968] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x5f4ebb8 | out: lpConsoleScreenBufferInfo=0x5f4ebb8) returned 1
	[0068.969] GetLastError () returned 0xea
	[0068.974] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17
	[0068.975] GetLastError () returned 0xea
	[0068.975] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x17, lpConsoleScreenBufferInfo=0x5f4eba8 | out: lpConsoleScreenBufferInfo=0x5f4eba8) returned 1
	[0068.975] GetLastError () returned 0xea
	[0068.980] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b
	[0068.981] GetLastError () returned 0xea
	[0068.981] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1b, lpConsoleScreenBufferInfo=0x5f4eba8 | out: lpConsoleScreenBufferInfo=0x5f4eba8) returned 1
	[0068.981] GetLastError () returned 0xea
	[0068.986] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f
	[0068.986] GetLastError () returned 0xea
	[0068.987] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5f4ebb0 | out: lpConsoleScreenBufferInfo=0x5f4ebb0) returned 1
	[0068.987] GetLastError () returned 0xea
	[0068.987] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0xbf) returned 1
	[0068.987] GetLastError () returned 0xea
	[0068.988] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5f4ebb0 | out: lpConsoleScreenBufferInfo=0x5f4ebb0) returned 1
	[0068.988] GetLastError () returned 0xea
	[0068.988] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0xbf) returned 1
	[0068.989] GetLastError () returned 0xea
	[0068.989] WriteConsoleW (in: hConsoleOutput=0x1f, lpBuffer=0x2ca68ac*, nNumberOfCharsToWrite=0xa, lpNumberOfCharsWritten=0x5f4ebfc, lpReserved=0x0 | out: lpBuffer=0x2ca68ac*, lpNumberOfCharsWritten=0x5f4ebfc*=0xa) returned 1
	[0068.990] GetLastError () returned 0xea
	[0068.991] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5f4ebac | out: lpConsoleScreenBufferInfo=0x5f4ebac) returned 1
	[0068.991] GetLastError () returned 0xea
	[0068.991] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0xbf) returned 1
	[0068.991] GetLastError () returned 0xea
	[0068.992] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5f4ebac | out: lpConsoleScreenBufferInfo=0x5f4ebac) returned 1
	[0068.992] GetLastError () returned 0xea
	[0068.992] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0xbf) returned 1
	[0068.992] GetLastError () returned 0xea
	[0068.993] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5f4ebe4 | out: lpConsoleScreenBufferInfo=0x5f4ebe4) returned 1
	[0068.993] GetLastError () returned 0xea
	[0068.998] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23
	[0068.999] GetLastError () returned 0xea
	[0068.999] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5f4ebe4 | out: lpConsoleScreenBufferInfo=0x5f4ebe4) returned 1
	[0068.999] GetLastError () returned 0xea
	[0069.004] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27
	[0069.005] GetLastError () returned 0xea
	[0069.005] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5f4ebec | out: lpConsoleScreenBufferInfo=0x5f4ebec) returned 1
	[0069.006] GetLastError () returned 0xea
	[0069.006] SetConsoleTextAttribute (hConsoleOutput=0x27, wAttributes=0xbf) returned 1
	[0069.006] GetLastError () returned 0xea
	[0069.006] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5f4ebec | out: lpConsoleScreenBufferInfo=0x5f4ebec) returned 1
	[0069.007] GetLastError () returned 0xea
	[0069.007] SetConsoleTextAttribute (hConsoleOutput=0x27, wAttributes=0xbf) returned 1
	[0069.007] GetLastError () returned 0xea
	[0069.008] WriteConsoleW (in: hConsoleOutput=0x27, lpBuffer=0x2ce6ef4*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5f4ec38, lpReserved=0x0 | out: lpBuffer=0x2ce6ef4*, lpNumberOfCharsWritten=0x5f4ec38*=0x1) returned 1
	[0069.008] GetLastError () returned 0xea
	[0069.009] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5f4ebe8 | out: lpConsoleScreenBufferInfo=0x5f4ebe8) returned 1
	[0069.009] GetLastError () returned 0xea
	[0069.009] SetConsoleTextAttribute (hConsoleOutput=0x27, wAttributes=0xbf) returned 1
	[0069.009] GetLastError () returned 0xea
	[0069.010] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5f4ebe8 | out: lpConsoleScreenBufferInfo=0x5f4ebe8) returned 1
	[0069.010] GetLastError () returned 0xea
	[0069.010] SetConsoleTextAttribute (hConsoleOutput=0x27, wAttributes=0xbf) returned 1
	[0069.010] GetLastError () returned 0xea
	[0069.011] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5f4eba8 | out: lpConsoleScreenBufferInfo=0x5f4eba8) returned 1
	[0069.011] GetLastError () returned 0xea
	[0069.017] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b
	[0069.017] GetLastError () returned 0xea
	[0069.017] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2b, lpConsoleScreenBufferInfo=0x5f4eba8 | out: lpConsoleScreenBufferInfo=0x5f4eba8) returned 1
	[0069.017] GetLastError () returned 0xea
	[0069.022] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f
	[0069.023] GetLastError () returned 0xea
	[0069.023] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5f4ebb0 | out: lpConsoleScreenBufferInfo=0x5f4ebb0) returned 1
	[0069.023] GetLastError () returned 0xea
	[0069.023] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0xbf) returned 1
	[0069.024] GetLastError () returned 0xea
	[0069.024] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5f4ebb0 | out: lpConsoleScreenBufferInfo=0x5f4ebb0) returned 1
	[0069.025] GetLastError () returned 0xea
	[0069.025] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0xbf) returned 1
	[0069.025] GetLastError () returned 0xea
	[0069.026] WriteConsoleW (in: hConsoleOutput=0x2f, lpBuffer=0x2ca692c*, nNumberOfCharsToWrite=0x8, lpNumberOfCharsWritten=0x5f4ebfc, lpReserved=0x0 | out: lpBuffer=0x2ca692c*, lpNumberOfCharsWritten=0x5f4ebfc*=0x8) returned 1
	[0069.026] GetLastError () returned 0xea
	[0069.027] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5f4ebac | out: lpConsoleScreenBufferInfo=0x5f4ebac) returned 1
	[0069.027] GetLastError () returned 0xea
	[0069.027] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0xbf) returned 1
	[0069.027] GetLastError () returned 0xea
	[0069.028] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5f4ebac | out: lpConsoleScreenBufferInfo=0x5f4ebac) returned 1
	[0069.028] GetLastError () returned 0xea
	[0069.028] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0xbf) returned 1
	[0069.028] GetLastError () returned 0xea
	[0069.029] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5f4ebe4 | out: lpConsoleScreenBufferInfo=0x5f4ebe4) returned 1
	[0069.029] GetLastError () returned 0xea
	[0069.034] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33
	[0069.035] GetLastError () returned 0xea
	[0069.035] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x33, lpConsoleScreenBufferInfo=0x5f4ebe4 | out: lpConsoleScreenBufferInfo=0x5f4ebe4) returned 1
	[0069.036] GetLastError () returned 0xea
	[0069.041] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37
	[0069.042] GetLastError () returned 0xea
	[0069.042] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5f4ebec | out: lpConsoleScreenBufferInfo=0x5f4ebec) returned 1
	[0069.042] GetLastError () returned 0xea
	[0069.042] SetConsoleTextAttribute (hConsoleOutput=0x37, wAttributes=0xbf) returned 1
	[0069.042] GetLastError () returned 0xea
	[0069.043] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5f4ebec | out: lpConsoleScreenBufferInfo=0x5f4ebec) returned 1
	[0069.043] GetLastError () returned 0xea
	[0069.043] SetConsoleTextAttribute (hConsoleOutput=0x37, wAttributes=0xbf) returned 1
	[0069.044] GetLastError () returned 0xea
	[0069.044] WriteConsoleW (in: hConsoleOutput=0x37, lpBuffer=0x2ce6ef4*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5f4ec38, lpReserved=0x0 | out: lpBuffer=0x2ce6ef4*, lpNumberOfCharsWritten=0x5f4ec38*=0x1) returned 1
	[0069.045] GetLastError () returned 0xea
	[0069.045] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5f4ebe8 | out: lpConsoleScreenBufferInfo=0x5f4ebe8) returned 1
	[0069.045] GetLastError () returned 0xea
	[0069.045] SetConsoleTextAttribute (hConsoleOutput=0x37, wAttributes=0xbf) returned 1
	[0069.046] GetLastError () returned 0xea
	[0069.046] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5f4ebe8 | out: lpConsoleScreenBufferInfo=0x5f4ebe8) returned 1
	[0069.047] GetLastError () returned 0xea
	[0069.047] SetConsoleTextAttribute (hConsoleOutput=0x37, wAttributes=0xbf) returned 1
	[0069.047] GetLastError () returned 0xea
	[0069.047] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5f4eba8 | out: lpConsoleScreenBufferInfo=0x5f4eba8) returned 1
	[0069.048] GetLastError () returned 0xea
	[0069.053] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b
	[0069.054] GetLastError () returned 0xea
	[0069.054] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5f4eba8 | out: lpConsoleScreenBufferInfo=0x5f4eba8) returned 1
	[0069.054] GetLastError () returned 0xea
	[0069.059] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f
	[0069.060] GetLastError () returned 0xea
	[0069.060] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5f4ebb0 | out: lpConsoleScreenBufferInfo=0x5f4ebb0) returned 1
	[0069.060] GetLastError () returned 0xea
	[0069.060] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0xbf) returned 1
	[0069.060] GetLastError () returned 0xea
	[0069.061] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5f4ebb0 | out: lpConsoleScreenBufferInfo=0x5f4ebb0) returned 1
	[0069.061] GetLastError () returned 0xea
	[0069.061] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0xbf) returned 1
	[0069.061] GetLastError () returned 0xea
	[0069.062] WriteConsoleW (in: hConsoleOutput=0x3f, lpBuffer=0x2ca699c*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0x5f4ebfc, lpReserved=0x0 | out: lpBuffer=0x2ca699c*, lpNumberOfCharsWritten=0x5f4ebfc*=0x9) returned 1
	[0069.063] GetLastError () returned 0xea
	[0069.063] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5f4ebac | out: lpConsoleScreenBufferInfo=0x5f4ebac) returned 1
	[0069.064] GetLastError () returned 0xea
	[0069.064] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0xbf) returned 1
	[0069.064] GetLastError () returned 0xea
	[0069.064] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5f4ebac | out: lpConsoleScreenBufferInfo=0x5f4ebac) returned 1
	[0069.065] GetLastError () returned 0xea
	[0069.065] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0xbf) returned 1
	[0069.065] GetLastError () returned 0xea
	[0069.066] WriteConsoleW (in: hConsoleOutput=0x3f, lpBuffer=0x2b299d8*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5f4eca0, lpReserved=0x0 | out: lpBuffer=0x2b299d8*, lpNumberOfCharsWritten=0x5f4eca0*=0x1) returned 1
	[0069.066] GetLastError () returned 0xea
	[0069.131] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5f4ec54 | out: lpConsoleScreenBufferInfo=0x5f4ec54) returned 1
	[0069.132] GetLastError () returned 0xea
	[0069.132] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0xdf) returned 1
	[0069.132] GetLastError () returned 0xea
	[0069.132] CloseHandle (hObject=0x3f) returned 1
	[0069.132] GetLastError () returned 0xea
	[0069.157] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f
	[0069.158] GetLastError () returned 0xea
	[0069.158] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5f4e824 | out: lpConsoleScreenBufferInfo=0x5f4e824) returned 1
	[0069.158] GetLastError () returned 0xea
	[0069.163] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43
	[0069.164] GetLastError () returned 0xea
	[0069.164] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x43, lpConsoleScreenBufferInfo=0x5f4e824 | out: lpConsoleScreenBufferInfo=0x5f4e824) returned 1
	[0069.164] GetLastError () returned 0xea
	[0069.174] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5f4e810 | out: lpConsoleScreenBufferInfo=0x5f4e810) returned 1
	[0069.174] GetLastError () returned 0xea
	[0069.174] SetConsoleCursorPosition (hConsoleOutput=0x47, dwCursorPosition=0x0) returned 1
	[0069.174] GetLastError () returned 0xea
	[0069.175] CloseHandle (hObject=0x47) returned 1
	[0069.175] GetLastError () returned 0xea
	[0069.180] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47
	[0069.181] GetLastError () returned 0xea
	[0069.181] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5f4e780 | out: lpConsoleScreenBufferInfo=0x5f4e780) returned 1
	[0069.181] GetLastError () returned 0xea
	[0069.181] FillConsoleOutputCharacterW (in: hConsoleOutput=0x47, cCharacter=0x20, nLength=0x5dc0, dwWriteCoord=0x0, lpNumberOfCharsWritten=0x5f4e7c0 | out: lpNumberOfCharsWritten=0x5f4e7c0) returned 1
	[0069.182] GetLastError () returned 0xea
	[0069.182] FillConsoleOutputAttribute (in: hConsoleOutput=0x47, wAttribute=0xdf, nLength=0x5dc0, dwWriteCoord=0x0, lpNumberOfAttrsWritten=0x5f4e7c0 | out: lpNumberOfAttrsWritten=0x5f4e7c0) returned 1
	[0069.187] GetLastError () returned 0xea
	[0069.187] CloseHandle (hObject=0x47) returned 1
	[0069.187] GetLastError () returned 0xea
	[0069.190] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5596f0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0069.190] GetLastError () returned 0xcb
	[0069.207] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5596f0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0069.207] GetLastError () returned 0xcb
	[0069.223] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5f4e8cc | out: lpConsoleScreenBufferInfo=0x5f4e8cc) returned 1
	[0069.224] GetLastError () returned 0xcb
	[0069.229] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b
	[0069.230] GetLastError () returned 0xcb
	[0069.230] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4b, lpConsoleScreenBufferInfo=0x5f4e8cc | out: lpConsoleScreenBufferInfo=0x5f4e8cc) returned 1
	[0069.230] GetLastError () returned 0xcb
	[0069.235] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f
	[0069.235] GetLastError () returned 0xcb
	[0069.235] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4f, lpConsoleScreenBufferInfo=0x5f4e8bc | out: lpConsoleScreenBufferInfo=0x5f4e8bc) returned 1
	[0069.236] GetLastError () returned 0xcb
	[0069.241] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53
	[0069.241] GetLastError () returned 0xcb
	[0069.241] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x53, lpConsoleScreenBufferInfo=0x5f4e8bc | out: lpConsoleScreenBufferInfo=0x5f4e8bc) returned 1
	[0069.241] GetLastError () returned 0xcb
	[0069.246] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57
	[0069.246] GetLastError () returned 0xcb
	[0069.246] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x57, lpConsoleScreenBufferInfo=0x5f4e8c4 | out: lpConsoleScreenBufferInfo=0x5f4e8c4) returned 1
	[0069.246] GetLastError () returned 0xcb
	[0069.246] SetConsoleTextAttribute (hConsoleOutput=0x57, wAttributes=0xdf) returned 1
	[0069.247] GetLastError () returned 0xcb
	[0069.247] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x57, lpConsoleScreenBufferInfo=0x5f4e8c4 | out: lpConsoleScreenBufferInfo=0x5f4e8c4) returned 1
	[0069.247] GetLastError () returned 0xcb
	[0069.247] SetConsoleTextAttribute (hConsoleOutput=0x57, wAttributes=0xdf) returned 1
	[0069.248] GetLastError () returned 0xcb
	[0069.248] WriteConsoleW (in: hConsoleOutput=0x57, lpBuffer=0x2ca81e8*, nNumberOfCharsToWrite=0x8, lpNumberOfCharsWritten=0x5f4e910, lpReserved=0x0 | out: lpBuffer=0x2ca81e8*, lpNumberOfCharsWritten=0x5f4e910*=0x8) returned 1
	[0069.249] GetLastError () returned 0xcb
	[0069.249] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x57, lpConsoleScreenBufferInfo=0x5f4e8c0 | out: lpConsoleScreenBufferInfo=0x5f4e8c0) returned 1
	[0069.250] GetLastError () returned 0xcb
	[0069.250] SetConsoleTextAttribute (hConsoleOutput=0x57, wAttributes=0xdf) returned 1
	[0069.250] GetLastError () returned 0xcb
	[0069.251] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x57, lpConsoleScreenBufferInfo=0x5f4e8c0 | out: lpConsoleScreenBufferInfo=0x5f4e8c0) returned 1
	[0069.251] GetLastError () returned 0xcb
	[0069.251] SetConsoleTextAttribute (hConsoleOutput=0x57, wAttributes=0xdf) returned 1
	[0069.251] GetLastError () returned 0xcb
	[0069.252] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x57, lpConsoleScreenBufferInfo=0x5f4e8f8 | out: lpConsoleScreenBufferInfo=0x5f4e8f8) returned 1
	[0069.252] GetLastError () returned 0xcb
	[0069.257] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b
	[0069.258] GetLastError () returned 0xcb
	[0069.258] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5b, lpConsoleScreenBufferInfo=0x5f4e8f8 | out: lpConsoleScreenBufferInfo=0x5f4e8f8) returned 1
	[0069.258] GetLastError () returned 0xcb
	[0069.263] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f
	[0069.263] GetLastError () returned 0xcb
	[0069.263] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5f4e900 | out: lpConsoleScreenBufferInfo=0x5f4e900) returned 1
	[0069.264] GetLastError () returned 0xcb
	[0069.264] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0xdf) returned 1
	[0069.264] GetLastError () returned 0xcb
	[0069.264] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5f4e900 | out: lpConsoleScreenBufferInfo=0x5f4e900) returned 1
	[0069.265] GetLastError () returned 0xcb
	[0069.265] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0xdf) returned 1
	[0069.265] GetLastError () returned 0xcb
	[0069.266] WriteConsoleW (in: hConsoleOutput=0x5f, lpBuffer=0x2ce6ef4*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5f4e94c, lpReserved=0x0 | out: lpBuffer=0x2ce6ef4*, lpNumberOfCharsWritten=0x5f4e94c*=0x1) returned 1
	[0069.266] GetLastError () returned 0xcb
	[0069.267] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5f4e8fc | out: lpConsoleScreenBufferInfo=0x5f4e8fc) returned 1
	[0069.267] GetLastError () returned 0xcb
	[0069.267] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0xdf) returned 1
	[0069.267] GetLastError () returned 0xcb
	[0069.268] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5f4e8fc | out: lpConsoleScreenBufferInfo=0x5f4e8fc) returned 1
	[0069.268] GetLastError () returned 0xcb
	[0069.268] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0xdf) returned 1
	[0069.268] GetLastError () returned 0xcb
	[0069.269] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5f4e8bc | out: lpConsoleScreenBufferInfo=0x5f4e8bc) returned 1
	[0069.269] GetLastError () returned 0xcb
	[0069.275] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x63
	[0069.275] GetLastError () returned 0xcb
	[0069.275] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63, lpConsoleScreenBufferInfo=0x5f4e8bc | out: lpConsoleScreenBufferInfo=0x5f4e8bc) returned 1
	[0069.275] GetLastError () returned 0xcb
	[0069.280] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67
	[0069.281] GetLastError () returned 0xcb
	[0069.281] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x67, lpConsoleScreenBufferInfo=0x5f4e8c4 | out: lpConsoleScreenBufferInfo=0x5f4e8c4) returned 1
	[0069.281] GetLastError () returned 0xcb
	[0069.281] SetConsoleTextAttribute (hConsoleOutput=0x67, wAttributes=0xdf) returned 1
	[0069.281] GetLastError () returned 0xcb
	[0069.282] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x67, lpConsoleScreenBufferInfo=0x5f4e8c4 | out: lpConsoleScreenBufferInfo=0x5f4e8c4) returned 1
	[0069.282] GetLastError () returned 0xcb
	[0069.282] SetConsoleTextAttribute (hConsoleOutput=0x67, wAttributes=0xdf) returned 1
	[0069.283] GetLastError () returned 0xcb
	[0069.284] WriteConsoleW (in: hConsoleOutput=0x67, lpBuffer=0x2ca8258*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x5f4e910, lpReserved=0x0 | out: lpBuffer=0x2ca8258*, lpNumberOfCharsWritten=0x5f4e910*=0x3) returned 1
	[0069.284] GetLastError () returned 0xcb
	[0069.285] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x67, lpConsoleScreenBufferInfo=0x5f4e8c0 | out: lpConsoleScreenBufferInfo=0x5f4e8c0) returned 1
	[0069.285] GetLastError () returned 0xcb
	[0069.285] SetConsoleTextAttribute (hConsoleOutput=0x67, wAttributes=0xdf) returned 1
	[0069.285] GetLastError () returned 0xcb
	[0069.286] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x67, lpConsoleScreenBufferInfo=0x5f4e8c0 | out: lpConsoleScreenBufferInfo=0x5f4e8c0) returned 1
	[0069.286] GetLastError () returned 0xcb
	[0069.286] SetConsoleTextAttribute (hConsoleOutput=0x67, wAttributes=0xdf) returned 1
	[0069.287] GetLastError () returned 0xcb
	[0069.287] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x67, lpConsoleScreenBufferInfo=0x5f4e8f8 | out: lpConsoleScreenBufferInfo=0x5f4e8f8) returned 1
	[0069.288] GetLastError () returned 0xcb
	[0069.293] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b
	[0069.293] GetLastError () returned 0xcb
	[0069.294] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6b, lpConsoleScreenBufferInfo=0x5f4e8f8 | out: lpConsoleScreenBufferInfo=0x5f4e8f8) returned 1
	[0069.294] GetLastError () returned 0xcb
	[0069.299] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f
	[0069.299] GetLastError () returned 0xcb
	[0069.299] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5f4e900 | out: lpConsoleScreenBufferInfo=0x5f4e900) returned 1
	[0069.300] GetLastError () returned 0xcb
	[0069.300] SetConsoleTextAttribute (hConsoleOutput=0x6f, wAttributes=0xdf) returned 1
	[0069.300] GetLastError () returned 0xcb
	[0069.301] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5f4e900 | out: lpConsoleScreenBufferInfo=0x5f4e900) returned 1
	[0069.301] GetLastError () returned 0xcb
	[0069.301] SetConsoleTextAttribute (hConsoleOutput=0x6f, wAttributes=0xdf) returned 1
	[0069.301] GetLastError () returned 0xcb
	[0069.302] WriteConsoleW (in: hConsoleOutput=0x6f, lpBuffer=0x2ce6ef4*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5f4e94c, lpReserved=0x0 | out: lpBuffer=0x2ce6ef4*, lpNumberOfCharsWritten=0x5f4e94c*=0x1) returned 1
	[0069.302] GetLastError () returned 0xcb
	[0069.303] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5f4e8fc | out: lpConsoleScreenBufferInfo=0x5f4e8fc) returned 1
	[0069.303] GetLastError () returned 0xcb
	[0069.303] SetConsoleTextAttribute (hConsoleOutput=0x6f, wAttributes=0xdf) returned 1
	[0069.304] GetLastError () returned 0xcb
	[0069.304] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5f4e8fc | out: lpConsoleScreenBufferInfo=0x5f4e8fc) returned 1
	[0069.304] GetLastError () returned 0xcb
	[0069.304] SetConsoleTextAttribute (hConsoleOutput=0x6f, wAttributes=0xdf) returned 1
	[0069.305] GetLastError () returned 0xcb
	[0069.305] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5f4e8bc | out: lpConsoleScreenBufferInfo=0x5f4e8bc) returned 1
	[0069.306] GetLastError () returned 0xcb
	[0069.311] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x73
	[0069.311] GetLastError () returned 0xcb
	[0069.311] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x73, lpConsoleScreenBufferInfo=0x5f4e8bc | out: lpConsoleScreenBufferInfo=0x5f4e8bc) returned 1
	[0069.312] GetLastError () returned 0xcb
	[0069.317] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77
	[0069.318] GetLastError () returned 0xcb
	[0069.318] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5f4e8c4 | out: lpConsoleScreenBufferInfo=0x5f4e8c4) returned 1
	[0069.318] GetLastError () returned 0xcb
	[0069.318] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0xdf) returned 1
	[0069.318] GetLastError () returned 0xcb
	[0069.319] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5f4e8c4 | out: lpConsoleScreenBufferInfo=0x5f4e8c4) returned 1
	[0069.319] GetLastError () returned 0xcb
	[0069.319] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0xdf) returned 1
	[0069.319] GetLastError () returned 0xcb
	[0069.320] WriteConsoleW (in: hConsoleOutput=0x77, lpBuffer=0x2ca82bc*, nNumberOfCharsToWrite=0x8, lpNumberOfCharsWritten=0x5f4e910, lpReserved=0x0 | out: lpBuffer=0x2ca82bc*, lpNumberOfCharsWritten=0x5f4e910*=0x8) returned 1
	[0069.320] GetLastError () returned 0xcb
	[0069.321] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5f4e8c0 | out: lpConsoleScreenBufferInfo=0x5f4e8c0) returned 1
	[0069.321] GetLastError () returned 0xcb
	[0069.321] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0xdf) returned 1
	[0069.322] GetLastError () returned 0xcb
	[0069.322] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5f4e8c0 | out: lpConsoleScreenBufferInfo=0x5f4e8c0) returned 1
	[0069.323] GetLastError () returned 0xcb
	[0069.323] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0xdf) returned 1
	[0069.323] GetLastError () returned 0xcb
	[0069.324] WriteConsoleW (in: hConsoleOutput=0x77, lpBuffer=0x2b299d8*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5f4e9b4, lpReserved=0x0 | out: lpBuffer=0x2b299d8*, lpNumberOfCharsWritten=0x5f4e9b4*=0x1) returned 1
	[0069.324] GetLastError () returned 0xcb
	[0069.371] SetErrorMode (uMode=0x1) returned 0x1
	[0069.642] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x53
	[0069.642] GetLastError () returned 0x3
	[0069.642] SetErrorMode (uMode=0x1) returned 0x1
	[0069.642] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\winhost.exe.ps1", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.642] GetLastError () returned 0x3
	[0069.645] SetErrorMode (uMode=0x1) returned 0x1
	[0069.645] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x53
	[0069.645] GetLastError () returned 0x3
	[0069.645] SetErrorMode (uMode=0x1) returned 0x1
	[0069.645] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\winhost.exe.psm1", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.645] GetLastError () returned 0x3
	[0069.648] SetErrorMode (uMode=0x1) returned 0x1
	[0069.648] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x53
	[0069.648] GetLastError () returned 0x3
	[0069.648] SetErrorMode (uMode=0x1) returned 0x1
	[0069.648] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\winhost.exe.psd1", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.648] GetLastError () returned 0x3
	[0069.650] SetErrorMode (uMode=0x1) returned 0x1
	[0069.651] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x53
	[0069.651] GetLastError () returned 0x3
	[0069.651] SetErrorMode (uMode=0x1) returned 0x1
	[0069.651] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\winhost.exe.COM", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.651] GetLastError () returned 0x3
	[0069.653] SetErrorMode (uMode=0x1) returned 0x1
	[0069.653] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x53
	[0069.654] GetLastError () returned 0x3
	[0069.654] SetErrorMode (uMode=0x1) returned 0x1
	[0069.654] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\winhost.exe.EXE", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.654] GetLastError () returned 0x3
	[0069.656] SetErrorMode (uMode=0x1) returned 0x1
	[0069.656] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x53
	[0069.656] GetLastError () returned 0x3
	[0069.656] SetErrorMode (uMode=0x1) returned 0x1
	[0069.656] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\winhost.exe.BAT", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.657] GetLastError () returned 0x3
	[0069.659] SetErrorMode (uMode=0x1) returned 0x1
	[0069.659] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x53
	[0069.659] GetLastError () returned 0x3
	[0069.659] SetErrorMode (uMode=0x1) returned 0x1
	[0069.659] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\winhost.exe.CMD", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.659] GetLastError () returned 0x3
	[0069.661] SetErrorMode (uMode=0x1) returned 0x1
	[0069.662] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x53
	[0069.662] GetLastError () returned 0x3
	[0069.662] SetErrorMode (uMode=0x1) returned 0x1
	[0069.662] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\winhost.exe.VBS", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.662] GetLastError () returned 0x3
	[0069.664] SetErrorMode (uMode=0x1) returned 0x1
	[0069.664] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x53
	[0069.664] GetLastError () returned 0x3
	[0069.664] SetErrorMode (uMode=0x1) returned 0x1
	[0069.665] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\winhost.exe.VBE", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.665] GetLastError () returned 0x3
	[0069.667] SetErrorMode (uMode=0x1) returned 0x1
	[0069.667] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x53
	[0069.667] GetLastError () returned 0x3
	[0069.667] SetErrorMode (uMode=0x1) returned 0x1
	[0069.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\winhost.exe.JS", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.667] GetLastError () returned 0x3
	[0069.671] SetErrorMode (uMode=0x1) returned 0x1
	[0069.671] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x53
	[0069.671] GetLastError () returned 0x3
	[0069.671] SetErrorMode (uMode=0x1) returned 0x1
	[0069.671] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\winhost.exe.JSE", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.671] GetLastError () returned 0x3
	[0069.673] SetErrorMode (uMode=0x1) returned 0x1
	[0069.674] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x53
	[0069.674] GetLastError () returned 0x3
	[0069.674] SetErrorMode (uMode=0x1) returned 0x1
	[0069.674] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\winhost.exe.WSF", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.674] GetLastError () returned 0x3
	[0069.676] SetErrorMode (uMode=0x1) returned 0x1
	[0069.676] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x53
	[0069.676] GetLastError () returned 0x3
	[0069.676] SetErrorMode (uMode=0x1) returned 0x1
	[0069.677] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\winhost.exe.WSH", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.677] GetLastError () returned 0x3
	[0069.679] SetErrorMode (uMode=0x1) returned 0x1
	[0069.679] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x53
	[0069.679] GetLastError () returned 0x3
	[0069.679] SetErrorMode (uMode=0x1) returned 0x1
	[0069.679] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\winhost.exe.MSC", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.679] GetLastError () returned 0x3
	[0069.681] SetErrorMode (uMode=0x1) returned 0x1
	[0069.681] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\winhost.exe", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.681] GetLastError () returned 0x2
	[0069.681] SetErrorMode (uMode=0x1) returned 0x1
	[0069.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0069.682] GetLastError () returned 0x2
	[0069.682] SetErrorMode (uMode=0x1) returned 0x1
	[0069.682] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\winhost.exe.ps1", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.682] GetLastError () returned 0x2
	[0069.682] SetErrorMode (uMode=0x1) returned 0x1
	[0069.682] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0069.682] GetLastError () returned 0x2
	[0069.682] SetErrorMode (uMode=0x1) returned 0x1
	[0069.682] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\winhost.exe.psm1", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.683] GetLastError () returned 0x2
	[0069.683] SetErrorMode (uMode=0x1) returned 0x1
	[0069.683] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0069.683] GetLastError () returned 0x2
	[0069.683] SetErrorMode (uMode=0x1) returned 0x1
	[0069.683] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\winhost.exe.psd1", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.683] GetLastError () returned 0x2
	[0069.683] SetErrorMode (uMode=0x1) returned 0x1
	[0069.683] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0069.683] GetLastError () returned 0x2
	[0069.683] SetErrorMode (uMode=0x1) returned 0x1
	[0069.684] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\winhost.exe.COM", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.684] GetLastError () returned 0x2
	[0069.684] SetErrorMode (uMode=0x1) returned 0x1
	[0069.684] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0069.684] GetLastError () returned 0x2
	[0069.684] SetErrorMode (uMode=0x1) returned 0x1
	[0069.684] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\winhost.exe.EXE", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.684] GetLastError () returned 0x2
	[0069.684] SetErrorMode (uMode=0x1) returned 0x1
	[0069.684] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0069.684] GetLastError () returned 0x2
	[0069.685] SetErrorMode (uMode=0x1) returned 0x1
	[0069.685] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\winhost.exe.BAT", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.685] GetLastError () returned 0x2
	[0069.685] SetErrorMode (uMode=0x1) returned 0x1
	[0069.685] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0069.685] GetLastError () returned 0x2
	[0069.685] SetErrorMode (uMode=0x1) returned 0x1
	[0069.685] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\winhost.exe.CMD", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.685] GetLastError () returned 0x2
	[0069.686] SetErrorMode (uMode=0x1) returned 0x1
	[0069.686] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0069.686] GetLastError () returned 0x2
	[0069.686] SetErrorMode (uMode=0x1) returned 0x1
	[0069.686] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\winhost.exe.VBS", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.686] GetLastError () returned 0x2
	[0069.686] SetErrorMode (uMode=0x1) returned 0x1
	[0069.686] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0069.686] GetLastError () returned 0x2
	[0069.686] SetErrorMode (uMode=0x1) returned 0x1
	[0069.686] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\winhost.exe.VBE", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.687] GetLastError () returned 0x2
	[0069.687] SetErrorMode (uMode=0x1) returned 0x1
	[0069.687] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0069.687] GetLastError () returned 0x2
	[0069.687] SetErrorMode (uMode=0x1) returned 0x1
	[0069.687] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\winhost.exe.JS", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.687] GetLastError () returned 0x2
	[0069.687] SetErrorMode (uMode=0x1) returned 0x1
	[0069.687] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0069.687] GetLastError () returned 0x2
	[0069.687] SetErrorMode (uMode=0x1) returned 0x1
	[0069.688] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\winhost.exe.JSE", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.688] GetLastError () returned 0x2
	[0069.688] SetErrorMode (uMode=0x1) returned 0x1
	[0069.688] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0069.688] GetLastError () returned 0x2
	[0069.688] SetErrorMode (uMode=0x1) returned 0x1
	[0069.688] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\winhost.exe.WSF", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.688] GetLastError () returned 0x2
	[0069.689] SetErrorMode (uMode=0x1) returned 0x1
	[0069.689] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0069.689] GetLastError () returned 0x2
	[0069.689] SetErrorMode (uMode=0x1) returned 0x1
	[0069.689] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\winhost.exe.WSH", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.689] GetLastError () returned 0x2
	[0069.689] SetErrorMode (uMode=0x1) returned 0x1
	[0069.689] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0069.689] GetLastError () returned 0x2
	[0069.689] SetErrorMode (uMode=0x1) returned 0x1
	[0069.689] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\winhost.exe.MSC", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.690] GetLastError () returned 0x2
	[0069.690] SetErrorMode (uMode=0x1) returned 0x1
	[0069.690] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
	[0069.690] GetLastError () returned 0x2
	[0069.690] SetErrorMode (uMode=0x1) returned 0x1
	[0069.690] FindFirstFileW (in: lpFileName="C:\\Windows\\winhost.exe", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.690] GetLastError () returned 0x2
	[0069.691] SetErrorMode (uMode=0x1) returned 0x1
	[0069.691] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
	[0069.691] GetLastError () returned 0x2
	[0069.691] SetErrorMode (uMode=0x1) returned 0x1
	[0069.691] FindFirstFileW (in: lpFileName="C:\\Windows\\winhost.exe.ps1", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.691] GetLastError () returned 0x2
	[0069.691] SetErrorMode (uMode=0x1) returned 0x1
	[0069.691] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
	[0069.691] GetLastError () returned 0x2
	[0069.691] SetErrorMode (uMode=0x1) returned 0x1
	[0069.691] FindFirstFileW (in: lpFileName="C:\\Windows\\winhost.exe.psm1", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.692] GetLastError () returned 0x2
	[0069.692] SetErrorMode (uMode=0x1) returned 0x1
	[0069.692] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
	[0069.692] GetLastError () returned 0x2
	[0069.692] SetErrorMode (uMode=0x1) returned 0x1
	[0069.692] FindFirstFileW (in: lpFileName="C:\\Windows\\winhost.exe.psd1", lpFindFileData=0x55e4a0 | out: lpFindFileData=0x55e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0069.692] GetLastError () returned 0x2
	[0069.692] SetErrorMode (uMode=0x1) returned 0x1
	[0069.692] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5f4e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
	[0069.692] GetLastError () returned 0x2
	[0069.692] SetErrorMode (uMode=0x1) returned 0x1
	[0069.807] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5596f0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0069.807] GetLastError () returned 0xcb
	[0069.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x5f4e0dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0069.812] GetLastError () returned 0xcb
	[0069.812] SetErrorMode (uMode=0x1) returned 0x1
	[0069.812] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2faf8c8 | out: lpFileInformation=0x2faf8c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7dee7d20, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x7dee7d20, ftLastWriteTime.dwHighDateTime=0x1d59309, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0069.812] GetLastError () returned 0xcb
	[0069.812] SetErrorMode (uMode=0x1) returned 0x1
	[0069.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x5f4e0e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0069.812] GetLastError () returned 0xcb
	[0069.812] SetErrorMode (uMode=0x1) returned 0x1
	[0069.812] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2fafa7c | out: lpFileInformation=0x2fafa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7dee7d20, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x7dee7d20, ftLastWriteTime.dwHighDateTime=0x1d59309, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0069.812] GetLastError () returned 0xcb
	[0069.812] SetErrorMode (uMode=0x1) returned 0x1
	[0069.817] LocalAlloc (uFlags=0x0, uBytes=0x18) returned 0x5591b0
	[0069.819] RtlMoveMemory (in: Destination=0x5591b0, Source=0x2edc1b0, Length=0x18 | out: Destination=0x5591b0) 
	[0069.819] LocalAlloc (uFlags=0x0, uBytes=0x4c) returned 0x540c30
	[0069.819] RtlMoveMemory (in: Destination=0x540c30, Source=0x2fb0ce4, Length=0x4c | out: Destination=0x540c30) 
	[0070.049] LocalFree (hMem=0x5591b0) returned 0x0
	[0070.049] GetLastError () returned 0x0
	[0070.049] LocalFree (hMem=0x540c30) returned 0x0
	[0070.049] GetLastError () returned 0x0
	[0070.052] NtQueryInformationProcess (in: ProcessHandle=0x468, ProcessInformationClass=0x0, ProcessInformation=0x2fb1260, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x2fb1260, ReturnLength=0x0) returned 0x0
	[0070.054] EnumProcesses (in: lpidProcess=0x2fb1284, cb=0x400, lpcbNeeded=0x5f4e8fc | out: lpidProcess=0x2fb1284, lpcbNeeded=0x5f4e8fc) returned 1
	[0070.057] GetLastError () returned 0x0
	[0070.143] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5f4e8cc | out: lpConsoleScreenBufferInfo=0x5f4e8cc) returned 1
	[0070.143] GetLastError () returned 0x0
	[0070.149] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b
	[0070.149] GetLastError () returned 0x0
	[0070.149] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7b, lpConsoleScreenBufferInfo=0x5f4e8bc | out: lpConsoleScreenBufferInfo=0x5f4e8bc) returned 1
	[0070.149] GetLastError () returned 0x0
	[0070.155] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7f
	[0070.155] GetLastError () returned 0x0
	[0070.155] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7f, lpConsoleScreenBufferInfo=0x5f4e8bc | out: lpConsoleScreenBufferInfo=0x5f4e8bc) returned 1
	[0070.155] GetLastError () returned 0x0
	[0070.160] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x83
	[0070.161] GetLastError () returned 0x0
	[0070.161] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x83, lpConsoleScreenBufferInfo=0x5f4e8c4 | out: lpConsoleScreenBufferInfo=0x5f4e8c4) returned 1
	[0070.161] GetLastError () returned 0x0
	[0070.161] SetConsoleTextAttribute (hConsoleOutput=0x83, wAttributes=0xde) returned 1
	[0070.162] GetLastError () returned 0x0
	[0070.162] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x83, lpConsoleScreenBufferInfo=0x5f4e8c4 | out: lpConsoleScreenBufferInfo=0x5f4e8c4) returned 1
	[0070.163] GetLastError () returned 0x0
	[0070.163] SetConsoleTextAttribute (hConsoleOutput=0x83, wAttributes=0xde) returned 1
	[0070.163] GetLastError () returned 0x0
	[0070.164] WriteConsoleW (in: hConsoleOutput=0x83, lpBuffer=0x2ca8a50*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x5f4e910, lpReserved=0x0 | out: lpBuffer=0x2ca8a50*, lpNumberOfCharsWritten=0x5f4e910*=0x3) returned 1
	[0070.164] GetLastError () returned 0x0
	[0070.165] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x83, lpConsoleScreenBufferInfo=0x5f4e8c0 | out: lpConsoleScreenBufferInfo=0x5f4e8c0) returned 1
	[0070.165] GetLastError () returned 0x0
	[0070.165] SetConsoleTextAttribute (hConsoleOutput=0x83, wAttributes=0xdf) returned 1
	[0070.166] GetLastError () returned 0x0
	[0070.166] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x83, lpConsoleScreenBufferInfo=0x5f4e8c0 | out: lpConsoleScreenBufferInfo=0x5f4e8c0) returned 1
	[0070.166] GetLastError () returned 0x0
	[0070.166] SetConsoleTextAttribute (hConsoleOutput=0x83, wAttributes=0xdf) returned 1
	[0070.167] GetLastError () returned 0x0
	[0070.167] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x83, lpConsoleScreenBufferInfo=0x5f4e8f8 | out: lpConsoleScreenBufferInfo=0x5f4e8f8) returned 1
	[0070.168] GetLastError () returned 0x0
	[0070.173] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x87
	[0070.173] GetLastError () returned 0x0
	[0070.173] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x87, lpConsoleScreenBufferInfo=0x5f4e8f8 | out: lpConsoleScreenBufferInfo=0x5f4e8f8) returned 1
	[0070.174] GetLastError () returned 0x0
	[0070.179] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8b
	[0070.179] GetLastError () returned 0x0
	[0070.179] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8b, lpConsoleScreenBufferInfo=0x5f4e900 | out: lpConsoleScreenBufferInfo=0x5f4e900) returned 1
	[0070.179] GetLastError () returned 0x0
	[0070.179] SetConsoleTextAttribute (hConsoleOutput=0x8b, wAttributes=0xde) returned 1
	[0070.180] GetLastError () returned 0x0
	[0070.180] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8b, lpConsoleScreenBufferInfo=0x5f4e900 | out: lpConsoleScreenBufferInfo=0x5f4e900) returned 1
	[0070.181] GetLastError () returned 0x0
	[0070.181] SetConsoleTextAttribute (hConsoleOutput=0x8b, wAttributes=0xde) returned 1
	[0070.181] GetLastError () returned 0x0
	[0070.182] WriteConsoleW (in: hConsoleOutput=0x8b, lpBuffer=0x2ce6ef4*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5f4e94c, lpReserved=0x0 | out: lpBuffer=0x2ce6ef4*, lpNumberOfCharsWritten=0x5f4e94c*=0x1) returned 1
	[0070.182] GetLastError () returned 0x0
	[0070.183] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8b, lpConsoleScreenBufferInfo=0x5f4e8fc | out: lpConsoleScreenBufferInfo=0x5f4e8fc) returned 1
	[0070.183] GetLastError () returned 0x0
	[0070.183] SetConsoleTextAttribute (hConsoleOutput=0x8b, wAttributes=0xdf) returned 1
	[0070.183] GetLastError () returned 0x0
	[0070.184] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8b, lpConsoleScreenBufferInfo=0x5f4e8fc | out: lpConsoleScreenBufferInfo=0x5f4e8fc) returned 1
	[0070.184] GetLastError () returned 0x0
	[0070.184] SetConsoleTextAttribute (hConsoleOutput=0x8b, wAttributes=0xdf) returned 1
	[0070.184] GetLastError () returned 0x0
	[0070.185] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8b, lpConsoleScreenBufferInfo=0x5f4e8bc | out: lpConsoleScreenBufferInfo=0x5f4e8bc) returned 1
	[0070.185] GetLastError () returned 0x0
	[0070.190] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f
	[0070.193] GetLastError () returned 0x0
	[0070.193] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8f, lpConsoleScreenBufferInfo=0x5f4e8bc | out: lpConsoleScreenBufferInfo=0x5f4e8bc) returned 1
	[0070.193] GetLastError () returned 0x0
	[0070.198] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x93
	[0070.199] GetLastError () returned 0x0
	[0070.199] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x93, lpConsoleScreenBufferInfo=0x5f4e8c4 | out: lpConsoleScreenBufferInfo=0x5f4e8c4) returned 1
	[0070.199] GetLastError () returned 0x0
	[0070.199] SetConsoleTextAttribute (hConsoleOutput=0x93, wAttributes=0xde) returned 1
	[0070.199] GetLastError () returned 0x0
	[0070.200] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x93, lpConsoleScreenBufferInfo=0x5f4e8c4 | out: lpConsoleScreenBufferInfo=0x5f4e8c4) returned 1
	[0070.200] GetLastError () returned 0x0
	[0070.200] SetConsoleTextAttribute (hConsoleOutput=0x93, wAttributes=0xde) returned 1
	[0070.201] GetLastError () returned 0x0
	[0070.201] WriteConsoleW (in: hConsoleOutput=0x93, lpBuffer=0x2fd7458*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0x5f4e910, lpReserved=0x0 | out: lpBuffer=0x2fd7458*, lpNumberOfCharsWritten=0x5f4e910*=0x4) returned 1
	[0070.202] GetLastError () returned 0x0
	[0070.202] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x93, lpConsoleScreenBufferInfo=0x5f4e8c0 | out: lpConsoleScreenBufferInfo=0x5f4e8c0) returned 1
	[0070.203] GetLastError () returned 0x0
	[0070.203] SetConsoleTextAttribute (hConsoleOutput=0x93, wAttributes=0xdf) returned 1
	[0070.203] GetLastError () returned 0x0
	[0070.204] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x93, lpConsoleScreenBufferInfo=0x5f4e8c0 | out: lpConsoleScreenBufferInfo=0x5f4e8c0) returned 1
	[0070.204] GetLastError () returned 0x0
	[0070.204] SetConsoleTextAttribute (hConsoleOutput=0x93, wAttributes=0xdf) returned 1
	[0070.204] GetLastError () returned 0x0
	[0070.205] WriteConsoleW (in: hConsoleOutput=0x93, lpBuffer=0x2b299d8*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5f4e9b4, lpReserved=0x0 | out: lpBuffer=0x2b299d8*, lpNumberOfCharsWritten=0x5f4e9b4*=0x1) returned 1
	[0070.206] GetLastError () returned 0x0
	[0074.294] EnumProcesses (in: lpidProcess=0x2feb208, cb=0x400, lpcbNeeded=0x5f4e938 | out: lpidProcess=0x2feb208, lpcbNeeded=0x5f4e938) returned 1
	[0074.296] GetLastError () returned 0x0
	[0074.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3b482b8, Length=0x20000, ResultLength=0x5f4e8b8 | out: SystemInformation=0x3b482b8, ResultLength=0x5f4e8b8*=0xa438) returned 0x0
	[0074.300] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x93, lpConsoleScreenBufferInfo=0x5f4e7f8 | out: lpConsoleScreenBufferInfo=0x5f4e7f8) returned 1
	[0074.300] GetLastError () returned 0x0
	[0074.306] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x97
	[0074.306] GetLastError () returned 0x0
	[0074.306] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x97, lpConsoleScreenBufferInfo=0x5f4e7f8 | out: lpConsoleScreenBufferInfo=0x5f4e7f8) returned 1
	[0074.306] GetLastError () returned 0x0
	[0074.311] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9b
	[0074.312] GetLastError () returned 0x0
	[0074.312] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x9b, lpConsoleScreenBufferInfo=0x5f4e7e8 | out: lpConsoleScreenBufferInfo=0x5f4e7e8) returned 1
	[0074.312] GetLastError () returned 0x0
	[0074.317] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f
	[0074.318] GetLastError () returned 0x0
	[0074.318] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x9f, lpConsoleScreenBufferInfo=0x5f4e7e8 | out: lpConsoleScreenBufferInfo=0x5f4e7e8) returned 1
	[0074.318] GetLastError () returned 0x0
	[0074.323] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa3
	[0074.323] GetLastError () returned 0x0
	[0074.323] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xa3, lpConsoleScreenBufferInfo=0x5f4e7f0 | out: lpConsoleScreenBufferInfo=0x5f4e7f0) returned 1
	[0074.324] GetLastError () returned 0x0
	[0074.324] SetConsoleTextAttribute (hConsoleOutput=0xa3, wAttributes=0xdf) returned 1
	[0074.324] GetLastError () returned 0x0
	[0074.325] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xa3, lpConsoleScreenBufferInfo=0x5f4e7f0 | out: lpConsoleScreenBufferInfo=0x5f4e7f0) returned 1
	[0074.325] GetLastError () returned 0x0
	[0074.325] SetConsoleTextAttribute (hConsoleOutput=0xa3, wAttributes=0xdf) returned 1
	[0074.325] GetLastError () returned 0x0
	[0074.326] WriteConsoleW (in: hConsoleOutput=0xa3, lpBuffer=0x2ca95f4*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x5f4e83c, lpReserved=0x0 | out: lpBuffer=0x2ca95f4*, lpNumberOfCharsWritten=0x5f4e83c*=0xc) returned 1
	[0074.327] GetLastError () returned 0x0
	[0074.328] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xa3, lpConsoleScreenBufferInfo=0x5f4e7ec | out: lpConsoleScreenBufferInfo=0x5f4e7ec) returned 1
	[0074.328] GetLastError () returned 0x0
	[0074.328] SetConsoleTextAttribute (hConsoleOutput=0xa3, wAttributes=0xdf) returned 1
	[0074.328] GetLastError () returned 0x0
	[0074.329] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xa3, lpConsoleScreenBufferInfo=0x5f4e7ec | out: lpConsoleScreenBufferInfo=0x5f4e7ec) returned 1
	[0074.329] GetLastError () returned 0x0
	[0074.329] SetConsoleTextAttribute (hConsoleOutput=0xa3, wAttributes=0xdf) returned 1
	[0074.330] GetLastError () returned 0x0
	[0074.330] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xa3, lpConsoleScreenBufferInfo=0x5f4e824 | out: lpConsoleScreenBufferInfo=0x5f4e824) returned 1
	[0074.330] GetLastError () returned 0x0
	[0074.335] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa7
	[0074.336] GetLastError () returned 0x0
	[0074.336] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xa7, lpConsoleScreenBufferInfo=0x5f4e824 | out: lpConsoleScreenBufferInfo=0x5f4e824) returned 1
	[0074.336] GetLastError () returned 0x0
	[0074.340] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xab
	[0074.341] GetLastError () returned 0x0
	[0074.341] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xab, lpConsoleScreenBufferInfo=0x5f4e82c | out: lpConsoleScreenBufferInfo=0x5f4e82c) returned 1
	[0074.341] GetLastError () returned 0x0
	[0074.341] SetConsoleTextAttribute (hConsoleOutput=0xab, wAttributes=0xdf) returned 1
	[0074.341] GetLastError () returned 0x0
	[0074.342] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xab, lpConsoleScreenBufferInfo=0x5f4e82c | out: lpConsoleScreenBufferInfo=0x5f4e82c) returned 1
	[0074.342] GetLastError () returned 0x0
	[0074.342] SetConsoleTextAttribute (hConsoleOutput=0xab, wAttributes=0xdf) returned 1
	[0074.342] GetLastError () returned 0x0
	[0074.343] WriteConsoleW (in: hConsoleOutput=0xab, lpBuffer=0x2ce6ef4*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5f4e878, lpReserved=0x0 | out: lpBuffer=0x2ce6ef4*, lpNumberOfCharsWritten=0x5f4e878*=0x1) returned 1
	[0074.344] GetLastError () returned 0x0
	[0074.344] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xab, lpConsoleScreenBufferInfo=0x5f4e828 | out: lpConsoleScreenBufferInfo=0x5f4e828) returned 1
	[0074.344] GetLastError () returned 0x0
	[0074.344] SetConsoleTextAttribute (hConsoleOutput=0xab, wAttributes=0xdf) returned 1
	[0074.344] GetLastError () returned 0x0
	[0074.345] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xab, lpConsoleScreenBufferInfo=0x5f4e828 | out: lpConsoleScreenBufferInfo=0x5f4e828) returned 1
	[0074.345] GetLastError () returned 0x0
	[0074.345] SetConsoleTextAttribute (hConsoleOutput=0xab, wAttributes=0xdf) returned 1
	[0074.345] GetLastError () returned 0x0
	[0074.346] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xab, lpConsoleScreenBufferInfo=0x5f4e7e8 | out: lpConsoleScreenBufferInfo=0x5f4e7e8) returned 1
	[0074.346] GetLastError () returned 0x0
	[0074.350] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xaf
	[0074.350] GetLastError () returned 0x0
	[0074.350] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xaf, lpConsoleScreenBufferInfo=0x5f4e7e8 | out: lpConsoleScreenBufferInfo=0x5f4e7e8) returned 1
	[0074.350] GetLastError () returned 0x0
	[0074.354] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xb3
	[0074.356] GetLastError () returned 0x0
	[0074.356] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb3, lpConsoleScreenBufferInfo=0x5f4e7f0 | out: lpConsoleScreenBufferInfo=0x5f4e7f0) returned 1
	[0074.357] GetLastError () returned 0x0
	[0074.357] SetConsoleTextAttribute (hConsoleOutput=0xb3, wAttributes=0xdf) returned 1
	[0074.357] GetLastError () returned 0x0
	[0074.358] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb3, lpConsoleScreenBufferInfo=0x5f4e7f0 | out: lpConsoleScreenBufferInfo=0x5f4e7f0) returned 1
	[0074.358] GetLastError () returned 0x0
	[0074.358] SetConsoleTextAttribute (hConsoleOutput=0xb3, wAttributes=0xdf) returned 1
	[0074.358] GetLastError () returned 0x0
	[0074.359] WriteConsoleW (in: hConsoleOutput=0xb3, lpBuffer=0x2ca9674*, nNumberOfCharsToWrite=0x8, lpNumberOfCharsWritten=0x5f4e83c, lpReserved=0x0 | out: lpBuffer=0x2ca9674*, lpNumberOfCharsWritten=0x5f4e83c*=0x8) returned 1
	[0074.359] GetLastError () returned 0x0
	[0074.359] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb3, lpConsoleScreenBufferInfo=0x5f4e7ec | out: lpConsoleScreenBufferInfo=0x5f4e7ec) returned 1
	[0074.360] GetLastError () returned 0x0
	[0074.360] SetConsoleTextAttribute (hConsoleOutput=0xb3, wAttributes=0xdf) returned 1
	[0074.360] GetLastError () returned 0x0
	[0074.360] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb3, lpConsoleScreenBufferInfo=0x5f4e7ec | out: lpConsoleScreenBufferInfo=0x5f4e7ec) returned 1
	[0074.361] GetLastError () returned 0x0
	[0074.361] SetConsoleTextAttribute (hConsoleOutput=0xb3, wAttributes=0xdf) returned 1
	[0074.361] GetLastError () returned 0x0
	[0074.362] WriteConsoleW (in: hConsoleOutput=0xb3, lpBuffer=0x2b299d8*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5f4e8e0, lpReserved=0x0 | out: lpBuffer=0x2b299d8*, lpNumberOfCharsWritten=0x5f4e8e0*=0x1) returned 1
	[0074.362] GetLastError () returned 0x0
	[0074.363] EnumProcesses (in: lpidProcess=0x300553c, cb=0x400, lpcbNeeded=0x5f4e838 | out: lpidProcess=0x300553c, lpcbNeeded=0x5f4e838) returned 1
	[0074.363] GetLastError () returned 0x0
	[0074.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3b682d8, Length=0x20000, ResultLength=0x5f4e7b8 | out: SystemInformation=0x3b682d8, ResultLength=0x5f4e7b8*=0xa438) returned 0x0
	[0074.728] OpenProcess (dwDesiredAccess=0x200, bInheritHandle=0, dwProcessId=0xb60) returned 0x38c
	[0074.728] GetLastError () returned 0x0
	[0074.730] SetPriorityClass (hProcess=0x38c, dwPriorityClass=0x100) 

Thread:
	id = 45
	os_tid = 0xb5c

	[0069.825] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0
	[0069.839] ShellExecuteExW (in: pExecInfo=0x2fb10fc*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="winhost.exe", lpParameters=0x0, lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2fb10fc*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="winhost.exe", lpParameters=0x0, lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x468)) returned 1
	[0070.042] GetLastError () returned 0x0
	[0070.043] CoGetContextToken (in: pToken=0x55bfad8 | out: pToken=0x55bfad8) returned 0x0
	[0070.043] CoUninitialize () 

Process:
	id = "3"
	image_name = "winhost.exe"
	filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"
	page_root = "0x3a87b000"
	os_pid = "0xb60"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0xae8"
	cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe\" "
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 46
	os_tid = 0xb64

	[0070.098] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000
	[0070.106] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222
	[0070.106] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0
	[0070.106] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee
	[0070.106] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442
	[0070.106] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0
	[0070.106] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2
	[0070.106] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950
	[0070.106] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18
	[0070.106] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10
	[0070.106] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223
	[0070.106] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e
	[0070.106] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0
	[0070.106] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c
	[0070.121] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700
	[0070.121] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b
	[0070.121] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809
	[0070.209] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136
	[0070.209] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371
	[0070.209] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c
	[0070.209] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3
	[0070.209] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d
	[0070.209] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916
	[0070.209] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff
	[0070.209] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270
	[0070.210] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3
	[0070.210] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c
	[0070.210] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151
	[0070.210] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0
	[0070.210] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220
	[0070.210] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd
	[0070.210] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e
	[0070.210] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5
	[0070.210] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e
	[0070.210] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410
	[0070.210] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467
	[0070.210] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5
	[0070.210] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173
	[0070.210] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725
	[0070.210] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0
	[0070.211] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8
	[0070.211] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7
	[0070.211] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860
	[0070.211] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282
	[0070.211] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807
	[0070.211] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e
	[0070.211] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435
	[0070.211] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9
	[0070.211] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e
	[0070.211] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026
	[0070.211] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9
	[0070.211] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b
	[0070.211] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c
	[0070.211] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d
	[0070.211] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca
	[0070.212] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a
	[0070.212] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986
	[0070.212] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802
	[0070.212] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96
	[0070.212] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e
	[0070.212] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0
	[0070.212] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f
	[0070.212] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c
	[0070.212] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf
	[0070.212] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000
	[0070.225] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d
	[0070.225] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad
	[0070.225] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6
	[0070.225] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d
	[0070.225] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304
	[0070.225] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c
	[0070.226] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64
	[0070.226] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c
	[0070.226] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c
	[0070.226] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144
	[0070.226] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86
	[0070.226] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a
	[0070.226] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466
	[0070.226] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000
	[0070.245] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3
	[0070.245] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000
	[0070.275] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46
	[0070.275] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000
	[0070.275] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0
	[0070.275] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x6fdd0000
	[0070.437] GetProcAddress (hModule=0x6fdd0000, lpProcName="WNetCloseEnum") returned 0x6fdd2dd6
	[0070.437] GetProcAddress (hModule=0x6fdd0000, lpProcName="WNetOpenEnumW") returned 0x6fdd2f06
	[0070.437] GetProcAddress (hModule=0x6fdd0000, lpProcName="WNetEnumResourceW") returned 0x6fdd3058
	[0070.437] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000
	[0070.439] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2
	[0070.439] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8
	[0070.439] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01
	[0070.439] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e
	[0070.439] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd
	[0070.440] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918
	[0070.440] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673
	[0070.440] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b
	[0070.440] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57
	[0070.440] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57
	[0070.440] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b
	[0070.440] GetProcessHeap () returned 0x5e0000
	[0070.440] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x20) returned 0x5f46d8
	[0070.440] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=19034836544) returned 1
	[0070.440] GetTickCount () returned 0x1148805
	[0070.440] GetCurrentProcessId () returned 0xb60
	[0070.441] GetTickCount () returned 0x1148805
	[0070.441] GetTickCount () returned 0x1148805
	[0070.441] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x20) returned 0x5f4700
	[0070.441] GetVersion () returned 0x1db10106
	[0070.441] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x7) returned 0x5e3cd0
	[0070.441] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x5f12b8
	[0070.441] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f12b8, Size=0x20) returned 0x5f4750
	[0070.442] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4750, Size=0x40) returned 0x5f4fa0
	[0070.442] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x5f4fe8
	[0070.442] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_V2D18CA") returned 0x0
	[0070.442] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_V2D18CA") returned 0x84
	[0070.442] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5e3cd0 | out: hHeap=0x5e0000) returned 1
	[0070.442] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0070.442] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4fa0 | out: hHeap=0x5e0000) returned 1
	[0070.442] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x7) returned 0x5e3cd0
	[0070.442] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x5f12b8
	[0070.442] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f12b8, Size=0x20) returned 0x5f4750
	[0070.442] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4750, Size=0x40) returned 0x5f4fa0
	[0070.442] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x604ff0
	[0070.443] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_V2D18CU") returned 0x0
	[0070.443] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_V2D18CU") returned 0x88
	[0070.443] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5e3cd0 | out: hHeap=0x5e0000) returned 1
	[0070.443] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0070.443] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4fa0 | out: hHeap=0x5e0000) returned 1
	[0070.443] GetVersion () returned 0x1db10106
	[0070.443] GetCurrentProcess () returned 0xffffffff
	[0070.443] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1
	[0070.443] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1
	[0070.443] CloseHandle (hObject=0x8c) returned 1
	[0070.443] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0
	[0070.443] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0
	[0070.443] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x5e3cd0
	[0070.443] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x5f12b8
	[0070.443] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f12b8, Size=0x20) returned 0x5f4750
	[0070.443] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4750, Size=0x40) returned 0x5f4fa0
	[0070.443] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4fa0, Size=0x80) returned 0x5f4c38
	[0070.443] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4c38, Size=0x100) returned 0x5f4c38
	[0070.443] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x34) returned 0x5f4fa0
	[0070.443] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f0df0
	[0070.443] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f0e00
	[0070.443] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4d40
	[0070.443] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x5f12b8
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f4d50
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x5f12d0
	[0070.444] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4d50, Size=0x8) returned 0x5f4d50
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x5f12e8
	[0070.444] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4d50, Size=0x10) returned 0x5f4d50
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x5f1300
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x5f1318
	[0070.444] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4d50, Size=0x20) returned 0x5f4d50
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x5f1330
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x5f1348
	[0070.444] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f0df0, Size=0x8) returned 0x5f0df0
	[0070.444] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f0e00, Size=0x8) returned 0x5f0e00
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4d78
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x5f1360
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f4d88
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x5f1378
	[0070.444] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4d88, Size=0x8) returned 0x5f4d88
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x615010
	[0070.444] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4d88, Size=0x10) returned 0x5f4d88
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x615028
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4da0
	[0070.444] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4d88, Size=0x20) returned 0x5f4db0
	[0070.444] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f0df0, Size=0x10) returned 0x5f4d88
	[0070.444] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f0e00, Size=0x10) returned 0x5f4dd8
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f0df0
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x615040
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f0e00
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x615058
	[0070.444] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f0e00, Size=0x8) returned 0x5f0e00
	[0070.444] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4df0
	[0070.445] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x615070
	[0070.445] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f4e00
	[0070.445] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x615088
	[0070.445] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4e00, Size=0x8) returned 0x5f4e00
	[0070.445] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4d88, Size=0x20) returned 0x5f4e10
	[0070.445] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4dd8, Size=0x20) returned 0x5f4e38
	[0070.445] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4dd8
	[0070.445] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x6150a0
	[0070.445] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f4d88
	[0070.445] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x6150b8
	[0070.445] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4d88, Size=0x8) returned 0x5f4d88
	[0070.445] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x5f4e60
	[0070.445] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x5f4e80
	[0070.445] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0070.445] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4c38 | out: hHeap=0x5e0000) returned 1
	[0070.445] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0
	[0070.454] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6150d0
	[0070.454] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6150d0, Size=0x20) returned 0x5f4958
	[0070.454] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4958, Size=0x40) returned 0x5f4c58
	[0070.455] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4c58, Size=0x80) returned 0x5f4c58
	[0070.455] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4c58, Size=0x100) returned 0x6156b0
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6150d0
	[0070.455] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6150d0, Size=0x20) returned 0x5f4958
	[0070.455] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4958, Size=0x40) returned 0x5f4c58
	[0070.455] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4c58, Size=0x80) returned 0x5f4c58
	[0070.455] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4c58, Size=0x100) returned 0x6157b8
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x6150d0
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f4c58
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6150e8
	[0070.455] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4c58, Size=0x8) returned 0x5f4c58
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x5f4c68
	[0070.455] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4c58, Size=0x10) returned 0x5f4c88
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x18) returned 0x5f4ca0
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1a) returned 0x5f4958
	[0070.455] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4c88, Size=0x20) returned 0x5f4cc0
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1c) returned 0x5f4980
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x16) returned 0x5f4ce8
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1a) returned 0x5f49a8
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x615100
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f4c58
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40) returned 0x6158c0
	[0070.455] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4c58, Size=0x8) returned 0x5f4c58
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x3c) returned 0x615908
	[0070.455] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4c58, Size=0x10) returned 0x5f4c88
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x5f4d08
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x18) returned 0x615950
	[0070.455] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4c88, Size=0x20) returned 0x615970
	[0070.455] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x24) returned 0x615998
	[0070.455] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0070.455] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6156b0 | out: hHeap=0x5e0000) returned 1
	[0070.455] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0070.455] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6157b8 | out: hHeap=0x5e0000) returned 1
	[0070.456] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x615f18
	[0070.458] EnumServicesStatusExW (in: hSCManager=0x615f18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0
	[0070.459] GetLastError () returned 0xea
	[0070.459] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x11e4) returned 0x619860
	[0070.459] EnumServicesStatusExW (in: hSCManager=0x615f18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x619860, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x619860, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1
	[0070.459] CloseServiceHandle (hSCObject=0x615f18) returned 1
	[0070.464] lstrlenW (lpString="Appinfo") returned 7
	[0070.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0070.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0070.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0070.464] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0070.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0070.464] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0070.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0070.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0070.464] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0070.464] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0070.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0070.464] lstrlenW (lpString="AudioSrv") returned 8
	[0070.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0070.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0070.465] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0070.465] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0070.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0070.465] lstrlenW (lpString="BFE") returned 3
	[0070.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0070.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0070.465] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0070.465] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0070.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0070.465] lstrlenW (lpString="CryptSvc") returned 8
	[0070.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0070.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0070.465] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0070.465] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0070.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0070.465] lstrlenW (lpString="CscService") returned 10
	[0070.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0070.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0070.465] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0070.465] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0070.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0070.465] lstrlenW (lpString="DcomLaunch") returned 10
	[0070.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0070.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0070.465] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0070.465] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0070.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0070.465] lstrlenW (lpString="Dhcp") returned 4
	[0070.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0070.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0070.465] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0070.465] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0070.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0070.466] lstrlenW (lpString="Dnscache") returned 8
	[0070.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0070.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0070.466] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0070.466] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0070.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0070.466] lstrlenW (lpString="DPS") returned 3
	[0070.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0070.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0070.466] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0070.466] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0070.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0070.466] lstrlenW (lpString="eventlog") returned 8
	[0070.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0070.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0070.466] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0070.466] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0070.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0070.466] lstrlenW (lpString="EventSystem") returned 11
	[0070.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0070.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0070.466] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0070.466] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0070.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0070.466] lstrlenW (lpString="gpsvc") returned 5
	[0070.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0070.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0070.466] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0070.466] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0070.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0070.466] lstrlenW (lpString="iphlpsvc") returned 8
	[0070.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0070.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0070.466] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0070.467] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0070.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0070.467] lstrlenW (lpString="LanmanServer") returned 12
	[0070.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0070.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0070.467] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0070.467] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0070.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0070.467] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0070.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0070.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0070.467] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0070.467] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0070.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0070.467] lstrlenW (lpString="lmhosts") returned 7
	[0070.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0070.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0070.467] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0070.467] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0070.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0070.467] lstrlenW (lpString="MMCSS") returned 5
	[0070.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0070.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0070.467] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0070.467] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0070.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0070.467] lstrlenW (lpString="MpsSvc") returned 6
	[0070.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0070.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0070.467] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0070.467] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0070.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0070.467] lstrlenW (lpString="Netman") returned 6
	[0070.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0070.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0070.468] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0070.468] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0070.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0070.468] lstrlenW (lpString="netprofm") returned 8
	[0070.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0070.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0070.468] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0070.468] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0070.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0070.468] lstrlenW (lpString="NlaSvc") returned 6
	[0070.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0070.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0070.468] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0070.468] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0070.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0070.468] lstrlenW (lpString="nsi") returned 3
	[0070.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0070.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0070.468] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0070.468] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0070.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0070.468] lstrlenW (lpString="PcaSvc") returned 6
	[0070.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0070.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0070.468] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0070.468] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0070.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0070.468] lstrlenW (lpString="PlugPlay") returned 8
	[0070.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0070.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0070.468] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0070.468] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0070.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0070.468] lstrlenW (lpString="Power") returned 5
	[0070.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0070.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0070.469] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0070.469] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0070.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0070.469] lstrlenW (lpString="ProfSvc") returned 7
	[0070.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0070.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0070.469] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0070.469] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0070.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0070.469] lstrlenW (lpString="RpcEptMapper") returned 12
	[0070.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0070.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0070.469] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0070.469] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0070.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0070.469] lstrlenW (lpString="RpcSs") returned 5
	[0070.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0070.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0070.469] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0070.469] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0070.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0070.469] lstrlenW (lpString="SamSs") returned 5
	[0070.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0070.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0070.469] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0070.469] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0070.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0070.469] lstrlenW (lpString="Schedule") returned 8
	[0070.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0070.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0070.469] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0070.469] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0070.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0070.469] lstrlenW (lpString="SENS") returned 4
	[0070.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0070.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0070.470] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0070.470] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0070.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0070.470] lstrlenW (lpString="ShellHWDetection") returned 16
	[0070.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0070.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0070.470] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0070.470] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0070.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0070.470] lstrlenW (lpString="Spooler") returned 7
	[0070.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0070.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0070.470] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0070.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0070.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0070.470] lstrlenW (lpString="SysMain") returned 7
	[0070.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0070.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0070.470] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0070.470] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0070.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0070.470] lstrlenW (lpString="Themes") returned 6
	[0070.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0070.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0070.470] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0070.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0070.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0070.470] lstrlenW (lpString="TrkWks") returned 6
	[0070.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0070.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0070.471] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0070.471] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0070.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0070.471] lstrlenW (lpString="UxSms") returned 5
	[0070.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0070.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0070.471] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0070.471] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0070.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0070.471] lstrlenW (lpString="WdiServiceHost") returned 14
	[0070.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0070.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0070.471] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0070.471] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0070.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0070.471] lstrlenW (lpString="WdiSystemHost") returned 13
	[0070.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0070.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0070.471] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0070.471] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0070.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0070.471] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0070.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0070.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0070.471] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0070.471] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0070.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0070.471] lstrlenW (lpString="Winmgmt") returned 7
	[0070.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0070.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0070.471] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0070.471] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0070.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0070.471] lstrlenW (lpString="WPDBusEnum") returned 10
	[0070.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0070.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0070.472] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0070.472] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0070.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0070.472] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x619860 | out: hHeap=0x5e0000) returned 1
	[0070.472] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0
	[0070.475] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0070.475] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0070.476] lstrlenW (lpString="System") returned 6
	[0070.476] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0070.476] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0070.476] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0070.476] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0070.476] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0070.476] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0070.476] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0070.476] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0070.476] lstrlenW (lpString="smss.exe") returned 8
	[0070.476] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0070.476] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0070.476] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0070.476] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0070.476] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0070.476] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0070.476] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0070.477] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0070.477] lstrlenW (lpString="csrss.exe") returned 9
	[0070.477] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0070.477] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0070.477] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0070.477] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0070.477] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0070.477] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0070.477] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0070.477] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0070.478] lstrlenW (lpString="wininit.exe") returned 11
	[0070.478] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0070.478] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0070.478] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0070.478] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0070.478] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0070.478] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0070.478] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0070.478] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0070.478] lstrlenW (lpString="csrss.exe") returned 9
	[0070.478] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0070.478] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0070.478] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0070.478] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0070.478] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0070.478] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0070.479] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0070.479] lstrlenW (lpString="winlogon.exe") returned 12
	[0070.479] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0070.479] lstrlenW (lpString="services.exe") returned 12
	[0070.480] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0070.480] lstrlenW (lpString="lsass.exe") returned 9
	[0070.480] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0070.480] lstrlenW (lpString="lsm.exe") returned 7
	[0070.480] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0070.481] lstrlenW (lpString="svchost.exe") returned 11
	[0070.481] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0070.482] lstrlenW (lpString="svchost.exe") returned 11
	[0070.482] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0070.483] lstrlenW (lpString="svchost.exe") returned 11
	[0070.483] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0070.483] lstrlenW (lpString="svchost.exe") returned 11
	[0070.483] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0070.484] lstrlenW (lpString="svchost.exe") returned 11
	[0070.484] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0070.485] lstrlenW (lpString="audiodg.exe") returned 11
	[0070.485] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0070.485] lstrlenW (lpString="svchost.exe") returned 11
	[0070.485] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0070.495] lstrlenW (lpString="svchost.exe") returned 11
	[0070.495] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0070.495] lstrlenW (lpString="dwm.exe") returned 7
	[0070.496] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0070.496] lstrlenW (lpString="explorer.exe") returned 12
	[0070.496] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0070.497] lstrlenW (lpString="spoolsv.exe") returned 11
	[0070.497] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0070.497] lstrlenW (lpString="taskhost.exe") returned 12
	[0070.497] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0070.498] lstrlenW (lpString="svchost.exe") returned 11
	[0070.498] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0070.498] lstrlenW (lpString="taskeng.exe") returned 11
	[0070.499] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thomas_military.exe")) returned 1
	[0070.499] lstrlenW (lpString="thomas_military.exe") returned 19
	[0070.499] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos_nuke.exe")) returned 1
	[0070.500] lstrlenW (lpString="logos_nuke.exe") returned 14
	[0070.500] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wake-automatic-wal.exe")) returned 1
	[0070.500] lstrlenW (lpString="wake-automatic-wal.exe") returned 22
	[0070.500] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="multiple.exe")) returned 1
	[0070.501] lstrlenW (lpString="multiple.exe") returned 12
	[0070.501] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flights-being-fridge.exe")) returned 1
	[0070.502] lstrlenW (lpString="flights-being-fridge.exe") returned 24
	[0070.502] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ste.exe")) returned 1
	[0070.503] lstrlenW (lpString="ste.exe") returned 7
	[0070.503] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied.exe")) returned 1
	[0070.503] lstrlenW (lpString="copied.exe") returned 10
	[0070.503] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="borough_pubs_der.exe")) returned 1
	[0070.504] lstrlenW (lpString="borough_pubs_der.exe") returned 20
	[0070.504] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wifi-cargo-fantastic.exe")) returned 1
	[0070.504] lstrlenW (lpString="wifi-cargo-fantastic.exe") returned 24
	[0070.504] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="corn possibly expert.exe")) returned 1
	[0070.505] lstrlenW (lpString="corn possibly expert.exe") returned 24
	[0070.505] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tennessee_scheme.exe")) returned 1
	[0070.505] lstrlenW (lpString="tennessee_scheme.exe") returned 20
	[0070.505] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="department.exe")) returned 1
	[0070.506] lstrlenW (lpString="department.exe") returned 14
	[0070.506] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="measure.exe")) returned 1
	[0070.506] lstrlenW (lpString="measure.exe") returned 11
	[0070.506] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="investigated_gratis_serious.exe")) returned 1
	[0070.507] lstrlenW (lpString="investigated_gratis_serious.exe") returned 31
	[0070.507] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="refined.exe")) returned 1
	[0070.507] lstrlenW (lpString="refined.exe") returned 11
	[0070.507] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logic-globe.exe")) returned 1
	[0070.508] lstrlenW (lpString="logic-globe.exe") returned 15
	[0070.508] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="butterfly-updated-boards.exe")) returned 1
	[0070.508] lstrlenW (lpString="butterfly-updated-boards.exe") returned 28
	[0070.508] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marvel steps judgment.exe")) returned 1
	[0070.509] lstrlenW (lpString="marvel steps judgment.exe") returned 25
	[0070.509] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="direct-prospect-severe.exe")) returned 1
	[0070.509] lstrlenW (lpString="direct-prospect-severe.exe") returned 26
	[0070.509] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friendly.exe")) returned 1
	[0070.510] lstrlenW (lpString="friendly.exe") returned 12
	[0070.510] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="magnitude-manually-psi.exe")) returned 1
	[0070.510] lstrlenW (lpString="magnitude-manually-psi.exe") returned 26
	[0070.510] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="messenger herbs.exe")) returned 1
	[0070.511] lstrlenW (lpString="messenger herbs.exe") returned 19
	[0070.511] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0070.511] lstrlenW (lpString="taskhost.exe") returned 12
	[0070.511] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0070.512] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0070.512] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1
	[0070.512] lstrlenW (lpString="powershell.exe") returned 14
	[0070.512] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0070.513] lstrlenW (lpString="conhost.exe") returned 11
	[0070.513] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xae8, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1
	[0070.513] lstrlenW (lpString="winhost.exe") returned 11
	[0070.513] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xae8, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 0
	[0070.514] CloseHandle (hObject=0xe0) returned 1
	[0070.514] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6158c0 | out: hHeap=0x5e0000) returned 1
	[0070.514] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615908 | out: hHeap=0x5e0000) returned 1
	[0070.514] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4d08 | out: hHeap=0x5e0000) returned 1
	[0070.514] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615950 | out: hHeap=0x5e0000) returned 1
	[0070.514] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615998 | out: hHeap=0x5e0000) returned 1
	[0070.514] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6150e8 | out: hHeap=0x5e0000) returned 1
	[0070.514] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4c68 | out: hHeap=0x5e0000) returned 1
	[0070.514] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4ca0 | out: hHeap=0x5e0000) returned 1
	[0070.514] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4958 | out: hHeap=0x5e0000) returned 1
	[0070.514] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4980 | out: hHeap=0x5e0000) returned 1
	[0070.514] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4ce8 | out: hHeap=0x5e0000) returned 1
	[0070.514] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f49a8 | out: hHeap=0x5e0000) returned 1
	[0070.514] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x61baa8
	[0070.515] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x62bab0
	[0070.515] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6150e8
	[0070.515] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6150e8, Size=0x20) returned 0x5f49a8
	[0070.515] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f49a8, Size=0x40) returned 0x617738
	[0070.515] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6150e8
	[0070.515] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6150e8, Size=0x20) returned 0x5f49a8
	[0070.515] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6150e8
	[0070.515] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6150e8, Size=0x20) returned 0x5f4980
	[0070.515] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6150e8
	[0070.515] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6150e8, Size=0x20) returned 0x5f4958
	[0070.515] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4958, Size=0x40) returned 0x617780
	[0070.515] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x62bab0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31
	[0070.515] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x63bab8
	[0070.516] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x64bac0
	[0070.516] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6150e8
	[0070.516] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6150e8, Size=0x20) returned 0x5f4958
	[0070.516] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4958, Size=0x40) returned 0x6177c8
	[0070.516] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6177c8, Size=0x80) returned 0x6158a8
	[0070.516] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6158a8, Size=0x100) returned 0x617230
	[0070.516] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0070.516] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617230 | out: hHeap=0x5e0000) returned 1
	[0070.516] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\winhost.exe", lpDst=0x63bab8, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\winhost.exe") returned 0x20
	[0070.516] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x64bac0 | out: hHeap=0x5e0000) returned 1
	[0070.516] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63bab8 | out: hHeap=0x5e0000) returned 1
	[0070.516] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x2160020
	[0070.516] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6150e8
	[0070.516] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6150e8, Size=0x20) returned 0x5f4958
	[0070.516] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6150e8
	[0070.517] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6150e8, Size=0x20) returned 0x615f68
	[0070.517] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0070.517] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0070.517] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1
	[0070.517] lstrlenW (lpString="kernel32.dll") returned 12
	[0070.517] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4958 | out: hHeap=0x5e0000) returned 1
	[0070.517] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0070.517] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615f68 | out: hHeap=0x5e0000) returned 1
	[0070.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0
	[0070.517] CreateFileW (lpFileName="C:\\Windows\\System32\\winhost.exe" (normalized: "c:\\windows\\system32\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4
	[0070.518] ReadFile (in: hFile=0xe0, lpBuffer=0x2160020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2160020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0070.531] WriteFile (in: hFile=0xe4, lpBuffer=0x2160020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2160020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0070.534] ReadFile (in: hFile=0xe0, lpBuffer=0x2160020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2160020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1
	[0070.534] CloseHandle (hObject=0xe4) returned 1
	[0070.535] CloseHandle (hObject=0xe0) returned 1
	[0070.535] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6150e8
	[0070.535] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6150e8, Size=0x20) returned 0x615f68
	[0070.535] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6150e8
	[0070.535] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6150e8, Size=0x20) returned 0x615f18
	[0070.536] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0070.536] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0070.536] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0070.536] lstrlenW (lpString="kernel32.dll") returned 12
	[0070.536] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615f18 | out: hHeap=0x5e0000) returned 1
	[0070.536] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0070.536] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615f68 | out: hHeap=0x5e0000) returned 1
	[0070.536] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x2160020 | out: hHeap=0x5e0000) returned 1
	[0070.542] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6150e8
	[0070.542] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6150e8, Size=0x20) returned 0x615f68
	[0070.542] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615f68, Size=0x40) returned 0x6177c8
	[0070.542] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6177c8, Size=0x80) returned 0x63bad0
	[0070.542] lstrlenW (lpString="C:\\Windows\\System32\\winhost.exe") returned 31
	[0070.542] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0070.542] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x5c) returned 0x6158a8
	[0070.542] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0
	[0070.542] RegSetValueExW (in: hKey=0xe0, lpValueName="winhost.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\winhost.exe", cbData=0x3e | out: lpData="C:\\Windows\\System32\\winhost.exe") returned 0x0
	[0070.544] RegCloseKey (hKey=0xe0) returned 0x0
	[0070.544] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6158a8 | out: hHeap=0x5e0000) returned 1
	[0070.544] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0070.544] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63bad0 | out: hHeap=0x5e0000) returned 1
	[0070.544] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x63dab8
	[0070.544] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x64dac0
	[0070.544] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6150e8
	[0070.544] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6150e8, Size=0x20) returned 0x615f68
	[0070.544] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615f68, Size=0x40) returned 0x6177c8
	[0070.544] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6177c8, Size=0x80) returned 0x63bad0
	[0070.544] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63bad0, Size=0x100) returned 0x617230
	[0070.544] lstrlenW (lpString="") returned 0
	[0070.544] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0070.544] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8c) returned 0x617338
	[0070.544] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0
	[0070.544] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x64dac0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x64dac0*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2
	[0070.544] RegCloseKey (hKey=0xe0) returned 0x0
	[0070.545] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617338 | out: hHeap=0x5e0000) returned 1
	[0070.545] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0070.545] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8c) returned 0x617338
	[0070.545] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0
	[0070.545] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x64dac0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0
	[0070.545] RegCloseKey (hKey=0xe4) returned 0x0
	[0070.545] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617338 | out: hHeap=0x5e0000) returned 1
	[0070.545] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75
	[0070.545] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0070.545] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617230 | out: hHeap=0x5e0000) returned 1
	[0070.545] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x63dab8, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x68
	[0070.545] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x64dac0 | out: hHeap=0x5e0000) returned 1
	[0070.545] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63dab8 | out: hHeap=0x5e0000) returned 1
	[0070.545] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x2160020
	[0070.546] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615118
	[0070.546] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615118, Size=0x20) returned 0x615f68
	[0070.546] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615118
	[0070.546] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615118, Size=0x20) returned 0x615f18
	[0070.546] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0070.546] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0070.546] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0070.546] lstrlenW (lpString="kernel32.dll") returned 12
	[0070.546] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615f68 | out: hHeap=0x5e0000) returned 1
	[0070.546] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0070.546] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615f18 | out: hHeap=0x5e0000) returned 1
	[0070.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4
	[0070.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8
	[0070.550] ReadFile (in: hFile=0xe4, lpBuffer=0x2160020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2160020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0070.565] WriteFile (in: hFile=0xe8, lpBuffer=0x2160020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2160020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0070.567] ReadFile (in: hFile=0xe4, lpBuffer=0x2160020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2160020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1
	[0070.567] CloseHandle (hObject=0xe8) returned 1
	[0070.568] CloseHandle (hObject=0xe4) returned 1
	[0070.568] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615118
	[0070.568] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615118, Size=0x20) returned 0x615f18
	[0070.568] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615118
	[0070.568] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615118, Size=0x20) returned 0x615f68
	[0070.569] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0070.569] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0070.569] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0070.569] lstrlenW (lpString="kernel32.dll") returned 12
	[0070.569] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615f68 | out: hHeap=0x5e0000) returned 1
	[0070.569] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0070.569] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615f18 | out: hHeap=0x5e0000) returned 1
	[0070.569] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x2160020 | out: hHeap=0x5e0000) returned 1
	[0070.574] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x63dab8
	[0070.574] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x64dac0
	[0070.574] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615118
	[0070.574] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615118, Size=0x20) returned 0x615f18
	[0070.574] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615f18, Size=0x40) returned 0x6177c8
	[0070.574] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6177c8, Size=0x80) returned 0x63bad0
	[0070.574] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63bad0, Size=0x100) returned 0x617230
	[0070.574] lstrlenW (lpString="") returned 0
	[0070.574] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0070.574] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8c) returned 0x617338
	[0070.574] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0
	[0070.574] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x64dac0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0
	[0070.574] RegCloseKey (hKey=0xe4) returned 0x0
	[0070.574] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617338 | out: hHeap=0x5e0000) returned 1
	[0070.574] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59
	[0070.574] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0070.574] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617230 | out: hHeap=0x5e0000) returned 1
	[0070.574] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x63dab8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x49
	[0070.574] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x64dac0 | out: hHeap=0x5e0000) returned 1
	[0070.574] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63dab8 | out: hHeap=0x5e0000) returned 1
	[0070.574] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x2160020
	[0070.575] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615118
	[0070.575] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615118, Size=0x20) returned 0x615f18
	[0070.575] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615118
	[0070.575] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615118, Size=0x20) returned 0x615f68
	[0070.575] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0070.575] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0070.575] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0070.575] lstrlenW (lpString="kernel32.dll") returned 12
	[0070.575] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615f18 | out: hHeap=0x5e0000) returned 1
	[0070.575] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0070.575] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615f68 | out: hHeap=0x5e0000) returned 1
	[0070.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4
	[0070.575] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8
	[0070.577] ReadFile (in: hFile=0xe4, lpBuffer=0x2160020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2160020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0070.592] WriteFile (in: hFile=0xe8, lpBuffer=0x2160020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2160020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0070.594] ReadFile (in: hFile=0xe4, lpBuffer=0x2160020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2160020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1
	[0070.594] CloseHandle (hObject=0xe8) returned 1
	[0070.596] CloseHandle (hObject=0xe4) returned 1
	[0070.596] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615118
	[0070.596] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615118, Size=0x20) returned 0x615f68
	[0070.597] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615118
	[0070.597] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615118, Size=0x20) returned 0x615f18
	[0070.597] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0070.597] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0070.597] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0070.597] lstrlenW (lpString="kernel32.dll") returned 12
	[0070.597] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615f18 | out: hHeap=0x5e0000) returned 1
	[0070.597] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0070.597] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615f68 | out: hHeap=0x5e0000) returned 1
	[0070.597] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x2160020 | out: hHeap=0x5e0000) returned 1
	[0070.603] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x61baa8 | out: hHeap=0x5e0000) returned 1
	[0070.603] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62bab0 | out: hHeap=0x5e0000) returned 1
	[0070.603] lstrlenW (lpString="%windir%\\System32") returned 17
	[0070.603] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617738 | out: hHeap=0x5e0000) returned 1
	[0070.603] lstrlenW (lpString="%appdata%") returned 9
	[0070.603] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f49a8 | out: hHeap=0x5e0000) returned 1
	[0070.603] lstrlenW (lpString="%sh(Startup)%") returned 13
	[0070.603] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4980 | out: hHeap=0x5e0000) returned 1
	[0070.603] lstrlenW (lpString="%sh(Common Startup)%") returned 20
	[0070.603] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617780 | out: hHeap=0x5e0000) returned 1
	[0070.603] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615118
	[0070.603] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615118, Size=0x20) returned 0x5f4980
	[0070.603] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4980, Size=0x40) returned 0x617780
	[0070.603] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x617780, Size=0x80) returned 0x63bad0
	[0070.603] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615118
	[0070.603] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615118, Size=0x20) returned 0x5f4980
	[0070.603] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1fffc) returned 0x61baa8
	[0070.603] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x63dab8
	[0070.603] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x64dac0
	[0070.603] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615118
	[0070.603] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615118, Size=0x20) returned 0x5f49a8
	[0070.603] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f49a8, Size=0x40) returned 0x617780
	[0070.603] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x617780, Size=0x80) returned 0x63bb58
	[0070.603] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63bb58, Size=0x100) returned 0x617230
	[0070.603] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0070.603] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617230 | out: hHeap=0x5e0000) returned 1
	[0070.603] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x63dab8, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c
	[0070.603] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x64dac0 | out: hHeap=0x5e0000) returned 1
	[0070.603] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63dab8 | out: hHeap=0x5e0000) returned 1
	[0070.604] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1
	[0070.604] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1
	[0070.604] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1
	[0070.604] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1
	[0070.604] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0xb6c, dwThreadId=0xb70)) returned 1
	[0070.619] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0070.619] WriteFile (in: hFile=0xec, lpBuffer=0x63bad0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x63bad0*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1
	[0070.619] CloseHandle (hObject=0xfc) returned 1
	[0070.619] CloseHandle (hObject=0xf8) returned 1
	[0070.619] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x61baa8 | out: hHeap=0x5e0000) returned 1
	[0070.619] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0070.619] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63bad0 | out: hHeap=0x5e0000) returned 1
	[0070.619] lstrlenW (lpString="%comspec%") returned 9
	[0070.619] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4980 | out: hHeap=0x5e0000) returned 1
	[0070.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8
	[0070.620] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x615118
	[0070.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x615118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc
	[0070.621] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4cb0
	[0070.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5f4cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104
	[0070.621] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615130
	[0070.621] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615130, Size=0x20) returned 0x5f4980
	[0070.621] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4980, Size=0x40) returned 0x617780
	[0070.621] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0070.621] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xd0) returned 0x6172a8
	[0070.621] GetLogicalDrives () returned 0x4
	[0070.621] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10014) returned 0x61baa8
	[0070.621] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615130
	[0070.621] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615130, Size=0x20) returned 0x5f4980
	[0070.621] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4980, Size=0x40) returned 0x617810
	[0070.622] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x617810, Size=0x80) returned 0x63bad0
	[0070.622] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63bad0, Size=0x100) returned 0x619818
	[0070.622] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x619818, Size=0x200) returned 0x619818
	[0070.622] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x619818, Size=0x400) returned 0x619818
	[0070.622] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x619818, Size=0x800) returned 0x619e30
	[0070.622] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x619e30, Size=0x1000) returned 0x62bac8
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x63dab8
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615130
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x615208
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f4c68
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x615220
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f4c78
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x615238
	[0070.622] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4c78, Size=0x8) returned 0x5f4c78
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x615250
	[0070.622] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4c78, Size=0x10) returned 0x617130
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x615268
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x615280
	[0070.622] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x617130, Size=0x20) returned 0x617130
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x615298
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4c78
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x6152b0
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x6152c8
	[0070.622] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x617130, Size=0x40) returned 0x615918
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x6152e0
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x6152f8
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x615310
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x615328
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x615340
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x615358
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x615960
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x615370
	[0070.622] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615918, Size=0x80) returned 0x619818
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x615388
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x6153a0
	[0070.622] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x6153b8
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x6153d0
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619e48
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619e60
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619e78
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x617130
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619e90
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619ea8
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619ec0
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619ed8
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619ef0
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619f08
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619f20
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619f38
	[0070.623] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x619818, Size=0x100) returned 0x619818
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619f50
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619f68
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619f80
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x619f98
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619fb0
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619fc8
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x617140
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619fe0
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619ff8
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a010
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x617150
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a028
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a040
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4ce8
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a058
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a070
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a088
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a0a0
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a0b8
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a0d0
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x61a0e8
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a100
	[0070.623] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x61a118
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a130
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a148
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a160
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a178
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4cf8
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a190
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a1a8
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a1c0
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a1d8
	[0070.624] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x619818, Size=0x200) returned 0x619818
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a1f0
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4d08
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a208
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a248
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a260
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a278
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a290
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a2a8
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a2c0
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a2d8
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a2f0
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a308
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a320
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a338
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a350
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a368
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a380
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a398
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a3b0
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a3c8
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a3e0
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a3f8
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a410
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4d18
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a428
	[0070.624] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a440
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a458
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x615918
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a470
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a488
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a4a0
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a4b8
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a4d0
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a4e8
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a500
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a518
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a530
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a548
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a560
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a578
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a590
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a5a8
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a5c0
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a5d8
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a5f0
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a608
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a648
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a660
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a678
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x62cae8
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x62caf8
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a690
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a6a8
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a6c0
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a6d8
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a6f0
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a708
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a720
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a738
	[0070.625] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a750
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a768
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a780
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a798
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a7b0
	[0070.626] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x619818, Size=0x400) returned 0x619818
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a7c8
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a7e0
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a7f8
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a810
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a828
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a840
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a858
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a870
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a888
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a8a0
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x62cb08
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a8b8
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x61a8d0
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a8e8
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a900
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a918
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a930
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x61a948
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a960
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a978
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a990
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a9a8
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a9c0
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a9d8
	[0070.626] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61a9f0
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x61aa08
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x62cb18
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cee8
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cf00
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cf18
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cf30
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cf48
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cf60
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cf78
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cf90
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cfa8
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x62cfc0
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cfd8
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x62cff0
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d008
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d020
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d038
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d050
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d068
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62d080
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d098
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d0b0
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d0c8
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d0e0
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d0f8
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d110
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d128
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d140
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d158
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d170
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d188
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d1a0
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d1b8
	[0070.627] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d1d0
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d1e8
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d200
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d218
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x62d230
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x12) returned 0x616538
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d248
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d260
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d278
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d290
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d2a8
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d2e8
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d300
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d318
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d330
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d348
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d360
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d378
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d390
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d3a8
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d3c0
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d3d8
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d3f0
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d408
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d420
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d438
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62d450
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62d468
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62d480
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x62d498
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62d4b0
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x62cb28
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d4c8
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x62cb38
	[0070.628] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d4e0
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d4f8
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d510
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62d528
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62d540
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d558
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62d570
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d588
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d5a0
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62d5b8
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d5d0
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62d5e8
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62d600
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d618
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x62cb48
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d630
	[0070.629] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62d648
	[0070.629] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0070.630] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63dab8 | out: hHeap=0x5e0000) returned 1
	[0070.632] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0070.632] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x64dad8 | out: hHeap=0x5e0000) returned 1

Thread:
	id = 47
	os_tid = 0xb68


Thread:
	id = 49
	os_tid = 0xb74

	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6307e8
	[0071.097] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6307e8, Size=0x20) returned 0x6160f8
	[0071.097] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6160f8, Size=0x40) returned 0x617930
	[0071.097] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x617930, Size=0x80) returned 0x63bad0
	[0071.097] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63bad0, Size=0x100) returned 0x631700
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6307e8
	[0071.097] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6307e8, Size=0x20) returned 0x6160f8
	[0071.097] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6160f8, Size=0x40) returned 0x617930
	[0071.097] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x617930, Size=0x80) returned 0x63bad0
	[0071.097] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63bad0, Size=0x100) returned 0x631808
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x6307e8
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x62ce78
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6307b8
	[0071.097] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62ce78, Size=0x8) returned 0x62cea8
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x616778
	[0071.097] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62cea8, Size=0x10) returned 0x6307d0
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x18) returned 0x616798
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1a) returned 0x6160f8
	[0071.097] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6307d0, Size=0x20) returned 0x616120
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1c) returned 0x616148
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x16) returned 0x6167b8
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1a) returned 0x616170
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x6307d0
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x62cea8
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40) returned 0x617930
	[0071.097] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62cea8, Size=0x8) returned 0x62ce78
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x3c) returned 0x617978
	[0071.097] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62ce78, Size=0x10) returned 0x6307a0
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x6167d8
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x18) returned 0x6167f8
	[0071.097] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6307a0, Size=0x20) returned 0x616198
	[0071.097] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x24) returned 0x62ca38
	[0071.098] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0071.098] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x631700 | out: hHeap=0x5e0000) returned 1
	[0071.098] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0071.098] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x631808 | out: hHeap=0x5e0000) returned 1
	[0071.098] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x616238
	[0071.110] EnumServicesStatusExW (in: hSCManager=0x616238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x225ff44, lpServicesReturned=0x225ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x225ff44, lpServicesReturned=0x225ff5c, lpResumeHandle=0x0) returned 0
	[0071.111] GetLastError () returned 0xea
	[0071.111] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x11e4) returned 0x64eb18
	[0071.111] EnumServicesStatusExW (in: hSCManager=0x616238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64eb18, cbBufSize=0x11e4, pcbBytesNeeded=0x225ff44, lpServicesReturned=0x225ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64eb18, pcbBytesNeeded=0x225ff44, lpServicesReturned=0x225ff5c, lpResumeHandle=0x0) returned 1
	[0071.112] CloseServiceHandle (hSCObject=0x616238) returned 1
	[0071.112] lstrlenW (lpString="Appinfo") returned 7
	[0071.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0071.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0071.112] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0071.112] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0071.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0071.112] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0071.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0071.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0071.113] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0071.113] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0071.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0071.113] lstrlenW (lpString="AudioSrv") returned 8
	[0071.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0071.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0071.113] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0071.113] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0071.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0071.113] lstrlenW (lpString="BFE") returned 3
	[0071.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0071.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0071.113] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0071.113] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0071.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0071.113] lstrlenW (lpString="CryptSvc") returned 8
	[0071.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0071.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0071.113] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0071.113] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0071.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0071.113] lstrlenW (lpString="CscService") returned 10
	[0071.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0071.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0071.114] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0071.114] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0071.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0071.114] lstrlenW (lpString="DcomLaunch") returned 10
	[0071.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0071.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0071.114] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0071.114] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0071.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0071.114] lstrlenW (lpString="Dhcp") returned 4
	[0071.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0071.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0071.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0071.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0071.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0071.115] lstrlenW (lpString="Dnscache") returned 8
	[0071.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0071.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0071.115] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0071.115] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0071.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0071.115] lstrlenW (lpString="DPS") returned 3
	[0071.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0071.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0071.115] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0071.115] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0071.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0071.115] lstrlenW (lpString="eventlog") returned 8
	[0071.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0071.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0071.115] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0071.115] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0071.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0071.115] lstrlenW (lpString="EventSystem") returned 11
	[0071.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0071.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0071.115] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0071.116] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0071.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0071.116] lstrlenW (lpString="gpsvc") returned 5
	[0071.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0071.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0071.116] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0071.116] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0071.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0071.116] lstrlenW (lpString="iphlpsvc") returned 8
	[0071.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0071.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0071.116] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0071.116] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0071.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0071.116] lstrlenW (lpString="LanmanServer") returned 12
	[0071.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0071.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0071.116] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0071.116] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0071.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0071.116] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0071.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0071.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0071.116] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0071.116] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0071.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0071.116] lstrlenW (lpString="lmhosts") returned 7
	[0071.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0071.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0071.116] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0071.116] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0071.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0071.117] lstrlenW (lpString="MMCSS") returned 5
	[0071.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0071.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0071.117] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0071.117] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0071.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0071.117] lstrlenW (lpString="MpsSvc") returned 6
	[0071.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0071.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0071.117] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0071.117] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0071.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0071.117] lstrlenW (lpString="Netman") returned 6
	[0071.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0071.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0071.117] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0071.117] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0071.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0071.117] lstrlenW (lpString="netprofm") returned 8
	[0071.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0071.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0071.117] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0071.117] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0071.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0071.117] lstrlenW (lpString="NlaSvc") returned 6
	[0071.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0071.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0071.117] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0071.117] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0071.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0071.117] lstrlenW (lpString="nsi") returned 3
	[0071.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0071.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0071.118] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0071.118] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0071.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0071.118] lstrlenW (lpString="PcaSvc") returned 6
	[0071.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0071.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0071.118] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0071.118] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0071.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0071.118] lstrlenW (lpString="PlugPlay") returned 8
	[0071.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0071.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0071.118] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0071.118] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0071.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0071.118] lstrlenW (lpString="Power") returned 5
	[0071.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0071.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0071.118] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0071.118] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0071.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0071.118] lstrlenW (lpString="ProfSvc") returned 7
	[0071.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0071.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0071.118] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0071.118] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0071.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0071.118] lstrlenW (lpString="RpcEptMapper") returned 12
	[0071.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0071.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0071.118] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0071.118] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0071.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0071.119] lstrlenW (lpString="RpcSs") returned 5
	[0071.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0071.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0071.119] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0071.119] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0071.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0071.119] lstrlenW (lpString="SamSs") returned 5
	[0071.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0071.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0071.119] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0071.119] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0071.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0071.119] lstrlenW (lpString="Schedule") returned 8
	[0071.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0071.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0071.119] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0071.119] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0071.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0071.119] lstrlenW (lpString="SENS") returned 4
	[0071.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0071.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0071.119] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0071.119] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0071.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0071.119] lstrlenW (lpString="ShellHWDetection") returned 16
	[0071.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0071.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0071.119] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0071.119] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0071.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0071.119] lstrlenW (lpString="Spooler") returned 7
	[0071.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0071.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0071.120] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0071.120] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0071.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0071.120] lstrlenW (lpString="SysMain") returned 7
	[0071.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0071.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0071.120] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0071.120] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0071.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0071.120] lstrlenW (lpString="Themes") returned 6
	[0071.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0071.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0071.120] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0071.120] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0071.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0071.120] lstrlenW (lpString="TrkWks") returned 6
	[0071.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0071.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0071.120] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0071.120] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0071.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0071.120] lstrlenW (lpString="UxSms") returned 5
	[0071.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0071.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0071.120] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0071.120] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0071.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0071.120] lstrlenW (lpString="WdiServiceHost") returned 14
	[0071.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0071.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0071.120] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0071.121] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0071.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0071.121] lstrlenW (lpString="WdiSystemHost") returned 13
	[0071.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0071.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0071.121] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0071.121] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0071.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0071.121] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0071.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0071.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0071.121] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0071.121] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0071.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0071.121] lstrlenW (lpString="Winmgmt") returned 7
	[0071.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0071.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0071.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0071.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0071.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0071.121] lstrlenW (lpString="WPDBusEnum") returned 10
	[0071.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0071.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0071.121] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0071.121] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0071.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0071.121] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x64eb18 | out: hHeap=0x5e0000) returned 1
	[0071.121] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118
	[0071.124] Process32FirstW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0071.125] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0071.125] lstrlenW (lpString="System") returned 6
	[0071.125] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0071.125] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0071.126] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0071.126] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0071.126] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0071.126] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0071.126] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0071.126] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0071.126] lstrlenW (lpString="smss.exe") returned 8
	[0071.126] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0071.126] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0071.126] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0071.126] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0071.126] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0071.126] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0071.126] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0071.126] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0071.127] lstrlenW (lpString="csrss.exe") returned 9
	[0071.127] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0071.127] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0071.127] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0071.127] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0071.127] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0071.127] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0071.127] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0071.127] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0071.128] lstrlenW (lpString="wininit.exe") returned 11
	[0071.128] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0071.128] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0071.128] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0071.128] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0071.128] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0071.128] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0071.128] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0071.128] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0071.128] lstrlenW (lpString="csrss.exe") returned 9
	[0071.128] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0071.128] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0071.128] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0071.128] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0071.128] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0071.128] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0071.129] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0071.129] lstrlenW (lpString="winlogon.exe") returned 12
	[0071.129] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0071.130] lstrlenW (lpString="services.exe") returned 12
	[0071.130] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0071.130] lstrlenW (lpString="lsass.exe") returned 9
	[0071.130] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0071.131] lstrlenW (lpString="lsm.exe") returned 7
	[0071.131] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.131] lstrlenW (lpString="svchost.exe") returned 11
	[0071.131] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.132] lstrlenW (lpString="svchost.exe") returned 11
	[0071.132] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.132] lstrlenW (lpString="svchost.exe") returned 11
	[0071.132] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.133] lstrlenW (lpString="svchost.exe") returned 11
	[0071.133] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.133] lstrlenW (lpString="svchost.exe") returned 11
	[0071.133] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0071.133] lstrlenW (lpString="audiodg.exe") returned 11
	[0071.134] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.134] lstrlenW (lpString="svchost.exe") returned 11
	[0071.134] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.134] lstrlenW (lpString="svchost.exe") returned 11
	[0071.135] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0071.135] lstrlenW (lpString="dwm.exe") returned 7
	[0071.135] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0071.135] lstrlenW (lpString="explorer.exe") returned 12
	[0071.135] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0071.136] lstrlenW (lpString="spoolsv.exe") returned 11
	[0071.136] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0071.137] lstrlenW (lpString="taskhost.exe") returned 12
	[0071.137] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.137] lstrlenW (lpString="svchost.exe") returned 11
	[0071.137] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0071.138] lstrlenW (lpString="taskeng.exe") returned 11
	[0071.138] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thomas_military.exe")) returned 1
	[0071.138] lstrlenW (lpString="thomas_military.exe") returned 19
	[0071.138] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos_nuke.exe")) returned 1
	[0071.139] lstrlenW (lpString="logos_nuke.exe") returned 14
	[0071.139] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wake-automatic-wal.exe")) returned 1
	[0071.139] lstrlenW (lpString="wake-automatic-wal.exe") returned 22
	[0071.139] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="multiple.exe")) returned 1
	[0071.140] lstrlenW (lpString="multiple.exe") returned 12
	[0071.140] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flights-being-fridge.exe")) returned 1
	[0071.140] lstrlenW (lpString="flights-being-fridge.exe") returned 24
	[0071.140] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ste.exe")) returned 1
	[0071.141] lstrlenW (lpString="ste.exe") returned 7
	[0071.141] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied.exe")) returned 1
	[0072.913] lstrlenW (lpString="copied.exe") returned 10
	[0072.913] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="borough_pubs_der.exe")) returned 1
	[0072.914] lstrlenW (lpString="borough_pubs_der.exe") returned 20
	[0072.914] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wifi-cargo-fantastic.exe")) returned 1
	[0073.098] lstrlenW (lpString="wifi-cargo-fantastic.exe") returned 24
	[0073.098] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="corn possibly expert.exe")) returned 1
	[0073.099] lstrlenW (lpString="corn possibly expert.exe") returned 24
	[0073.099] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tennessee_scheme.exe")) returned 1
	[0073.099] lstrlenW (lpString="tennessee_scheme.exe") returned 20
	[0073.100] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="department.exe")) returned 1
	[0073.100] lstrlenW (lpString="department.exe") returned 14
	[0073.100] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="measure.exe")) returned 1
	[0073.101] lstrlenW (lpString="measure.exe") returned 11
	[0073.101] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="investigated_gratis_serious.exe")) returned 1
	[0073.101] lstrlenW (lpString="investigated_gratis_serious.exe") returned 31
	[0073.101] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="refined.exe")) returned 1
	[0073.102] lstrlenW (lpString="refined.exe") returned 11
	[0073.102] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logic-globe.exe")) returned 1
	[0073.102] lstrlenW (lpString="logic-globe.exe") returned 15
	[0073.102] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="butterfly-updated-boards.exe")) returned 1
	[0073.103] lstrlenW (lpString="butterfly-updated-boards.exe") returned 28
	[0073.103] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marvel steps judgment.exe")) returned 1
	[0073.103] lstrlenW (lpString="marvel steps judgment.exe") returned 25
	[0073.103] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="direct-prospect-severe.exe")) returned 1
	[0073.104] lstrlenW (lpString="direct-prospect-severe.exe") returned 26
	[0073.104] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friendly.exe")) returned 1
	[0073.104] lstrlenW (lpString="friendly.exe") returned 12
	[0073.104] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="magnitude-manually-psi.exe")) returned 1
	[0073.105] lstrlenW (lpString="magnitude-manually-psi.exe") returned 26
	[0073.105] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="messenger herbs.exe")) returned 1
	[0073.105] lstrlenW (lpString="messenger herbs.exe") returned 19
	[0073.105] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0073.106] lstrlenW (lpString="taskhost.exe") returned 12
	[0073.106] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0073.106] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0073.106] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1
	[0073.108] lstrlenW (lpString="powershell.exe") returned 14
	[0073.108] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0073.108] lstrlenW (lpString="conhost.exe") returned 11
	[0073.108] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xae8, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1
	[0073.109] lstrlenW (lpString="winhost.exe") returned 11
	[0073.109] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb60, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0073.110] lstrlenW (lpString="cmd.exe") returned 7
	[0073.110] Process32NextW (in: hSnapshot=0x118, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb60, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0
	[0073.110] CloseHandle (hObject=0x118) returned 1
	[0073.110] Sleep (dwMilliseconds=0x1f4) 
	[0074.688] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6338b8
	[0074.689] EnumServicesStatusExW (in: hSCManager=0x6338b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x225ff44, lpServicesReturned=0x225ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x225ff44, lpServicesReturned=0x225ff5c, lpResumeHandle=0x0) returned 0
	[0074.690] GetLastError () returned 0xea
	[0074.690] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x11e4) returned 0x38428c8
	[0074.690] EnumServicesStatusExW (in: hSCManager=0x6338b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38428c8, cbBufSize=0x11e4, pcbBytesNeeded=0x225ff44, lpServicesReturned=0x225ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38428c8, pcbBytesNeeded=0x225ff44, lpServicesReturned=0x225ff5c, lpResumeHandle=0x0) returned 1
	[0074.691] CloseServiceHandle (hSCObject=0x6338b8) returned 1
	[0074.691] lstrlenW (lpString="Appinfo") returned 7
	[0074.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0074.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0074.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0074.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0074.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0074.691] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0074.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0074.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0074.691] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0074.692] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0074.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0074.692] lstrlenW (lpString="AudioSrv") returned 8
	[0074.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0074.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0074.692] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0074.692] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0074.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0074.692] lstrlenW (lpString="BFE") returned 3
	[0074.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0074.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0074.692] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0074.692] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0074.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0074.692] lstrlenW (lpString="CryptSvc") returned 8
	[0074.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0074.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0074.692] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0074.692] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0074.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0074.692] lstrlenW (lpString="CscService") returned 10
	[0074.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0074.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0074.692] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0074.692] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0074.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0074.692] lstrlenW (lpString="DcomLaunch") returned 10
	[0074.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0074.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0074.692] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0074.692] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0074.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0074.693] lstrlenW (lpString="Dhcp") returned 4
	[0074.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0074.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0074.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0074.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0074.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0074.693] lstrlenW (lpString="Dnscache") returned 8
	[0074.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0074.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0074.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0074.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0074.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0074.693] lstrlenW (lpString="DPS") returned 3
	[0074.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0074.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0074.693] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0074.693] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0074.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0074.693] lstrlenW (lpString="eventlog") returned 8
	[0074.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0074.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0074.693] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0074.693] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0074.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0074.693] lstrlenW (lpString="EventSystem") returned 11
	[0074.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0074.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0074.693] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0074.693] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0074.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0074.693] lstrlenW (lpString="gpsvc") returned 5
	[0074.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0074.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0074.694] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0074.694] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0074.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0074.694] lstrlenW (lpString="iphlpsvc") returned 8
	[0074.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0074.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0074.694] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0074.694] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0074.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0074.694] lstrlenW (lpString="LanmanServer") returned 12
	[0074.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0074.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0074.694] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0074.694] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0074.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0074.694] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0074.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0074.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0074.694] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0074.694] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0074.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0074.694] lstrlenW (lpString="lmhosts") returned 7
	[0074.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0074.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0074.694] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0074.694] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0074.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0074.694] lstrlenW (lpString="MMCSS") returned 5
	[0074.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0074.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0074.694] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0074.694] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0074.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0074.695] lstrlenW (lpString="MpsSvc") returned 6
	[0074.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0074.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0074.695] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0074.695] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0074.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0074.695] lstrlenW (lpString="Netman") returned 6
	[0074.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0074.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0074.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0074.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0074.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0074.695] lstrlenW (lpString="netprofm") returned 8
	[0074.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0074.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0074.695] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0074.695] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0074.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0074.695] lstrlenW (lpString="NlaSvc") returned 6
	[0074.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0074.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0074.695] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0074.695] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0074.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0074.695] lstrlenW (lpString="nsi") returned 3
	[0074.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0074.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0074.695] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0074.695] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0074.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0074.695] lstrlenW (lpString="PcaSvc") returned 6
	[0074.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0074.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0074.696] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0074.696] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0074.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0074.696] lstrlenW (lpString="PlugPlay") returned 8
	[0074.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0074.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0074.696] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0074.696] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0074.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0074.696] lstrlenW (lpString="Power") returned 5
	[0074.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0074.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0074.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0074.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0074.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0074.696] lstrlenW (lpString="ProfSvc") returned 7
	[0074.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0074.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0074.696] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0074.696] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0074.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0074.696] lstrlenW (lpString="RpcEptMapper") returned 12
	[0074.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0074.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0074.696] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0074.696] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0074.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0074.696] lstrlenW (lpString="RpcSs") returned 5
	[0074.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0074.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0074.696] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0074.696] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0074.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0074.697] lstrlenW (lpString="SamSs") returned 5
	[0074.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0074.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0074.697] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0074.697] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0074.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0074.697] lstrlenW (lpString="Schedule") returned 8
	[0074.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0074.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0074.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0074.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0074.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0074.697] lstrlenW (lpString="SENS") returned 4
	[0074.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0074.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0074.697] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0074.697] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0074.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0074.697] lstrlenW (lpString="ShellHWDetection") returned 16
	[0074.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0074.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0074.697] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0074.697] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0074.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0074.697] lstrlenW (lpString="Spooler") returned 7
	[0074.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0074.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0074.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0074.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0074.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0074.697] lstrlenW (lpString="SysMain") returned 7
	[0074.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0074.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0074.698] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0074.698] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0074.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0074.698] lstrlenW (lpString="Themes") returned 6
	[0074.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0074.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0074.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0074.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0074.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0074.709] lstrlenW (lpString="TrkWks") returned 6
	[0074.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0074.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0074.709] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0074.709] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0074.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0074.709] lstrlenW (lpString="UxSms") returned 5
	[0074.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0074.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0074.709] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0074.709] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0074.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0074.710] lstrlenW (lpString="WdiServiceHost") returned 14
	[0074.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0074.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0074.710] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0074.710] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0074.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0074.710] lstrlenW (lpString="WdiSystemHost") returned 13
	[0074.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0074.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0074.710] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0074.710] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0074.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0074.710] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0074.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0074.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0074.710] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0074.710] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0074.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0074.710] lstrlenW (lpString="Winmgmt") returned 7
	[0074.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0074.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0074.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0074.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0074.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0074.710] lstrlenW (lpString="WPDBusEnum") returned 10
	[0074.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0074.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0074.711] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0074.711] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0074.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0074.711] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x38428c8 | out: hHeap=0x5e0000) returned 1
	[0074.711] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x160
	[0074.713] Process32FirstW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0074.714] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0074.714] lstrlenW (lpString="System") returned 6
	[0074.714] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0074.714] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0074.714] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0074.715] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0074.715] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0074.715] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0074.715] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0074.715] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0074.715] lstrlenW (lpString="smss.exe") returned 8
	[0074.715] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0074.715] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0074.715] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0074.715] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0074.715] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0074.715] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0074.715] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0074.715] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0074.716] lstrlenW (lpString="csrss.exe") returned 9
	[0074.716] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0074.716] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0074.716] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0074.716] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0074.716] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0074.716] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0074.716] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0074.716] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0074.717] lstrlenW (lpString="wininit.exe") returned 11
	[0074.717] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0074.717] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0074.717] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0074.717] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0074.717] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0074.717] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0074.717] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0074.717] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0074.718] lstrlenW (lpString="csrss.exe") returned 9
	[0074.718] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0074.718] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0074.718] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0074.718] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0074.718] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0074.718] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0074.718] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0074.718] lstrlenW (lpString="winlogon.exe") returned 12
	[0074.718] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0074.719] lstrlenW (lpString="services.exe") returned 12
	[0074.719] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0074.719] lstrlenW (lpString="lsass.exe") returned 9
	[0074.720] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0074.720] lstrlenW (lpString="lsm.exe") returned 7
	[0074.720] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.721] lstrlenW (lpString="svchost.exe") returned 11
	[0074.721] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.721] lstrlenW (lpString="svchost.exe") returned 11
	[0074.721] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.741] lstrlenW (lpString="svchost.exe") returned 11
	[0074.741] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.742] lstrlenW (lpString="svchost.exe") returned 11
	[0074.742] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.742] lstrlenW (lpString="svchost.exe") returned 11
	[0074.742] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0074.743] lstrlenW (lpString="audiodg.exe") returned 11
	[0074.743] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.743] lstrlenW (lpString="svchost.exe") returned 11
	[0074.743] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.744] lstrlenW (lpString="svchost.exe") returned 11
	[0074.744] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0074.744] lstrlenW (lpString="dwm.exe") returned 7
	[0074.744] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0074.745] lstrlenW (lpString="explorer.exe") returned 12
	[0074.745] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0074.746] lstrlenW (lpString="spoolsv.exe") returned 11
	[0074.746] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0074.746] lstrlenW (lpString="taskhost.exe") returned 12
	[0074.746] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.747] lstrlenW (lpString="svchost.exe") returned 11
	[0074.747] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0074.747] lstrlenW (lpString="taskeng.exe") returned 11
	[0074.747] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thomas_military.exe")) returned 1
	[0074.748] lstrlenW (lpString="thomas_military.exe") returned 19
	[0074.748] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos_nuke.exe")) returned 1
	[0074.748] lstrlenW (lpString="logos_nuke.exe") returned 14
	[0074.748] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wake-automatic-wal.exe")) returned 1
	[0074.749] lstrlenW (lpString="wake-automatic-wal.exe") returned 22
	[0074.749] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="multiple.exe")) returned 1
	[0074.749] lstrlenW (lpString="multiple.exe") returned 12
	[0074.749] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flights-being-fridge.exe")) returned 1
	[0074.750] lstrlenW (lpString="flights-being-fridge.exe") returned 24
	[0074.750] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ste.exe")) returned 1
	[0074.750] lstrlenW (lpString="ste.exe") returned 7
	[0074.750] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied.exe")) returned 1
	[0074.751] lstrlenW (lpString="copied.exe") returned 10
	[0074.751] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="borough_pubs_der.exe")) returned 1
	[0074.752] lstrlenW (lpString="borough_pubs_der.exe") returned 20
	[0074.752] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wifi-cargo-fantastic.exe")) returned 1
	[0074.753] lstrlenW (lpString="wifi-cargo-fantastic.exe") returned 24
	[0074.753] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="corn possibly expert.exe")) returned 1
	[0074.753] lstrlenW (lpString="corn possibly expert.exe") returned 24
	[0074.753] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tennessee_scheme.exe")) returned 1
	[0074.754] lstrlenW (lpString="tennessee_scheme.exe") returned 20
	[0074.754] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="department.exe")) returned 1
	[0074.754] lstrlenW (lpString="department.exe") returned 14
	[0074.754] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="measure.exe")) returned 1
	[0074.755] lstrlenW (lpString="measure.exe") returned 11
	[0074.755] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="investigated_gratis_serious.exe")) returned 1
	[0074.755] lstrlenW (lpString="investigated_gratis_serious.exe") returned 31
	[0074.755] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="refined.exe")) returned 1
	[0074.756] lstrlenW (lpString="refined.exe") returned 11
	[0074.756] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logic-globe.exe")) returned 1
	[0074.757] lstrlenW (lpString="logic-globe.exe") returned 15
	[0074.757] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="butterfly-updated-boards.exe")) returned 1
	[0074.757] lstrlenW (lpString="butterfly-updated-boards.exe") returned 28
	[0074.758] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marvel steps judgment.exe")) returned 1
	[0074.758] lstrlenW (lpString="marvel steps judgment.exe") returned 25
	[0074.758] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="direct-prospect-severe.exe")) returned 1
	[0074.759] lstrlenW (lpString="direct-prospect-severe.exe") returned 26
	[0074.759] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friendly.exe")) returned 1
	[0074.759] lstrlenW (lpString="friendly.exe") returned 12
	[0074.759] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="magnitude-manually-psi.exe")) returned 1
	[0074.760] lstrlenW (lpString="magnitude-manually-psi.exe") returned 26
	[0074.760] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="messenger herbs.exe")) returned 1
	[0074.761] lstrlenW (lpString="messenger herbs.exe") returned 19
	[0074.761] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0074.761] lstrlenW (lpString="taskhost.exe") returned 12
	[0074.761] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0074.762] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0074.762] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1
	[0074.763] lstrlenW (lpString="powershell.exe") returned 14
	[0074.763] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0074.763] lstrlenW (lpString="conhost.exe") returned 11
	[0074.763] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xae8, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1
	[0074.764] lstrlenW (lpString="winhost.exe") returned 11
	[0074.764] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb60, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0074.765] lstrlenW (lpString="cmd.exe") returned 7
	[0074.765] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0074.765] lstrlenW (lpString="conhost.exe") returned 11
	[0074.766] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0074.766] lstrlenW (lpString="mode.com") returned 8
	[0074.766] Process32NextW (in: hSnapshot=0x160, lppe=0x225fd34 | out: lppe=0x225fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0074.767] CloseHandle (hObject=0x160) returned 1
	[0074.767] Sleep (dwMilliseconds=0x1f4) 
	[0075.448] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) 

Thread:
	id = 50
	os_tid = 0xb78

	[0072.714] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff
	[0072.715] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615118 | out: hHeap=0x5e0000) returned 1

Thread:
	id = 51
	os_tid = 0xb7c

	[0072.720] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x615118
	[0072.720] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615118, Size=0x20) returned 0x616288
	[0072.720] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616288, Size=0x40) returned 0x6179c0
	[0072.720] GetLogicalDrives () returned 0x4
	[0072.721] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x64eb18
	[0072.721] GetComputerNameW (in: lpBuffer=0x64eb1c, nSize=0x245ff6c | out: lpBuffer="XDUWTFONO", nSize=0x245ff6c) returned 1
	[0072.722] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1000) returned 0x65eb20
	[0072.722] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x245ff3c | out: lphEnum=0x245ff3c*=0x616818) returned 0x0
	[0072.723] WNetEnumResourceW (in: hEnum=0x616818, lpcCount=0x245ff38, lpBuffer=0x65eb20, lpBufferSize=0x245ff40 | out: lpcCount=0x245ff38, lpBuffer=0x65eb20, lpBufferSize=0x245ff40) returned 0x103
	[0072.724] WNetCloseEnum (hEnum=0x616818) returned 0x0
	[0072.724] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x245ff3c | out: lphEnum=0x245ff3c*=0x3841790) returned 0x0
	[0075.720] WNetEnumResourceW (in: hEnum=0x3841790, lpcCount=0x245ff38, lpBuffer=0x65eb20, lpBufferSize=0x245ff40 | out: lpcCount=0x245ff38, lpBuffer=0x65eb20, lpBufferSize=0x245ff40) returned 0x0
	[0075.721] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1000) returned 0x3847708
	[0075.721] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x65eb20, lphEnum=0x245ff10) 

Thread:
	id = 52
	os_tid = 0xb80

	[0072.726] GetTickCount () returned 0x114894c
	[0072.732] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x24) returned 0x63b9b0
	[0072.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x63b9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120
	[0072.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x63b9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124
	[0072.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x63b9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130
	[0072.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x63b9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138
	[0072.766] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630848
	[0072.766] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630848, Size=0x20) returned 0x616238
	[0072.766] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630848
	[0072.766] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630848, Size=0x20) returned 0x6161c0
	[0072.907] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0073.186] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0073.186] Wow64DisableWow64FsRedirection (in: OldValue=0x255ff84 | out: OldValue=0x255ff84*=0x0) returned 1
	[0073.186] lstrlenW (lpString="kernel32.dll") returned 12
	[0073.186] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x616238 | out: hHeap=0x5e0000) returned 1
	[0073.186] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0073.186] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6161c0 | out: hHeap=0x5e0000) returned 1
	[0073.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x61baa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140
	[0073.187] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0073.725] GetTickCount () returned 0x1148a75
	[0073.725] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0074.276] GetTickCount () returned 0x1148b7e
	[0074.276] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0074.740] GetTickCount () returned 0x1148cb6
	[0074.740] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0074.881] GetTickCount () returned 0x1148d42
	[0074.881] GetTickCount () returned 0x1148d42
	[0074.881] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0075.172] GetTickCount () returned 0x1148dee
	[0075.172] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0075.363] GetTickCount () returned 0x1148e99
	[0075.363] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0075.495] GetTickCount () returned 0x1148f26
	[0075.495] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0075.643] GetTickCount () returned 0x1148f93
	[0075.643] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0075.801] GetTickCount () returned 0x1149000
	[0075.801] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0075.968] GetTickCount () returned 0x11490ac
	[0075.968] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0076.146] GetTickCount () returned 0x1149148
	[0076.146] GetTickCount () returned 0x1149148
	[0076.146] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0076.336] GetTickCount () returned 0x1149213
	[0076.336] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0076.519] GetTickCount () returned 0x11492be
	[0076.519] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0076.734] GetTickCount () returned 0x1149399
	[0076.734] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0076.867] GetTickCount () returned 0x1149425
	[0076.867] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0077.135] GetTickCount () returned 0x114952e
	[0077.135] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0077.350] GetTickCount () returned 0x11495f9
	[0077.351] GetTickCount () returned 0x11495f9
	[0077.351] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0077.667] GetTickCount () returned 0x11496e3
	[0077.667] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0077.990] GetTickCount () returned 0x11497ec
	[0077.990] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0078.200] GetTickCount () returned 0x1149879
	[0078.201] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0078.365] GetTickCount () returned 0x1149924
	[0078.365] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0078.552] GetTickCount () returned 0x11499e0
	[0078.552] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0078.769] GetTickCount () returned 0x1149a5c
	[0078.769] GetTickCount () returned 0x1149a5c
	[0078.769] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0078.892] GetTickCount () returned 0x1149ad9
	[0078.892] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0079.054] GetTickCount () returned 0x1149b85
	[0079.054] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0079.238] GetTickCount () returned 0x1149c40
	[0079.238] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0079.488] GetTickCount () returned 0x1149cfb
	[0079.488] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0079.643] GetTickCount () returned 0x1149d97
	[0079.643] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0079.815] GetTickCount () returned 0x1149e43
	[0079.815] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0080.001] GetTickCount () returned 0x1149eb0
	[0080.001] GetTickCount () returned 0x1149eb0
	[0080.002] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0080.142] GetTickCount () returned 0x1149f4c
	[0080.142] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0080.330] GetTickCount () returned 0x114a007
	[0080.330] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0080.501] GetTickCount () returned 0x114a0b3
	[0080.501] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0080.744] GetTickCount () returned 0x114a15e
	[0080.744] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0080.907] GetTickCount () returned 0x114a20a
	[0080.907] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0081.081] GetTickCount () returned 0x114a2b6
	[0081.081] GetTickCount () returned 0x114a2b6
	[0081.081] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0081.205] GetTickCount () returned 0x114a332
	[0081.205] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0081.347] GetTickCount () returned 0x114a3bf
	[0081.347] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0081.455] GetTickCount () returned 0x114a42c
	[0081.455] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0081.578] GetTickCount () returned 0x114a4a9
	[0081.578] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0081.717] GetTickCount () returned 0x114a526
	[0081.717] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0081.832] GetTickCount () returned 0x114a5a2
	[0081.832] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0081.954] GetTickCount () returned 0x114a61f
	[0081.954] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0082.062] GetTickCount () returned 0x114a68c
	[0082.062] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0082.173] GetTickCount () returned 0x114a6fa
	[0082.173] GetTickCount () returned 0x114a6fa
	[0082.173] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0082.287] GetTickCount () returned 0x114a767
	[0082.288] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0082.416] GetTickCount () returned 0x114a7e4
	[0082.416] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0082.538] GetTickCount () returned 0x114a860
	[0082.538] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0082.670] GetTickCount () returned 0x114a8ed
	[0082.670] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0082.779] GetTickCount () returned 0x114a95a
	[0082.779] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0082.895] GetTickCount () returned 0x114a9c7
	[0082.895] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0083.004] GetTickCount () returned 0x114aa34
	[0083.004] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0083.130] GetTickCount () returned 0x114aab1
	[0083.130] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0083.236] GetTickCount () returned 0x114ab1e
	[0083.236] GetTickCount () returned 0x114ab1e
	[0083.236] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0083.344] GetTickCount () returned 0x114ab8c
	[0083.344] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0083.466] GetTickCount () returned 0x114ac08
	[0083.466] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0083.627] GetTickCount () returned 0x114aca4
	[0083.628] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0083.793] GetTickCount () returned 0x114ad50
	[0083.793] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0083.905] GetTickCount () returned 0x114adbd
	[0083.905] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0084.027] GetTickCount () returned 0x114ae3a
	[0084.028] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0084.140] GetTickCount () returned 0x114aea7
	[0084.140] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0084.280] GetTickCount () returned 0x114af34
	[0084.280] GetTickCount () returned 0x114af34
	[0084.280] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0084.448] GetTickCount () returned 0x114afd0
	[0084.448] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0084.578] GetTickCount () returned 0x114b05c
	[0084.578] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0084.683] GetTickCount () returned 0x114b0c9
	[0084.683] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0084.795] GetTickCount () returned 0x114b136
	[0084.795] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0084.934] GetTickCount () returned 0x114b1c3
	[0084.934] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0085.073] GetTickCount () returned 0x114b24f
	[0085.073] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0085.214] GetTickCount () returned 0x114b2dc
	[0085.214] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0085.324] GetTickCount () returned 0x114b349
	[0085.324] GetTickCount () returned 0x114b349
	[0085.324] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0085.449] GetTickCount () returned 0x114b3c6
	[0085.449] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0085.569] GetTickCount () returned 0x114b433
	[0085.569] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0085.699] GetTickCount () returned 0x114b4bf
	[0085.699] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0085.806] GetTickCount () returned 0x114b52c
	[0085.806] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0085.923] GetTickCount () returned 0x114b59a
	[0085.923] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0086.035] GetTickCount () returned 0x114b607
	[0086.035] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0086.192] GetTickCount () returned 0x114b6a3
	[0086.192] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0086.290] GetTickCount () returned 0x114b710
	[0086.290] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0086.431] GetTickCount () returned 0x114b79c
	[0086.431] GetTickCount () returned 0x114b79c
	[0086.431] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0086.539] GetTickCount () returned 0x114b80a
	[0086.539] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0086.654] GetTickCount () returned 0x114b877
	[0086.654] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0086.762] GetTickCount () returned 0x114b8e4
	[0086.762] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0086.883] GetTickCount () returned 0x114b961
	[0086.883] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0086.994] GetTickCount () returned 0x114b9ce
	[0086.994] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0087.110] GetTickCount () returned 0x114ba3b
	[0087.110] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0087.211] GetTickCount () returned 0x114baa8
	[0087.211] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0087.324] GetTickCount () returned 0x114bb16
	[0087.324] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0087.477] GetTickCount () returned 0x114bbb2
	[0087.477] GetTickCount () returned 0x114bbb2
	[0087.477] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0087.586] GetTickCount () returned 0x114bc1f
	[0087.586] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0087.697] GetTickCount () returned 0x114bc8c
	[0087.697] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0087.810] GetTickCount () returned 0x114bcf9
	[0087.810] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0087.921] GetTickCount () returned 0x114bd66
	[0087.921] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0088.025] GetTickCount () returned 0x114bdd4
	[0088.025] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0088.132] GetTickCount () returned 0x114be41
	[0088.132] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0088.256] GetTickCount () returned 0x114bebe
	[0088.256] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0088.365] GetTickCount () returned 0x114bf2b
	[0088.366] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0088.480] GetTickCount () returned 0x114bf98
	[0088.480] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0088.601] GetTickCount () returned 0x114c015
	[0088.601] GetTickCount () returned 0x114c015
	[0088.601] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0088.709] GetTickCount () returned 0x114c082
	[0088.710] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0088.822] GetTickCount () returned 0x114c0ef
	[0088.822] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0088.926] GetTickCount () returned 0x114c15c
	[0088.926] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0089.061] GetTickCount () returned 0x114c1d9
	[0089.061] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0089.179] GetTickCount () returned 0x114c256
	[0089.179] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0089.303] GetTickCount () returned 0x114c2d3
	[0089.304] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0089.423] GetTickCount () returned 0x114c340
	[0089.423] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0089.528] GetTickCount () returned 0x114c3ad
	[0089.528] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0089.681] GetTickCount () returned 0x114c449
	[0089.681] GetTickCount () returned 0x114c449
	[0089.681] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0089.839] GetTickCount () returned 0x114c4e5
	[0089.839] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0089.959] GetTickCount () returned 0x114c562
	[0089.959] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0090.067] GetTickCount () returned 0x114c5cf
	[0090.067] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0090.196] GetTickCount () returned 0x114c64c
	[0090.196] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0090.303] GetTickCount () returned 0x114c6b9
	[0090.303] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0090.418] GetTickCount () returned 0x114c726
	[0090.419] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0090.527] GetTickCount () returned 0x114c794
	[0090.527] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0090.633] GetTickCount () returned 0x114c801
	[0090.634] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0090.736] GetTickCount () returned 0x114c86e
	[0090.737] GetTickCount () returned 0x114c86e
	[0090.737] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0090.922] GetTickCount () returned 0x114c91a
	[0090.922] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0091.016] GetTickCount () returned 0x114c987
	[0091.016] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0091.126] GetTickCount () returned 0x114c9f4
	[0091.126] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0091.237] GetTickCount () returned 0x114ca61
	[0091.237] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0091.344] GetTickCount () returned 0x114cace
	[0091.344] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0091.595] GetTickCount () returned 0x114cbc8
	[0091.595] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0091.704] GetTickCount () returned 0x114cc35
	[0091.704] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0091.813] GetTickCount () returned 0x114cca2
	[0091.813] GetTickCount () returned 0x114cca2
	[0091.813] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0091.921] GetTickCount () returned 0x114cd10
	[0091.921] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0092.031] GetTickCount () returned 0x114cd7d
	[0092.031] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0092.146] GetTickCount () returned 0x114cdea
	[0092.146] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0092.257] GetTickCount () returned 0x114ce57
	[0092.257] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0092.358] GetTickCount () returned 0x114cec4
	[0092.358] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0092.467] GetTickCount () returned 0x114cf32
	[0092.467] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0092.612] GetTickCount () returned 0x114cfbe
	[0092.612] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0092.718] GetTickCount () returned 0x114d02b
	[0092.718] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0092.867] GetTickCount () returned 0x114d0b8
	[0092.867] GetTickCount () returned 0x114d0b8
	[0092.867] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0093.014] GetTickCount () returned 0x114d154
	[0093.014] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0093.128] GetTickCount () returned 0x114d1c1
	[0093.128] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0093.231] GetTickCount () returned 0x114d22e
	[0093.231] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0093.356] GetTickCount () returned 0x114d2ab
	[0093.356] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0093.475] GetTickCount () returned 0x114d318
	[0093.475] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0093.596] GetTickCount () returned 0x114d395
	[0093.596] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0093.701] GetTickCount () returned 0x114d402
	[0093.701] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0093.864] GetTickCount () returned 0x114d49e
	[0093.865] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0094.030] GetTickCount () returned 0x114d54a
	[0094.030] GetTickCount () returned 0x114d54a
	[0094.030] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0094.182] GetTickCount () returned 0x114d5e6
	[0094.182] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0094.299] GetTickCount () returned 0x114d653
	[0094.299] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0094.409] GetTickCount () returned 0x114d6c0
	[0094.409] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0094.512] GetTickCount () returned 0x114d72d
	[0094.512] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0094.625] GetTickCount () returned 0x114d79a
	[0094.625] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0094.730] GetTickCount () returned 0x114d808
	[0094.730] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0094.880] GetTickCount () returned 0x114d894
	[0094.880] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0094.986] GetTickCount () returned 0x114d901
	[0094.986] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0095.124] GetTickCount () returned 0x114d98e
	[0095.124] GetTickCount () returned 0x114d98e
	[0095.124] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0095.251] GetTickCount () returned 0x114da0a
	[0095.251] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0095.367] GetTickCount () returned 0x114da78
	[0095.367] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0095.471] GetTickCount () returned 0x114dae5
	[0095.471] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0095.593] GetTickCount () returned 0x114db62
	[0095.593] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0095.713] GetTickCount () returned 0x114dbcf
	[0095.713] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0095.822] GetTickCount () returned 0x114dc3c
	[0095.822] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0095.933] GetTickCount () returned 0x114dca9
	[0095.933] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0096.053] GetTickCount () returned 0x114dd16
	[0096.053] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0096.166] GetTickCount () returned 0x114dd93
	[0096.166] GetTickCount () returned 0x114dd93
	[0096.166] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0096.273] GetTickCount () returned 0x114de00
	[0096.273] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0096.394] GetTickCount () returned 0x114de6e
	[0096.394] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0096.542] GetTickCount () returned 0x114df0a
	[0096.542] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0096.651] GetTickCount () returned 0x114df77
	[0096.651] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0096.756] GetTickCount () returned 0x114dfe4
	[0096.756] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0096.905] GetTickCount () returned 0x114e070
	[0096.905] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0097.006] GetTickCount () returned 0x114e0de
	[0097.006] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0097.127] GetTickCount () returned 0x114e14b
	[0097.127] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0097.250] GetTickCount () returned 0x114e1c8
	[0097.250] GetTickCount () returned 0x114e1c8
	[0097.250] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0097.364] GetTickCount () returned 0x114e235
	[0097.364] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0097.462] GetTickCount () returned 0x114e2a2
	[0097.462] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0097.604] GetTickCount () returned 0x114e32e
	[0097.604] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0097.761] GetTickCount () returned 0x114e3bb
	[0097.761] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0097.865] GetTickCount () returned 0x114e428
	[0097.865] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0097.977] GetTickCount () returned 0x114e495
	[0097.977] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0098.100] GetTickCount () returned 0x114e512
	[0098.100] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0098.211] GetTickCount () returned 0x114e57f
	[0098.211] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0098.325] GetTickCount () returned 0x114e5ec
	[0098.325] GetTickCount () returned 0x114e5ec
	[0098.325] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0098.430] GetTickCount () returned 0x114e65a
	[0098.430] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0098.566] GetTickCount () returned 0x114e6e6
	[0098.566] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0098.707] GetTickCount () returned 0x114e772
	[0098.707] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0098.818] GetTickCount () returned 0x114e7e0
	[0098.818] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0098.927] GetTickCount () returned 0x114e84d
	[0098.927] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0099.038] GetTickCount () returned 0x114e8ba
	[0099.038] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0099.160] GetTickCount () returned 0x114e937
	[0099.160] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0099.284] GetTickCount () returned 0x114e9b4
	[0099.284] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0099.404] GetTickCount () returned 0x114ea21
	[0099.405] GetTickCount () returned 0x114ea21
	[0099.405] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0099.516] GetTickCount () returned 0x114ea8e
	[0099.516] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0099.620] GetTickCount () returned 0x114eafb
	[0099.620] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0099.747] GetTickCount () returned 0x114eb78
	[0099.747] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0099.846] GetTickCount () returned 0x114ebe5
	[0099.846] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0099.969] GetTickCount () returned 0x114ec52
	[0099.970] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0100.082] GetTickCount () returned 0x114eccf
	[0100.082] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0100.190] GetTickCount () returned 0x114ed3c
	[0100.190] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0100.331] GetTickCount () returned 0x114edb9
	[0100.331] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0100.482] GetTickCount () returned 0x114ee46
	[0100.482] GetTickCount () returned 0x114ee46
	[0100.482] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0100.590] GetTickCount () returned 0x114eeb3
	[0100.590] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0100.708] GetTickCount () returned 0x114ef20
	[0100.708] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0100.820] GetTickCount () returned 0x114ef8d
	[0100.820] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0100.950] GetTickCount () returned 0x114f00a
	[0100.950] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0101.055] GetTickCount () returned 0x114f077
	[0101.055] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0101.168] GetTickCount () returned 0x114f0e4
	[0101.168] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0101.315] GetTickCount () returned 0x114f180
	[0101.315] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0101.471] GetTickCount () returned 0x114f21c
	[0101.471] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0101.586] GetTickCount () returned 0x114f28a
	[0101.586] GetTickCount () returned 0x114f28a
	[0101.586] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0101.687] GetTickCount () returned 0x114f2f7
	[0101.687] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0101.796] GetTickCount () returned 0x114f364
	[0101.796] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0101.913] GetTickCount () returned 0x114f3d1
	[0101.913] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0102.014] GetTickCount () returned 0x114f43e
	[0102.014] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0102.123] GetTickCount () returned 0x114f4ac
	[0102.123] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0102.233] GetTickCount () returned 0x114f519
	[0102.233] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0102.342] GetTickCount () returned 0x114f586
	[0102.342] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0102.451] GetTickCount () returned 0x114f5f3
	[0102.451] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0102.562] GetTickCount () returned 0x114f660
	[0102.562] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0102.669] GetTickCount () returned 0x114f6ce
	[0102.669] GetTickCount () returned 0x114f6ce
	[0102.669] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0102.780] GetTickCount () returned 0x114f73b
	[0102.780] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0102.888] GetTickCount () returned 0x114f7a8
	[0102.888] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0102.997] GetTickCount () returned 0x114f815
	[0102.997] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0103.112] GetTickCount () returned 0x114f882
	[0103.112] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0103.222] GetTickCount () returned 0x114f8f0
	[0103.222] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0103.333] GetTickCount () returned 0x114f95d
	[0103.333] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0103.450] GetTickCount () returned 0x114f9da
	[0103.450] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0103.566] GetTickCount () returned 0x114fa47
	[0103.566] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0103.689] GetTickCount () returned 0x114fac4
	[0103.689] GetTickCount () returned 0x114fac4
	[0103.689] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0103.795] GetTickCount () returned 0x114fb31
	[0103.795] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0103.937] GetTickCount () returned 0x114fbae
	[0103.937] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0104.056] GetTickCount () returned 0x114fc1b
	[0104.056] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0104.182] GetTickCount () returned 0x114fca7
	[0104.182] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0104.300] GetTickCount () returned 0x114fd14
	[0104.300] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0104.403] GetTickCount () returned 0x114fd82
	[0104.403] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0104.521] GetTickCount () returned 0x114fdef
	[0104.521] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0104.640] GetTickCount () returned 0x114fe6c
	[0104.640] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0104.751] GetTickCount () returned 0x114fed9
	[0104.751] GetTickCount () returned 0x114fed9
	[0104.751] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0104.896] GetTickCount () returned 0x114ff65
	[0104.896] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0105.040] GetTickCount () returned 0x1150001
	[0105.040] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0105.153] GetTickCount () returned 0x115006e
	[0105.153] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0105.302] GetTickCount () returned 0x11500fb
	[0105.302] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0105.423] GetTickCount () returned 0x1150178
	[0105.424] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0105.524] GetTickCount () returned 0x11501e5
	[0105.524] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102
	[0105.659] GetTickCount () returned 0x1150262
	[0105.659] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) 

Thread:
	id = 53
	os_tid = 0xb84

	[0072.733] GetTickCount () returned 0x114895c
	[0072.733] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x24) returned 0x62c5d8
	[0072.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62c5d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c
	[0072.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62c5d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128
	[0072.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62c5d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134
	[0072.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62c5d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c
	[0072.908] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630848
	[0072.908] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630848, Size=0x20) returned 0x6162b0
	[0072.908] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630848
	[0072.908] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630848, Size=0x20) returned 0x6162d8
	[0072.908] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0073.168] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0073.168] Wow64DisableWow64FsRedirection (in: OldValue=0x265ff84 | out: OldValue=0x265ff84*=0x0) returned 1
	[0073.168] lstrlenW (lpString="kernel32.dll") returned 12
	[0073.168] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162b0 | out: hHeap=0x5e0000) returned 1
	[0073.168] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0073.168] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162d8 | out: hHeap=0x5e0000) returned 1
	[0073.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x63dab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c
	[0073.171] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0073.723] GetTickCount () returned 0x1148a75
	[0073.723] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0074.244] GetTickCount () returned 0x1148b5f
	[0074.245] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0074.740] GetTickCount () returned 0x1148cb6
	[0074.740] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0074.881] GetTickCount () returned 0x1148d42
	[0074.881] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0075.171] GetTickCount () returned 0x1148dee
	[0075.171] GetTickCount () returned 0x1148dee
	[0075.171] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0075.363] GetTickCount () returned 0x1148e99
	[0075.363] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0075.495] GetTickCount () returned 0x1148f26
	[0075.495] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0075.642] GetTickCount () returned 0x1148f93
	[0075.642] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0075.801] GetTickCount () returned 0x1149000
	[0075.801] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0075.968] GetTickCount () returned 0x11490ac
	[0075.968] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0076.146] GetTickCount () returned 0x1149148
	[0076.146] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0076.336] GetTickCount () returned 0x1149213
	[0076.336] GetTickCount () returned 0x1149213
	[0076.336] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0076.518] GetTickCount () returned 0x11492be
	[0076.518] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0076.734] GetTickCount () returned 0x1149399
	[0076.734] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0076.867] GetTickCount () returned 0x1149425
	[0076.867] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0077.135] GetTickCount () returned 0x114952e
	[0077.135] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0077.350] GetTickCount () returned 0x11495f9
	[0077.350] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0077.666] GetTickCount () returned 0x11496e3
	[0077.666] GetTickCount () returned 0x11496e3
	[0077.667] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0077.990] GetTickCount () returned 0x11497ec
	[0077.990] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0078.200] GetTickCount () returned 0x1149879
	[0078.200] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0078.365] GetTickCount () returned 0x1149924
	[0078.365] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0078.552] GetTickCount () returned 0x11499e0
	[0078.552] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0078.769] GetTickCount () returned 0x1149a5c
	[0078.769] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0078.892] GetTickCount () returned 0x1149ad9
	[0078.892] GetTickCount () returned 0x1149ad9
	[0078.892] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0079.054] GetTickCount () returned 0x1149b85
	[0079.054] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0079.238] GetTickCount () returned 0x1149c40
	[0079.238] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0079.487] GetTickCount () returned 0x1149cfb
	[0079.487] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0079.643] GetTickCount () returned 0x1149d97
	[0079.643] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0079.815] GetTickCount () returned 0x1149e43
	[0079.815] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0080.001] GetTickCount () returned 0x1149eb0
	[0080.001] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0080.142] GetTickCount () returned 0x1149f4c
	[0080.142] GetTickCount () returned 0x1149f4c
	[0080.142] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0080.330] GetTickCount () returned 0x114a007
	[0080.330] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0080.501] GetTickCount () returned 0x114a0b3
	[0080.501] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0080.744] GetTickCount () returned 0x114a15e
	[0080.744] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0080.906] GetTickCount () returned 0x114a1fa
	[0080.906] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0081.081] GetTickCount () returned 0x114a2b6
	[0081.081] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0081.205] GetTickCount () returned 0x114a332
	[0081.205] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0081.346] GetTickCount () returned 0x114a3bf
	[0081.346] GetTickCount () returned 0x114a3bf
	[0081.347] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0081.455] GetTickCount () returned 0x114a42c
	[0081.455] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0081.578] GetTickCount () returned 0x114a4a9
	[0081.578] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0081.717] GetTickCount () returned 0x114a526
	[0081.717] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0081.832] GetTickCount () returned 0x114a5a2
	[0081.832] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0081.954] GetTickCount () returned 0x114a61f
	[0081.954] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0082.062] GetTickCount () returned 0x114a68c
	[0082.062] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0082.173] GetTickCount () returned 0x114a6fa
	[0082.173] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0082.287] GetTickCount () returned 0x114a767
	[0082.287] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0082.416] GetTickCount () returned 0x114a7e4
	[0082.416] GetTickCount () returned 0x114a7e4
	[0082.416] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0082.538] GetTickCount () returned 0x114a860
	[0082.538] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0082.668] GetTickCount () returned 0x114a8dd
	[0082.668] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0082.776] GetTickCount () returned 0x114a94a
	[0082.776] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0082.883] GetTickCount () returned 0x114a9b8
	[0082.883] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0082.983] GetTickCount () returned 0x114aa25
	[0082.983] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0083.130] GetTickCount () returned 0x114aab1
	[0083.130] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0083.236] GetTickCount () returned 0x114ab1e
	[0083.236] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0083.344] GetTickCount () returned 0x114ab8c
	[0083.344] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0083.466] GetTickCount () returned 0x114ac08
	[0083.466] GetTickCount () returned 0x114ac08
	[0083.466] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0083.627] GetTickCount () returned 0x114aca4
	[0083.627] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0083.793] GetTickCount () returned 0x114ad50
	[0083.793] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0083.905] GetTickCount () returned 0x114adbd
	[0083.905] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0084.027] GetTickCount () returned 0x114ae3a
	[0084.027] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0084.140] GetTickCount () returned 0x114aea7
	[0084.140] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0084.280] GetTickCount () returned 0x114af34
	[0084.280] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0084.448] GetTickCount () returned 0x114afd0
	[0084.448] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0084.578] GetTickCount () returned 0x114b05c
	[0084.578] GetTickCount () returned 0x114b05c
	[0084.578] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0084.683] GetTickCount () returned 0x114b0c9
	[0084.683] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0084.794] GetTickCount () returned 0x114b136
	[0084.794] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0084.933] GetTickCount () returned 0x114b1c3
	[0084.933] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0085.072] GetTickCount () returned 0x114b24f
	[0085.073] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0085.213] GetTickCount () returned 0x114b2dc
	[0085.213] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0085.324] GetTickCount () returned 0x114b349
	[0085.324] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0085.448] GetTickCount () returned 0x114b3c6
	[0085.448] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0085.568] GetTickCount () returned 0x114b433
	[0085.568] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0085.699] GetTickCount () returned 0x114b4bf
	[0085.699] GetTickCount () returned 0x114b4bf
	[0085.699] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0085.806] GetTickCount () returned 0x114b52c
	[0085.806] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0085.923] GetTickCount () returned 0x114b59a
	[0085.923] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0086.035] GetTickCount () returned 0x114b607
	[0086.035] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0086.192] GetTickCount () returned 0x114b6a3
	[0086.192] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0086.290] GetTickCount () returned 0x114b710
	[0086.290] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0086.430] GetTickCount () returned 0x114b79c
	[0086.430] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0086.539] GetTickCount () returned 0x114b80a
	[0086.539] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0086.654] GetTickCount () returned 0x114b877
	[0086.654] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0086.761] GetTickCount () returned 0x114b8e4
	[0086.761] GetTickCount () returned 0x114b8e4
	[0086.762] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0086.883] GetTickCount () returned 0x114b961
	[0086.883] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0086.994] GetTickCount () returned 0x114b9ce
	[0086.994] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0087.109] GetTickCount () returned 0x114ba3b
	[0087.109] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0087.211] GetTickCount () returned 0x114baa8
	[0087.211] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0087.324] GetTickCount () returned 0x114bb16
	[0087.324] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0087.477] GetTickCount () returned 0x114bbb2
	[0087.477] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0087.586] GetTickCount () returned 0x114bc1f
	[0087.586] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0087.697] GetTickCount () returned 0x114bc8c
	[0087.697] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0087.810] GetTickCount () returned 0x114bcf9
	[0087.810] GetTickCount () returned 0x114bcf9
	[0087.810] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0087.921] GetTickCount () returned 0x114bd66
	[0087.921] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0088.025] GetTickCount () returned 0x114bdd4
	[0088.025] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0088.132] GetTickCount () returned 0x114be41
	[0088.132] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0088.256] GetTickCount () returned 0x114bebe
	[0088.256] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0088.365] GetTickCount () returned 0x114bf2b
	[0088.365] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0088.479] GetTickCount () returned 0x114bf98
	[0088.479] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0088.601] GetTickCount () returned 0x114c015
	[0088.601] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0088.709] GetTickCount () returned 0x114c082
	[0088.709] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0088.821] GetTickCount () returned 0x114c0ef
	[0088.821] GetTickCount () returned 0x114c0ef
	[0088.821] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0088.926] GetTickCount () returned 0x114c15c
	[0088.926] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0089.061] GetTickCount () returned 0x114c1d9
	[0089.061] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0089.179] GetTickCount () returned 0x114c256
	[0089.179] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0089.303] GetTickCount () returned 0x114c2d3
	[0089.303] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0089.423] GetTickCount () returned 0x114c340
	[0089.423] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0089.528] GetTickCount () returned 0x114c3ad
	[0089.528] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0089.681] GetTickCount () returned 0x114c449
	[0089.681] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0089.839] GetTickCount () returned 0x114c4e5
	[0089.839] GetTickCount () returned 0x114c4e5
	[0089.839] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0089.958] GetTickCount () returned 0x114c562
	[0089.958] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0090.067] GetTickCount () returned 0x114c5cf
	[0090.067] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0090.196] GetTickCount () returned 0x114c64c
	[0090.196] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0090.303] GetTickCount () returned 0x114c6b9
	[0090.303] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0090.418] GetTickCount () returned 0x114c726
	[0090.418] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0090.527] GetTickCount () returned 0x114c794
	[0090.527] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0090.633] GetTickCount () returned 0x114c801
	[0090.633] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0090.736] GetTickCount () returned 0x114c86e
	[0090.736] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0090.921] GetTickCount () returned 0x114c91a
	[0090.921] GetTickCount () returned 0x114c91a
	[0090.922] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0091.016] GetTickCount () returned 0x114c987
	[0091.016] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0091.126] GetTickCount () returned 0x114c9f4
	[0091.126] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0091.237] GetTickCount () returned 0x114ca61
	[0091.237] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0091.344] GetTickCount () returned 0x114cace
	[0091.344] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0091.595] GetTickCount () returned 0x114cbc8
	[0091.595] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0091.704] GetTickCount () returned 0x114cc35
	[0091.704] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0091.813] GetTickCount () returned 0x114cca2
	[0091.813] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0091.921] GetTickCount () returned 0x114cd10
	[0091.921] GetTickCount () returned 0x114cd10
	[0091.921] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0092.030] GetTickCount () returned 0x114cd7d
	[0092.030] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0092.146] GetTickCount () returned 0x114cdea
	[0092.146] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0092.257] GetTickCount () returned 0x114ce57
	[0092.257] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0092.357] GetTickCount () returned 0x114cec4
	[0092.357] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0092.467] GetTickCount () returned 0x114cf32
	[0092.467] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0092.612] GetTickCount () returned 0x114cfbe
	[0092.612] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0092.718] GetTickCount () returned 0x114d02b
	[0092.718] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0092.866] GetTickCount () returned 0x114d0b8
	[0092.866] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0093.014] GetTickCount () returned 0x114d154
	[0093.014] GetTickCount () returned 0x114d154
	[0093.014] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0093.128] GetTickCount () returned 0x114d1c1
	[0093.128] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0093.231] GetTickCount () returned 0x114d22e
	[0093.231] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0093.356] GetTickCount () returned 0x114d2ab
	[0093.356] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0093.474] GetTickCount () returned 0x114d318
	[0093.474] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0093.596] GetTickCount () returned 0x114d395
	[0093.596] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0093.701] GetTickCount () returned 0x114d402
	[0093.701] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0093.864] GetTickCount () returned 0x114d49e
	[0093.864] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0094.030] GetTickCount () returned 0x114d54a
	[0094.030] GetTickCount () returned 0x114d54a
	[0094.030] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0094.182] GetTickCount () returned 0x114d5e6
	[0094.182] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0094.299] GetTickCount () returned 0x114d653
	[0094.299] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0094.409] GetTickCount () returned 0x114d6c0
	[0094.409] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0094.512] GetTickCount () returned 0x114d72d
	[0094.512] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0094.625] GetTickCount () returned 0x114d79a
	[0094.625] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0094.730] GetTickCount () returned 0x114d808
	[0094.730] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0094.879] GetTickCount () returned 0x114d894
	[0094.879] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0094.986] GetTickCount () returned 0x114d901
	[0094.986] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0095.124] GetTickCount () returned 0x114d98e
	[0095.124] GetTickCount () returned 0x114d98e
	[0095.124] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0095.251] GetTickCount () returned 0x114da0a
	[0095.251] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0095.367] GetTickCount () returned 0x114da78
	[0095.367] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0095.470] GetTickCount () returned 0x114dae5
	[0095.470] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0095.593] GetTickCount () returned 0x114db62
	[0095.593] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0095.713] GetTickCount () returned 0x114dbcf
	[0095.713] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0095.822] GetTickCount () returned 0x114dc3c
	[0095.822] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0095.933] GetTickCount () returned 0x114dca9
	[0095.933] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0096.053] GetTickCount () returned 0x114dd16
	[0096.053] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0096.166] GetTickCount () returned 0x114dd93
	[0096.166] GetTickCount () returned 0x114dd93
	[0096.166] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0096.273] GetTickCount () returned 0x114de00
	[0096.273] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0096.393] GetTickCount () returned 0x114de6e
	[0096.393] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0096.542] GetTickCount () returned 0x114df0a
	[0096.542] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0096.651] GetTickCount () returned 0x114df77
	[0096.651] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0096.756] GetTickCount () returned 0x114dfe4
	[0096.756] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0096.905] GetTickCount () returned 0x114e070
	[0096.905] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0097.006] GetTickCount () returned 0x114e0de
	[0097.006] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0097.127] GetTickCount () returned 0x114e14b
	[0097.127] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0097.250] GetTickCount () returned 0x114e1c8
	[0097.250] GetTickCount () returned 0x114e1c8
	[0097.250] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0097.364] GetTickCount () returned 0x114e235
	[0097.364] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0097.462] GetTickCount () returned 0x114e2a2
	[0097.462] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0097.604] GetTickCount () returned 0x114e32e
	[0097.604] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0097.761] GetTickCount () returned 0x114e3bb
	[0097.761] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0097.865] GetTickCount () returned 0x114e428
	[0097.865] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0097.977] GetTickCount () returned 0x114e495
	[0097.977] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0098.100] GetTickCount () returned 0x114e512
	[0098.100] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0098.210] GetTickCount () returned 0x114e57f
	[0098.210] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0098.325] GetTickCount () returned 0x114e5ec
	[0098.325] GetTickCount () returned 0x114e5ec
	[0098.325] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0098.430] GetTickCount () returned 0x114e65a
	[0098.430] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0098.566] GetTickCount () returned 0x114e6e6
	[0098.566] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0098.707] GetTickCount () returned 0x114e772
	[0098.707] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0098.818] GetTickCount () returned 0x114e7e0
	[0098.818] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0098.926] GetTickCount () returned 0x114e84d
	[0098.926] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0099.038] GetTickCount () returned 0x114e8ba
	[0099.038] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0099.159] GetTickCount () returned 0x114e937
	[0099.159] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0099.284] GetTickCount () returned 0x114e9b4
	[0099.284] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0099.404] GetTickCount () returned 0x114ea21
	[0099.404] GetTickCount () returned 0x114ea21
	[0099.404] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0099.516] GetTickCount () returned 0x114ea8e
	[0099.516] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0099.620] GetTickCount () returned 0x114eafb
	[0099.620] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0099.746] GetTickCount () returned 0x114eb78
	[0099.746] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0099.846] GetTickCount () returned 0x114ebe5
	[0099.846] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0099.969] GetTickCount () returned 0x114ec52
	[0099.969] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0100.081] GetTickCount () returned 0x114eccf
	[0100.081] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0100.189] GetTickCount () returned 0x114ed3c
	[0100.189] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0100.331] GetTickCount () returned 0x114edb9
	[0100.331] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0100.481] GetTickCount () returned 0x114ee46
	[0100.481] GetTickCount () returned 0x114ee46
	[0100.481] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0100.590] GetTickCount () returned 0x114eeb3
	[0100.590] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0100.708] GetTickCount () returned 0x114ef20
	[0100.708] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0100.820] GetTickCount () returned 0x114ef8d
	[0100.820] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0100.950] GetTickCount () returned 0x114f00a
	[0100.950] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0101.054] GetTickCount () returned 0x114f077
	[0101.054] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0101.168] GetTickCount () returned 0x114f0e4
	[0101.168] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0101.314] GetTickCount () returned 0x114f180
	[0101.315] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0101.471] GetTickCount () returned 0x114f21c
	[0101.471] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0101.586] GetTickCount () returned 0x114f28a
	[0101.586] GetTickCount () returned 0x114f28a
	[0101.586] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0101.687] GetTickCount () returned 0x114f2f7
	[0101.687] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0101.796] GetTickCount () returned 0x114f364
	[0101.796] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0101.913] GetTickCount () returned 0x114f3d1
	[0101.913] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0102.014] GetTickCount () returned 0x114f43e
	[0102.014] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0102.123] GetTickCount () returned 0x114f4ac
	[0102.123] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0102.233] GetTickCount () returned 0x114f519
	[0102.233] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0102.342] GetTickCount () returned 0x114f586
	[0102.342] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0102.451] GetTickCount () returned 0x114f5f3
	[0102.451] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0102.561] GetTickCount () returned 0x114f660
	[0102.561] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0102.669] GetTickCount () returned 0x114f6ce
	[0102.669] GetTickCount () returned 0x114f6ce
	[0102.669] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0102.780] GetTickCount () returned 0x114f73b
	[0102.780] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0102.888] GetTickCount () returned 0x114f7a8
	[0102.888] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0102.996] GetTickCount () returned 0x114f815
	[0102.996] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0103.112] GetTickCount () returned 0x114f882
	[0103.112] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0103.222] GetTickCount () returned 0x114f8f0
	[0103.222] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0103.332] GetTickCount () returned 0x114f95d
	[0103.333] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0103.450] GetTickCount () returned 0x114f9da
	[0103.450] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0103.566] GetTickCount () returned 0x114fa47
	[0103.566] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0103.689] GetTickCount () returned 0x114fac4
	[0103.689] GetTickCount () returned 0x114fac4
	[0103.689] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0103.795] GetTickCount () returned 0x114fb31
	[0103.795] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0103.936] GetTickCount () returned 0x114fbae
	[0103.936] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0104.056] GetTickCount () returned 0x114fc1b
	[0104.056] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0104.182] GetTickCount () returned 0x114fca7
	[0104.182] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0104.300] GetTickCount () returned 0x114fd14
	[0104.300] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0104.403] GetTickCount () returned 0x114fd82
	[0104.403] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0104.520] GetTickCount () returned 0x114fdef
	[0104.520] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0104.640] GetTickCount () returned 0x114fe6c
	[0104.640] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0104.751] GetTickCount () returned 0x114fed9
	[0104.751] GetTickCount () returned 0x114fed9
	[0104.751] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0104.896] GetTickCount () returned 0x114ff65
	[0104.896] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0105.040] GetTickCount () returned 0x1150001
	[0105.040] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0105.153] GetTickCount () returned 0x115006e
	[0105.153] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0105.302] GetTickCount () returned 0x11500fb
	[0105.302] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0105.423] GetTickCount () returned 0x1150178
	[0105.423] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0105.524] GetTickCount () returned 0x11501e5
	[0105.524] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102
	[0105.659] GetTickCount () returned 0x1150262
	[0105.659] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) 

Thread:
	id = 54
	os_tid = 0xb88

	[0073.169] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x6601e8
	[0073.169] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x6701f0
	[0073.169] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6308f0
	[0073.169] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x62ce78
	[0073.169] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630908
	[0073.169] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3420020
	[0073.170] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630920
	[0073.170] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630920, Size=0x20) returned 0x6162d8
	[0073.170] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630920
	[0073.170] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630920, Size=0x20) returned 0x6162b0
	[0073.170] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0073.170] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0073.170] Wow64DisableWow64FsRedirection (in: OldValue=0x235ff58 | out: OldValue=0x235ff58*=0x0) returned 1
	[0073.170] lstrlenW (lpString="kernel32.dll") returned 12
	[0073.170] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162d8 | out: hHeap=0x5e0000) returned 1
	[0073.170] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0073.170] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162b0 | out: hHeap=0x5e0000) returned 1
	[0073.170] Sleep (dwMilliseconds=0x64) 
	[0073.723] Sleep (dwMilliseconds=0x64) 
	[0074.197] lstrcmpiW (lpString1=".ini", lpString2=".adobe") returned 1
	[0074.200] lstrlenW (lpString="desktop.ini") returned 11
	[0074.200] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0074.210] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=129) returned 1
	[0074.211] CloseHandle (hObject=0x160) returned 1
	[0074.211] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26
	[0074.211] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.211] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0074.211] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.211] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.211] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0074.213] GetLastError () returned 0x0
	[0074.213] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x81, lpOverlapped=0x0) returned 1
	[0074.229] WriteFile (in: hFile=0x16c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x90, lpOverlapped=0x0) returned 1
	[0074.231] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0074.231] WriteFile (in: hFile=0x16c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0074.231] SetEndOfFile (hFile=0x16c) returned 1
	[0074.231] CloseHandle (hObject=0x16c) returned 1
	[0074.234] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.234] SetEndOfFile (hFile=0x160) returned 1
	[0074.235] CloseHandle (hObject=0x160) returned 1
	[0074.235] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x26) returned 1
	[0074.235] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1
	[0074.236] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0074.236] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0074.236] lstrlenW (lpString=".doc") returned 4
	[0074.236] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0074.236] lstrlenW (lpString=".docx") returned 5
	[0074.236] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0074.236] lstrlenW (lpString=".pdf") returned 4
	[0074.236] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0074.236] lstrlenW (lpString=".xls") returned 4
	[0074.236] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0074.236] lstrlenW (lpString=".xlsx") returned 5
	[0074.236] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0074.236] lstrlenW (lpString=".ppt") returned 4
	[0074.236] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0074.236] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0074.236] lstrlenW (lpString=".zip") returned 4
	[0074.236] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0074.236] lstrlenW (lpString=".rar") returned 4
	[0074.236] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0074.236] lstrlenW (lpString=".bz2") returned 4
	[0074.236] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0074.236] lstrlenW (lpString=".7z") returned 3
	[0074.236] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0074.236] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0074.236] lstrlenW (lpString=".dbf") returned 4
	[0074.236] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0074.237] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0074.237] lstrlenW (lpString=".1cd") returned 4
	[0074.237] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0074.237] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0074.237] lstrlenW (lpString=".jpg") returned 4
	[0074.237] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0074.237] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0074.237] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0074.237] lstrlenW (lpString=".doc") returned 4
	[0074.237] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0074.237] lstrlenW (lpString=".docx") returned 5
	[0074.237] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0074.237] lstrlenW (lpString=".pdf") returned 4
	[0074.237] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0074.237] lstrlenW (lpString=".xls") returned 4
	[0074.237] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0074.237] lstrlenW (lpString=".xlsx") returned 5
	[0074.237] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0074.237] lstrlenW (lpString=".ppt") returned 4
	[0074.237] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0074.237] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0074.237] lstrlenW (lpString=".zip") returned 4
	[0074.237] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0074.237] lstrlenW (lpString=".rar") returned 4
	[0074.237] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0074.237] lstrlenW (lpString=".bz2") returned 4
	[0074.238] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0074.238] lstrlenW (lpString=".7z") returned 3
	[0074.238] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0074.238] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0074.238] lstrlenW (lpString=".dbf") returned 4
	[0074.238] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0074.238] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0074.238] lstrlenW (lpString=".1cd") returned 4
	[0074.238] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0074.238] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0074.238] lstrlenW (lpString=".jpg") returned 4
	[0074.238] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0074.238] lstrcmpiW (lpString1=".LOG", lpString2=".adobe") returned 1
	[0074.238] lstrlenW (lpString="BCD.LOG") returned 7
	[0074.238] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.238] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0074.238] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0074.239] lstrlenW (lpString=".doc") returned 4
	[0074.239] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0074.239] lstrlenW (lpString=".docx") returned 5
	[0074.239] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0074.239] lstrlenW (lpString=".pdf") returned 4
	[0074.239] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0074.239] lstrlenW (lpString=".xls") returned 4
	[0074.239] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0074.239] lstrlenW (lpString=".xlsx") returned 5
	[0074.239] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0074.239] lstrlenW (lpString=".ppt") returned 4
	[0074.239] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0074.239] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0074.239] lstrlenW (lpString=".zip") returned 4
	[0074.239] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0074.239] lstrlenW (lpString=".rar") returned 4
	[0074.239] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0074.239] lstrlenW (lpString=".bz2") returned 4
	[0074.239] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0074.239] lstrlenW (lpString=".7z") returned 3
	[0074.239] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0074.239] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0074.239] lstrlenW (lpString=".dbf") returned 4
	[0074.239] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0074.239] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0074.239] lstrlenW (lpString=".1cd") returned 4
	[0074.240] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0074.240] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0074.240] lstrlenW (lpString=".jpg") returned 4
	[0074.240] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0074.240] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0074.240] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0074.240] lstrlenW (lpString=".doc") returned 4
	[0074.240] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0074.240] lstrlenW (lpString=".docx") returned 5
	[0074.240] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0074.240] lstrlenW (lpString=".pdf") returned 4
	[0074.240] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0074.240] lstrlenW (lpString=".xls") returned 4
	[0074.240] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0074.240] lstrlenW (lpString=".xlsx") returned 5
	[0074.240] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0074.240] lstrlenW (lpString=".ppt") returned 4
	[0074.240] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0074.240] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0074.240] lstrlenW (lpString=".zip") returned 4
	[0074.240] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0074.240] lstrlenW (lpString=".rar") returned 4
	[0074.240] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0074.240] lstrlenW (lpString=".bz2") returned 4
	[0074.240] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0074.240] lstrlenW (lpString=".7z") returned 3
	[0074.241] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0074.241] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0074.241] lstrlenW (lpString=".dbf") returned 4
	[0074.241] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0074.241] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0074.241] lstrlenW (lpString=".1cd") returned 4
	[0074.241] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0074.241] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0074.241] lstrlenW (lpString=".jpg") returned 4
	[0074.241] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0074.241] lstrcmpiW (lpString1=".DAT", lpString2=".adobe") returned 1
	[0074.241] lstrlenW (lpString="BOOTSTAT.DAT") returned 12
	[0074.241] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0074.242] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=65536) returned 1
	[0074.242] CloseHandle (hObject=0x160) returned 1
	[0074.242] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26
	[0074.242] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.242] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0074.242] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.242] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.242] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0074.243] GetLastError () returned 0x0
	[0074.243] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x10000, lpOverlapped=0x0) returned 1
	[0074.408] WriteFile (in: hFile=0x16c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x10010, lpOverlapped=0x0) returned 1
	[0074.411] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0074.411] WriteFile (in: hFile=0x16c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0074.411] SetEndOfFile (hFile=0x16c) returned 1
	[0074.411] CloseHandle (hObject=0x16c) returned 1
	[0074.413] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.413] SetEndOfFile (hFile=0x160) returned 1
	[0074.415] CloseHandle (hObject=0x160) returned 1
	[0074.415] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x26) returned 1
	[0074.415] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1
	[0074.416] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.416] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.416] lstrlenW (lpString=".doc") returned 4
	[0074.416] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0074.416] lstrlenW (lpString=".docx") returned 5
	[0074.416] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1
	[0074.416] lstrlenW (lpString=".pdf") returned 4
	[0074.416] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0074.416] lstrlenW (lpString=".xls") returned 4
	[0074.416] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0074.416] lstrlenW (lpString=".xlsx") returned 5
	[0074.416] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1
	[0074.416] lstrlenW (lpString=".ppt") returned 4
	[0074.416] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0074.416] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.416] lstrlenW (lpString=".zip") returned 4
	[0074.416] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0074.416] lstrlenW (lpString=".rar") returned 4
	[0074.416] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0074.416] lstrlenW (lpString=".bz2") returned 4
	[0074.416] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0074.416] lstrlenW (lpString=".7z") returned 3
	[0074.416] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0074.416] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.416] lstrlenW (lpString=".dbf") returned 4
	[0074.416] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0074.416] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.416] lstrlenW (lpString=".1cd") returned 4
	[0074.416] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0074.416] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.416] lstrlenW (lpString=".jpg") returned 4
	[0074.416] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0074.417] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.417] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.417] lstrlenW (lpString=".doc") returned 4
	[0074.417] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0074.417] lstrlenW (lpString=".docx") returned 5
	[0074.417] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1
	[0074.417] lstrlenW (lpString=".pdf") returned 4
	[0074.417] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0074.417] lstrlenW (lpString=".xls") returned 4
	[0074.417] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0074.417] lstrlenW (lpString=".xlsx") returned 5
	[0074.417] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1
	[0074.417] lstrlenW (lpString=".ppt") returned 4
	[0074.417] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0074.434] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.434] lstrlenW (lpString=".zip") returned 4
	[0074.434] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0074.434] lstrlenW (lpString=".rar") returned 4
	[0074.434] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0074.434] lstrlenW (lpString=".bz2") returned 4
	[0074.434] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0074.434] lstrlenW (lpString=".7z") returned 3
	[0074.434] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0074.434] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.434] lstrlenW (lpString=".dbf") returned 4
	[0074.434] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0074.434] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.434] lstrlenW (lpString=".1cd") returned 4
	[0074.434] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0074.434] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.434] lstrlenW (lpString=".jpg") returned 4
	[0074.435] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0074.435] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0074.435] lstrlenW (lpString="ExcelMUI.xml") returned 12
	[0074.435] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0075.718] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1565) returned 1
	[0075.718] CloseHandle (hObject=0x184) returned 1
	[0075.718] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020
	[0075.718] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0075.722] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.722] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.723] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0075.760] GetLastError () returned 0x0
	[0075.760] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x61d, lpOverlapped=0x0) returned 1
	[0075.771] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x620, lpOverlapped=0x0) returned 1
	[0075.772] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0075.772] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0075.772] SetEndOfFile (hFile=0x1a0) returned 1
	[0075.777] CloseHandle (hObject=0x1a0) returned 1
	[0075.780] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.780] SetEndOfFile (hFile=0x174) returned 1
	[0075.812] CloseHandle (hObject=0x174) returned 1
	[0075.826] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.839] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1
	[0075.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0075.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0075.963] lstrlenW (lpString=".doc") returned 4
	[0075.963] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.963] lstrlenW (lpString=".docx") returned 5
	[0075.963] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0075.963] lstrlenW (lpString=".pdf") returned 4
	[0075.963] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.963] lstrlenW (lpString=".xls") returned 4
	[0075.963] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.963] lstrlenW (lpString=".xlsx") returned 5
	[0075.963] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0075.963] lstrlenW (lpString=".ppt") returned 4
	[0075.963] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0075.963] lstrlenW (lpString=".zip") returned 4
	[0075.963] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.963] lstrlenW (lpString=".rar") returned 4
	[0075.963] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.963] lstrlenW (lpString=".bz2") returned 4
	[0075.963] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.963] lstrlenW (lpString=".7z") returned 3
	[0075.964] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0075.964] lstrlenW (lpString=".dbf") returned 4
	[0075.964] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0075.964] lstrlenW (lpString=".1cd") returned 4
	[0075.964] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0075.964] lstrlenW (lpString=".jpg") returned 4
	[0075.964] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0075.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0075.964] lstrlenW (lpString=".doc") returned 4
	[0075.964] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.964] lstrlenW (lpString=".docx") returned 5
	[0075.964] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0075.964] lstrlenW (lpString=".pdf") returned 4
	[0075.964] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.964] lstrlenW (lpString=".xls") returned 4
	[0075.964] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.964] lstrlenW (lpString=".xlsx") returned 5
	[0075.964] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0075.964] lstrlenW (lpString=".ppt") returned 4
	[0075.964] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0075.964] lstrlenW (lpString=".zip") returned 4
	[0075.964] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.964] lstrlenW (lpString=".rar") returned 4
	[0075.964] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.964] lstrlenW (lpString=".bz2") returned 4
	[0075.964] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.965] lstrlenW (lpString=".7z") returned 3
	[0075.965] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0075.965] lstrlenW (lpString=".dbf") returned 4
	[0075.965] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0075.965] lstrlenW (lpString=".1cd") returned 4
	[0075.965] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0075.965] lstrlenW (lpString=".jpg") returned 4
	[0075.965] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.965] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0075.965] lstrlenW (lpString="Setup.xml") returned 9
	[0075.965] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0075.965] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2362) returned 1
	[0075.966] CloseHandle (hObject=0x19c) returned 1
	[0075.966] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0075.966] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0075.966] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.966] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0075.966] GetLastError () returned 0x0
	[0075.966] ReadFile (in: hFile=0x19c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x93a, lpOverlapped=0x0) returned 1
	[0076.046] WriteFile (in: hFile=0x1b0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x940, lpOverlapped=0x0) returned 1
	[0076.048] ReadFile (in: hFile=0x19c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0076.048] WriteFile (in: hFile=0x1b0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0076.048] SetEndOfFile (hFile=0x1b0) returned 1
	[0076.048] CloseHandle (hObject=0x1b0) returned 1
	[0076.049] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.049] SetEndOfFile (hFile=0x19c) returned 1
	[0076.050] CloseHandle (hObject=0x19c) returned 1
	[0076.050] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0076.051] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0076.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.051] lstrlenW (lpString=".doc") returned 4
	[0076.051] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0076.051] lstrlenW (lpString=".docx") returned 5
	[0076.051] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0076.051] lstrlenW (lpString=".pdf") returned 4
	[0076.051] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0076.051] lstrlenW (lpString=".xls") returned 4
	[0076.051] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0076.051] lstrlenW (lpString=".xlsx") returned 5
	[0076.051] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0076.051] lstrlenW (lpString=".ppt") returned 4
	[0076.051] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0076.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.051] lstrlenW (lpString=".zip") returned 4
	[0076.051] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0076.051] lstrlenW (lpString=".rar") returned 4
	[0076.052] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0076.052] lstrlenW (lpString=".bz2") returned 4
	[0076.052] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0076.052] lstrlenW (lpString=".7z") returned 3
	[0076.052] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0076.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.052] lstrlenW (lpString=".dbf") returned 4
	[0076.052] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0076.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.052] lstrlenW (lpString=".1cd") returned 4
	[0076.052] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0076.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.052] lstrlenW (lpString=".jpg") returned 4
	[0076.052] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0076.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.052] lstrlenW (lpString=".doc") returned 4
	[0076.052] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0076.052] lstrlenW (lpString=".docx") returned 5
	[0076.052] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0076.052] lstrlenW (lpString=".pdf") returned 4
	[0076.052] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0076.052] lstrlenW (lpString=".xls") returned 4
	[0076.052] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0076.052] lstrlenW (lpString=".xlsx") returned 5
	[0076.052] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0076.053] lstrlenW (lpString=".ppt") returned 4
	[0076.053] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0076.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.053] lstrlenW (lpString=".zip") returned 4
	[0076.053] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0076.053] lstrlenW (lpString=".rar") returned 4
	[0076.053] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0076.053] lstrlenW (lpString=".bz2") returned 4
	[0076.053] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0076.053] lstrlenW (lpString=".7z") returned 3
	[0076.053] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0076.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.053] lstrlenW (lpString=".dbf") returned 4
	[0076.053] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0076.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.053] lstrlenW (lpString=".1cd") returned 4
	[0076.053] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0076.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.053] lstrlenW (lpString=".jpg") returned 4
	[0076.053] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0076.053] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0076.053] lstrlenW (lpString="VisioMUI.xml") returned 12
	[0076.053] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0076.555] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=9503) returned 1
	[0076.555] CloseHandle (hObject=0x19c) returned 1
	[0076.555] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020
	[0076.556] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0076.773] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0076.773] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.773] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.774] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0078.191] GetLastError () returned 0x0
	[0078.191] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x251f, lpOverlapped=0x0) returned 1
	[0078.270] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2520, lpOverlapped=0x0) returned 1
	[0078.272] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0078.272] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0078.272] SetEndOfFile (hFile=0x184) returned 1
	[0078.272] CloseHandle (hObject=0x184) returned 1
	[0078.273] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.274] SetEndOfFile (hFile=0x1a8) returned 1
	[0078.275] CloseHandle (hObject=0x1a8) returned 1
	[0078.275] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0078.275] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1
	[0078.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0078.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0078.276] lstrlenW (lpString=".doc") returned 4
	[0078.276] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.276] lstrlenW (lpString=".docx") returned 5
	[0078.276] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0078.276] lstrlenW (lpString=".pdf") returned 4
	[0078.276] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.276] lstrlenW (lpString=".xls") returned 4
	[0078.276] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.276] lstrlenW (lpString=".xlsx") returned 5
	[0078.276] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0078.276] lstrlenW (lpString=".ppt") returned 4
	[0078.276] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0078.276] lstrlenW (lpString=".zip") returned 4
	[0078.276] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.276] lstrlenW (lpString=".rar") returned 4
	[0078.276] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.276] lstrlenW (lpString=".bz2") returned 4
	[0078.276] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.276] lstrlenW (lpString=".7z") returned 3
	[0078.276] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0078.276] lstrlenW (lpString=".dbf") returned 4
	[0078.276] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0078.276] lstrlenW (lpString=".1cd") returned 4
	[0078.276] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0078.277] lstrlenW (lpString=".jpg") returned 4
	[0078.277] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0078.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0078.277] lstrlenW (lpString=".doc") returned 4
	[0078.277] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.277] lstrlenW (lpString=".docx") returned 5
	[0078.277] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0078.277] lstrlenW (lpString=".pdf") returned 4
	[0078.277] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.277] lstrlenW (lpString=".xls") returned 4
	[0078.277] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.277] lstrlenW (lpString=".xlsx") returned 5
	[0078.277] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0078.277] lstrlenW (lpString=".ppt") returned 4
	[0078.277] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0078.277] lstrlenW (lpString=".zip") returned 4
	[0078.277] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.277] lstrlenW (lpString=".rar") returned 4
	[0078.277] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.277] lstrlenW (lpString=".bz2") returned 4
	[0078.277] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.277] lstrlenW (lpString=".7z") returned 3
	[0078.277] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0078.278] lstrlenW (lpString=".dbf") returned 4
	[0078.278] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0078.278] lstrlenW (lpString=".1cd") returned 4
	[0078.278] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0078.278] lstrlenW (lpString=".jpg") returned 4
	[0078.278] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.278] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0078.278] lstrlenW (lpString="OfficeMUI.xml") returned 13
	[0078.278] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0078.693] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=5557) returned 1
	[0078.693] CloseHandle (hObject=0x198) returned 1
	[0078.693] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020
	[0078.702] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0078.714] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0080.049] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.049] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.049] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0081.336] GetLastError () returned 0x0
	[0081.336] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x15b5, lpOverlapped=0x0) returned 1
	[0081.398] WriteFile (in: hFile=0x194, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x15c0, lpOverlapped=0x0) returned 1
	[0081.399] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.399] WriteFile (in: hFile=0x194, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0081.399] SetEndOfFile (hFile=0x194) returned 1
	[0081.430] CloseHandle (hObject=0x194) returned 1
	[0081.431] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.431] SetEndOfFile (hFile=0x184) returned 1
	[0081.440] CloseHandle (hObject=0x184) returned 1
	[0081.455] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.456] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1
	[0081.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.473] lstrlenW (lpString=".doc") returned 4
	[0081.473] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.473] lstrlenW (lpString=".docx") returned 5
	[0081.473] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0081.473] lstrlenW (lpString=".pdf") returned 4
	[0081.473] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.473] lstrlenW (lpString=".xls") returned 4
	[0081.473] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.473] lstrlenW (lpString=".xlsx") returned 5
	[0081.473] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0081.473] lstrlenW (lpString=".ppt") returned 4
	[0081.473] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.473] lstrlenW (lpString=".zip") returned 4
	[0081.473] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.474] lstrlenW (lpString=".rar") returned 4
	[0081.474] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.474] lstrlenW (lpString=".bz2") returned 4
	[0081.474] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.474] lstrlenW (lpString=".7z") returned 3
	[0081.474] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.474] lstrlenW (lpString=".dbf") returned 4
	[0081.474] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.474] lstrlenW (lpString=".1cd") returned 4
	[0081.474] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.474] lstrlenW (lpString=".jpg") returned 4
	[0081.474] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.474] lstrlenW (lpString=".doc") returned 4
	[0081.474] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.474] lstrlenW (lpString=".docx") returned 5
	[0081.474] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0081.474] lstrlenW (lpString=".pdf") returned 4
	[0081.474] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.474] lstrlenW (lpString=".xls") returned 4
	[0081.475] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.475] lstrlenW (lpString=".xlsx") returned 5
	[0081.475] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0081.475] lstrlenW (lpString=".ppt") returned 4
	[0081.475] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.475] lstrlenW (lpString=".zip") returned 4
	[0081.475] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.475] lstrlenW (lpString=".rar") returned 4
	[0081.475] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.475] lstrlenW (lpString=".bz2") returned 4
	[0081.475] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.475] lstrlenW (lpString=".7z") returned 3
	[0081.475] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.475] lstrlenW (lpString=".dbf") returned 4
	[0081.475] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.475] lstrlenW (lpString=".1cd") returned 4
	[0081.475] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.475] lstrlenW (lpString=".jpg") returned 4
	[0081.475] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.476] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0081.476] lstrlenW (lpString="Setup.xml") returned 9
	[0081.476] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.489] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=9352) returned 1
	[0081.489] CloseHandle (hObject=0x198) returned 1
	[0081.489] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0081.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.521] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.635] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.636] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0081.865] GetLastError () returned 0x0
	[0081.865] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x2488, lpOverlapped=0x0) returned 1
	[0081.868] WriteFile (in: hFile=0x194, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2490, lpOverlapped=0x0) returned 1
	[0081.870] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.870] WriteFile (in: hFile=0x194, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0081.870] SetEndOfFile (hFile=0x194) returned 1
	[0081.881] CloseHandle (hObject=0x194) returned 1
	[0081.885] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.885] SetEndOfFile (hFile=0x198) returned 1
	[0081.891] CloseHandle (hObject=0x198) returned 1
	[0081.893] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.894] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0081.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.938] lstrlenW (lpString=".doc") returned 4
	[0081.938] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.938] lstrlenW (lpString=".docx") returned 5
	[0081.939] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0081.939] lstrlenW (lpString=".pdf") returned 4
	[0081.939] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.939] lstrlenW (lpString=".xls") returned 4
	[0081.939] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.939] lstrlenW (lpString=".xlsx") returned 5
	[0081.939] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0081.939] lstrlenW (lpString=".ppt") returned 4
	[0081.939] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.939] lstrlenW (lpString=".zip") returned 4
	[0081.939] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.939] lstrlenW (lpString=".rar") returned 4
	[0081.939] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.939] lstrlenW (lpString=".bz2") returned 4
	[0081.939] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.939] lstrlenW (lpString=".7z") returned 3
	[0081.939] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.939] lstrlenW (lpString=".dbf") returned 4
	[0081.939] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.939] lstrlenW (lpString=".1cd") returned 4
	[0081.939] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.939] lstrlenW (lpString=".jpg") returned 4
	[0081.939] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.940] lstrlenW (lpString=".doc") returned 4
	[0081.940] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.940] lstrlenW (lpString=".docx") returned 5
	[0081.940] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0081.940] lstrlenW (lpString=".pdf") returned 4
	[0081.940] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.940] lstrlenW (lpString=".xls") returned 4
	[0081.940] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.940] lstrlenW (lpString=".xlsx") returned 5
	[0081.940] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0081.940] lstrlenW (lpString=".ppt") returned 4
	[0081.940] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.940] lstrlenW (lpString=".zip") returned 4
	[0081.940] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.940] lstrlenW (lpString=".rar") returned 4
	[0081.940] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.940] lstrlenW (lpString=".bz2") returned 4
	[0081.940] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.940] lstrlenW (lpString=".7z") returned 3
	[0081.940] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.940] lstrlenW (lpString=".dbf") returned 4
	[0081.941] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.941] lstrlenW (lpString=".1cd") returned 4
	[0081.941] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.941] lstrlenW (lpString=".jpg") returned 4
	[0081.941] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.941] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0081.941] lstrlenW (lpString="MS.GIF") returned 6
	[0081.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.969] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1069) returned 1
	[0081.969] CloseHandle (hObject=0x184) returned 1
	[0081.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20
	[0081.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0081.986] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.986] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0082.107] GetLastError () returned 0x0
	[0082.107] ReadFile (in: hFile=0x19c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x42d, lpOverlapped=0x0) returned 1
	[0082.109] WriteFile (in: hFile=0x194, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x430, lpOverlapped=0x0) returned 1
	[0082.110] ReadFile (in: hFile=0x19c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0082.111] WriteFile (in: hFile=0x194, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0082.111] SetEndOfFile (hFile=0x194) returned 1
	[0082.173] CloseHandle (hObject=0x194) returned 1
	[0082.185] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.185] SetEndOfFile (hFile=0x19c) returned 1
	[0082.199] CloseHandle (hObject=0x19c) returned 1
	[0082.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0082.286] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1
	[0082.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0082.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0082.295] lstrlenW (lpString=".doc") returned 4
	[0082.295] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0082.295] lstrlenW (lpString=".docx") returned 5
	[0082.295] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1
	[0082.295] lstrlenW (lpString=".pdf") returned 4
	[0082.295] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0082.295] lstrlenW (lpString=".xls") returned 4
	[0082.295] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0082.295] lstrlenW (lpString=".xlsx") returned 5
	[0082.295] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1
	[0082.295] lstrlenW (lpString=".ppt") returned 4
	[0082.295] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0082.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0082.295] lstrlenW (lpString=".zip") returned 4
	[0082.295] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0082.295] lstrlenW (lpString=".rar") returned 4
	[0082.295] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0082.295] lstrlenW (lpString=".bz2") returned 4
	[0082.295] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0082.295] lstrlenW (lpString=".7z") returned 3
	[0082.295] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0082.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0082.296] lstrlenW (lpString=".dbf") returned 4
	[0082.296] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0082.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0082.296] lstrlenW (lpString=".1cd") returned 4
	[0082.296] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0082.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0082.296] lstrlenW (lpString=".jpg") returned 4
	[0082.296] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0082.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0082.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0082.296] lstrlenW (lpString=".doc") returned 4
	[0082.296] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0082.296] lstrlenW (lpString=".docx") returned 5
	[0082.296] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1
	[0082.296] lstrlenW (lpString=".pdf") returned 4
	[0082.296] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0082.296] lstrlenW (lpString=".xls") returned 4
	[0082.296] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0082.296] lstrlenW (lpString=".xlsx") returned 5
	[0082.296] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1
	[0082.296] lstrlenW (lpString=".ppt") returned 4
	[0082.296] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0082.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0082.296] lstrlenW (lpString=".zip") returned 4
	[0082.296] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0082.296] lstrlenW (lpString=".rar") returned 4
	[0082.296] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0082.296] lstrlenW (lpString=".bz2") returned 4
	[0082.296] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0082.296] lstrlenW (lpString=".7z") returned 3
	[0082.296] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0082.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0082.297] lstrlenW (lpString=".dbf") returned 4
	[0082.297] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0082.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0082.297] lstrlenW (lpString=".1cd") returned 4
	[0082.297] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0082.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0082.297] lstrlenW (lpString=".jpg") returned 4
	[0082.297] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0082.297] lstrcmpiW (lpString1=".avi", lpString2=".adobe") returned 1
	[0082.297] lstrlenW (lpString="boxed-correct.avi") returned 17
	[0082.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0082.556] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=89600) returned 1
	[0082.556] CloseHandle (hObject=0x1a8) returned 1
	[0082.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20
	[0082.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0082.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0082.557] lstrlenW (lpString=".doc") returned 4
	[0082.557] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0082.557] lstrlenW (lpString=".docx") returned 5
	[0082.557] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0082.557] lstrlenW (lpString=".pdf") returned 4
	[0082.557] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0082.557] lstrlenW (lpString=".xls") returned 4
	[0082.557] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0082.557] lstrlenW (lpString=".xlsx") returned 5
	[0082.557] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0082.557] lstrlenW (lpString=".ppt") returned 4
	[0082.557] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0082.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0082.557] lstrlenW (lpString=".zip") returned 4
	[0082.557] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0082.557] lstrlenW (lpString=".rar") returned 4
	[0082.557] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0082.557] lstrlenW (lpString=".bz2") returned 4
	[0082.557] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0082.557] lstrlenW (lpString=".7z") returned 3
	[0082.557] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0082.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0082.557] lstrlenW (lpString=".dbf") returned 4
	[0082.557] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0082.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0082.558] lstrlenW (lpString=".1cd") returned 4
	[0082.558] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0082.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0082.558] lstrlenW (lpString=".jpg") returned 4
	[0082.558] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0082.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0082.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0082.558] lstrlenW (lpString=".doc") returned 4
	[0082.558] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0082.558] lstrlenW (lpString=".docx") returned 5
	[0082.558] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0082.558] lstrlenW (lpString=".pdf") returned 4
	[0082.558] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0082.558] lstrlenW (lpString=".xls") returned 4
	[0082.558] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0082.558] lstrlenW (lpString=".xlsx") returned 5
	[0082.558] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0082.558] lstrlenW (lpString=".ppt") returned 4
	[0082.558] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0082.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0082.558] lstrlenW (lpString=".zip") returned 4
	[0082.558] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0082.558] lstrlenW (lpString=".rar") returned 4
	[0082.558] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0082.558] lstrlenW (lpString=".bz2") returned 4
	[0082.558] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0082.559] lstrlenW (lpString=".7z") returned 3
	[0082.559] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0082.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0082.559] lstrlenW (lpString=".dbf") returned 4
	[0082.559] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0082.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0082.559] lstrlenW (lpString=".1cd") returned 4
	[0082.559] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0082.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0082.559] lstrlenW (lpString=".jpg") returned 4
	[0082.559] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0082.559] lstrcmpiW (lpString1=".avi", lpString2=".adobe") returned 1
	[0082.559] lstrlenW (lpString="boxed-join.avi") returned 14
	[0082.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0082.560] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=33280) returned 1
	[0082.560] CloseHandle (hObject=0x1a8) returned 1
	[0082.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20
	[0082.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0082.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0082.560] lstrlenW (lpString=".doc") returned 4
	[0082.560] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0082.560] lstrlenW (lpString=".docx") returned 5
	[0082.560] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0082.563] lstrlenW (lpString=".pdf") returned 4
	[0082.563] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0082.563] lstrlenW (lpString=".xls") returned 4
	[0082.563] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0082.563] lstrlenW (lpString=".xlsx") returned 5
	[0082.563] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0082.563] lstrlenW (lpString=".ppt") returned 4
	[0082.563] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0082.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0082.563] lstrlenW (lpString=".zip") returned 4
	[0082.563] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0082.563] lstrlenW (lpString=".rar") returned 4
	[0082.563] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0082.563] lstrlenW (lpString=".bz2") returned 4
	[0082.563] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0082.563] lstrlenW (lpString=".7z") returned 3
	[0082.563] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0082.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0082.563] lstrlenW (lpString=".dbf") returned 4
	[0082.563] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0082.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0082.563] lstrlenW (lpString=".1cd") returned 4
	[0082.563] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0082.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0082.563] lstrlenW (lpString=".jpg") returned 4
	[0082.563] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0082.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0082.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0082.564] lstrlenW (lpString=".doc") returned 4
	[0082.564] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0082.564] lstrlenW (lpString=".docx") returned 5
	[0082.564] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0082.564] lstrlenW (lpString=".pdf") returned 4
	[0082.564] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0082.564] lstrlenW (lpString=".xls") returned 4
	[0082.564] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0082.564] lstrlenW (lpString=".xlsx") returned 5
	[0082.564] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0082.564] lstrlenW (lpString=".ppt") returned 4
	[0082.564] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0082.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0082.564] lstrlenW (lpString=".zip") returned 4
	[0082.564] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0082.564] lstrlenW (lpString=".rar") returned 4
	[0082.564] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0082.564] lstrlenW (lpString=".bz2") returned 4
	[0082.564] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0082.564] lstrlenW (lpString=".7z") returned 3
	[0082.564] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0082.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0082.565] lstrlenW (lpString=".dbf") returned 4
	[0082.565] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0082.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0082.565] lstrlenW (lpString=".1cd") returned 4
	[0082.565] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0082.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0082.565] lstrlenW (lpString=".jpg") returned 4
	[0082.565] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0082.565] lstrcmpiW (lpString1=".avi", lpString2=".adobe") returned 1
	[0082.565] lstrlenW (lpString="boxed-split.avi") returned 15
	[0082.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0082.566] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=62976) returned 1
	[0082.566] CloseHandle (hObject=0x1a8) returned 1
	[0082.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20
	[0082.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0082.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0082.567] lstrlenW (lpString=".doc") returned 4
	[0082.567] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0082.567] lstrlenW (lpString=".docx") returned 5
	[0082.567] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0082.567] lstrlenW (lpString=".pdf") returned 4
	[0082.567] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0082.567] lstrlenW (lpString=".xls") returned 4
	[0082.567] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0082.567] lstrlenW (lpString=".xlsx") returned 5
	[0082.567] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0082.567] lstrlenW (lpString=".ppt") returned 4
	[0082.567] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0082.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0082.567] lstrlenW (lpString=".zip") returned 4
	[0082.567] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0082.567] lstrlenW (lpString=".rar") returned 4
	[0082.567] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0082.567] lstrlenW (lpString=".bz2") returned 4
	[0082.567] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0082.567] lstrlenW (lpString=".7z") returned 3
	[0082.567] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0082.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0082.567] lstrlenW (lpString=".dbf") returned 4
	[0082.567] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0082.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0082.568] lstrlenW (lpString=".1cd") returned 4
	[0082.568] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0082.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0082.568] lstrlenW (lpString=".jpg") returned 4
	[0082.568] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0082.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0082.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0082.568] lstrlenW (lpString=".doc") returned 4
	[0082.568] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0082.568] lstrlenW (lpString=".docx") returned 5
	[0082.568] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0082.568] lstrlenW (lpString=".pdf") returned 4
	[0082.568] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0082.568] lstrlenW (lpString=".xls") returned 4
	[0082.568] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0082.568] lstrlenW (lpString=".xlsx") returned 5
	[0082.568] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0082.568] lstrlenW (lpString=".ppt") returned 4
	[0082.568] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0082.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0082.568] lstrlenW (lpString=".zip") returned 4
	[0082.568] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0082.568] lstrlenW (lpString=".rar") returned 4
	[0082.568] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0082.568] lstrlenW (lpString=".bz2") returned 4
	[0082.569] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0082.569] lstrlenW (lpString=".7z") returned 3
	[0082.569] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0082.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0082.569] lstrlenW (lpString=".dbf") returned 4
	[0082.569] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0082.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0082.569] lstrlenW (lpString=".1cd") returned 4
	[0082.569] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0082.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0082.569] lstrlenW (lpString=".jpg") returned 4
	[0082.569] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0082.569] lstrcmpiW (lpString1=".avi", lpString2=".adobe") returned 1
	[0082.569] lstrlenW (lpString="correct.avi") returned 11
	[0082.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0082.570] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=197120) returned 1
	[0082.570] CloseHandle (hObject=0x1a8) returned 1
	[0082.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20
	[0082.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0082.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0082.570] lstrlenW (lpString=".doc") returned 4
	[0082.570] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0082.570] lstrlenW (lpString=".docx") returned 5
	[0082.570] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0082.570] lstrlenW (lpString=".pdf") returned 4
	[0082.570] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0082.570] lstrlenW (lpString=".xls") returned 4
	[0082.570] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0082.570] lstrlenW (lpString=".xlsx") returned 5
	[0082.571] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0082.571] lstrlenW (lpString=".ppt") returned 4
	[0082.571] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0082.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0082.571] lstrlenW (lpString=".zip") returned 4
	[0082.571] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0082.571] lstrlenW (lpString=".rar") returned 4
	[0082.571] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0082.571] lstrlenW (lpString=".bz2") returned 4
	[0082.571] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0082.571] lstrlenW (lpString=".7z") returned 3
	[0082.571] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0082.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0082.571] lstrlenW (lpString=".dbf") returned 4
	[0082.571] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0082.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0082.571] lstrlenW (lpString=".1cd") returned 4
	[0082.571] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0082.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0082.571] lstrlenW (lpString=".jpg") returned 4
	[0082.571] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0082.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0082.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0082.571] lstrlenW (lpString=".doc") returned 4
	[0082.571] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0082.572] lstrlenW (lpString=".docx") returned 5
	[0082.572] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0082.572] lstrlenW (lpString=".pdf") returned 4
	[0082.572] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0082.572] lstrlenW (lpString=".xls") returned 4
	[0082.572] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0082.572] lstrlenW (lpString=".xlsx") returned 5
	[0082.572] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0082.572] lstrlenW (lpString=".ppt") returned 4
	[0082.572] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0082.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0082.572] lstrlenW (lpString=".zip") returned 4
	[0082.572] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0082.572] lstrlenW (lpString=".rar") returned 4
	[0082.572] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0082.572] lstrlenW (lpString=".bz2") returned 4
	[0082.572] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0082.572] lstrlenW (lpString=".7z") returned 3
	[0082.572] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0082.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0082.572] lstrlenW (lpString=".dbf") returned 4
	[0082.572] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0082.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0082.572] lstrlenW (lpString=".1cd") returned 4
	[0082.572] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0082.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0082.572] lstrlenW (lpString=".jpg") returned 4
	[0082.573] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0082.573] lstrcmpiW (lpString1=".avi", lpString2=".adobe") returned 1
	[0082.573] lstrlenW (lpString="delete.avi") returned 10
	[0082.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0082.596] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=224256) returned 1
	[0082.596] CloseHandle (hObject=0x1ac) returned 1
	[0082.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20
	[0082.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0082.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0082.596] lstrlenW (lpString=".doc") returned 4
	[0082.596] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0082.596] lstrlenW (lpString=".docx") returned 5
	[0082.596] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0082.596] lstrlenW (lpString=".pdf") returned 4
	[0082.596] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0082.596] lstrlenW (lpString=".xls") returned 4
	[0082.596] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0082.597] lstrlenW (lpString=".xlsx") returned 5
	[0082.597] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0082.597] lstrlenW (lpString=".ppt") returned 4
	[0082.597] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0082.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0082.597] lstrlenW (lpString=".zip") returned 4
	[0082.597] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0082.597] lstrlenW (lpString=".rar") returned 4
	[0082.597] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0082.597] lstrlenW (lpString=".bz2") returned 4
	[0082.597] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0082.597] lstrlenW (lpString=".7z") returned 3
	[0082.597] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0082.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0082.597] lstrlenW (lpString=".dbf") returned 4
	[0082.597] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0082.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0082.597] lstrlenW (lpString=".1cd") returned 4
	[0082.597] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0082.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0082.597] lstrlenW (lpString=".jpg") returned 4
	[0082.597] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0082.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0082.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0082.597] lstrlenW (lpString=".doc") returned 4
	[0082.597] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0082.598] lstrlenW (lpString=".docx") returned 5
	[0082.598] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0082.598] lstrlenW (lpString=".pdf") returned 4
	[0082.598] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0082.598] lstrlenW (lpString=".xls") returned 4
	[0082.598] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0082.598] lstrlenW (lpString=".xlsx") returned 5
	[0082.598] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0082.598] lstrlenW (lpString=".ppt") returned 4
	[0082.598] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0082.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0082.598] lstrlenW (lpString=".zip") returned 4
	[0082.598] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0082.598] lstrlenW (lpString=".rar") returned 4
	[0082.598] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0082.598] lstrlenW (lpString=".bz2") returned 4
	[0082.598] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0082.598] lstrlenW (lpString=".7z") returned 3
	[0082.598] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0082.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0082.598] lstrlenW (lpString=".dbf") returned 4
	[0082.598] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0082.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0082.598] lstrlenW (lpString=".1cd") returned 4
	[0082.598] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0082.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0082.599] lstrlenW (lpString=".jpg") returned 4
	[0082.599] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0082.599] lstrcmpiW (lpString1=".avi", lpString2=".adobe") returned 1
	[0082.599] lstrlenW (lpString="join.avi") returned 8
	[0082.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0082.599] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=222208) returned 1
	[0082.599] CloseHandle (hObject=0x1ac) returned 1
	[0082.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20
	[0082.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0082.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0082.600] lstrlenW (lpString=".doc") returned 4
	[0082.600] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0082.600] lstrlenW (lpString=".docx") returned 5
	[0082.600] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0082.600] lstrlenW (lpString=".pdf") returned 4
	[0082.600] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0082.600] lstrlenW (lpString=".xls") returned 4
	[0082.600] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0082.600] lstrlenW (lpString=".xlsx") returned 5
	[0082.600] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0082.600] lstrlenW (lpString=".ppt") returned 4
	[0082.600] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0082.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0082.600] lstrlenW (lpString=".zip") returned 4
	[0082.600] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0082.600] lstrlenW (lpString=".rar") returned 4
	[0082.600] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0082.601] lstrlenW (lpString=".bz2") returned 4
	[0082.601] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0082.601] lstrlenW (lpString=".7z") returned 3
	[0082.601] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0082.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0082.601] lstrlenW (lpString=".dbf") returned 4
	[0082.601] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0082.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0084.985] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.986] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0084.986] GetLastError () returned 0x0
	[0084.986] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x6931, lpOverlapped=0x0) returned 1
	[0085.015] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x6940, lpOverlapped=0x0) returned 1
	[0085.017] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.017] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0085.017] SetEndOfFile (hFile=0x188) returned 1
	[0085.026] CloseHandle (hObject=0x188) returned 1
	[0085.029] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.029] SetEndOfFile (hFile=0x1a8) returned 1
	[0085.035] CloseHandle (hObject=0x1a8) returned 1
	[0085.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.090] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1
	[0085.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0085.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0085.114] lstrlenW (lpString=".doc") returned 4
	[0085.114] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0085.114] lstrlenW (lpString=".docx") returned 5
	[0085.114] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1
	[0085.114] lstrlenW (lpString=".pdf") returned 4
	[0085.115] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0085.115] lstrlenW (lpString=".xls") returned 4
	[0085.115] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0085.115] lstrlenW (lpString=".xlsx") returned 5
	[0085.115] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1
	[0085.115] lstrlenW (lpString=".ppt") returned 4
	[0085.115] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0085.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0085.115] lstrlenW (lpString=".zip") returned 4
	[0085.115] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0085.115] lstrlenW (lpString=".rar") returned 4
	[0085.115] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0085.115] lstrlenW (lpString=".bz2") returned 4
	[0085.115] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0085.115] lstrlenW (lpString=".7z") returned 3
	[0085.115] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0085.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0085.115] lstrlenW (lpString=".dbf") returned 4
	[0085.115] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0085.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0085.115] lstrlenW (lpString=".1cd") returned 4
	[0085.115] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0085.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0085.115] lstrlenW (lpString=".jpg") returned 4
	[0085.115] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0085.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0085.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0085.116] lstrlenW (lpString=".doc") returned 4
	[0085.116] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0085.116] lstrlenW (lpString=".docx") returned 5
	[0085.116] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1
	[0085.116] lstrlenW (lpString=".pdf") returned 4
	[0085.116] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0085.116] lstrlenW (lpString=".xls") returned 4
	[0085.116] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0085.116] lstrlenW (lpString=".xlsx") returned 5
	[0085.116] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1
	[0085.116] lstrlenW (lpString=".ppt") returned 4
	[0085.116] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0085.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0085.116] lstrlenW (lpString=".zip") returned 4
	[0085.116] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0085.116] lstrlenW (lpString=".rar") returned 4
	[0085.116] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0085.116] lstrlenW (lpString=".bz2") returned 4
	[0085.116] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0085.116] lstrlenW (lpString=".7z") returned 3
	[0085.116] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0085.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0085.116] lstrlenW (lpString=".dbf") returned 4
	[0085.116] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0085.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0085.116] lstrlenW (lpString=".1cd") returned 4
	[0085.117] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0085.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0085.117] lstrlenW (lpString=".jpg") returned 4
	[0085.117] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0085.117] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.117] lstrlenW (lpString="SETUP.XML") returned 9
	[0085.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0085.132] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2362) returned 1
	[0085.132] CloseHandle (hObject=0x1ac) returned 1
	[0085.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20
	[0085.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0085.133] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.133] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.134] GetLastError () returned 0x0
	[0085.134] ReadFile (in: hFile=0x1ac, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x93a, lpOverlapped=0x0) returned 1
	[0085.150] WriteFile (in: hFile=0x1a4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x940, lpOverlapped=0x0) returned 1
	[0085.151] ReadFile (in: hFile=0x1ac, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.151] WriteFile (in: hFile=0x1a4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0085.151] SetEndOfFile (hFile=0x1a4) returned 1
	[0085.151] CloseHandle (hObject=0x1a4) returned 1
	[0085.152] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.152] SetEndOfFile (hFile=0x1ac) returned 1
	[0085.153] CloseHandle (hObject=0x1ac) returned 1
	[0085.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.153] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1
	[0085.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0085.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0085.154] lstrlenW (lpString=".doc") returned 4
	[0085.154] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.154] lstrlenW (lpString=".docx") returned 5
	[0085.154] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.154] lstrlenW (lpString=".pdf") returned 4
	[0085.154] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.154] lstrlenW (lpString=".xls") returned 4
	[0085.154] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.154] lstrlenW (lpString=".xlsx") returned 5
	[0085.154] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.154] lstrlenW (lpString=".ppt") returned 4
	[0085.154] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0085.154] lstrlenW (lpString=".zip") returned 4
	[0085.154] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.154] lstrlenW (lpString=".rar") returned 4
	[0085.154] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.154] lstrlenW (lpString=".bz2") returned 4
	[0085.154] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.154] lstrlenW (lpString=".7z") returned 3
	[0085.154] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0085.154] lstrlenW (lpString=".dbf") returned 4
	[0085.155] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0085.155] lstrlenW (lpString=".1cd") returned 4
	[0085.155] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0085.155] lstrlenW (lpString=".jpg") returned 4
	[0085.155] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0085.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0085.155] lstrlenW (lpString=".doc") returned 4
	[0085.155] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.155] lstrlenW (lpString=".docx") returned 5
	[0085.155] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.155] lstrlenW (lpString=".pdf") returned 4
	[0085.155] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.155] lstrlenW (lpString=".xls") returned 4
	[0085.155] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.155] lstrlenW (lpString=".xlsx") returned 5
	[0085.155] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.155] lstrlenW (lpString=".ppt") returned 4
	[0085.155] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0085.155] lstrlenW (lpString=".zip") returned 4
	[0085.155] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.156] lstrlenW (lpString=".rar") returned 4
	[0085.156] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.156] lstrlenW (lpString=".bz2") returned 4
	[0085.156] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.156] lstrlenW (lpString=".7z") returned 3
	[0085.156] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0085.156] lstrlenW (lpString=".dbf") returned 4
	[0085.156] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0085.156] lstrlenW (lpString=".1cd") returned 4
	[0085.156] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0085.156] lstrlenW (lpString=".jpg") returned 4
	[0085.156] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.156] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.156] lstrlenW (lpString="OneNoteMUI.XML") returned 14
	[0085.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0085.157] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1606) returned 1
	[0085.157] CloseHandle (hObject=0x1ac) returned 1
	[0085.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20
	[0085.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0085.158] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.158] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0085.274] GetLastError () returned 0x0
	[0085.274] ReadFile (in: hFile=0x1ac, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x646, lpOverlapped=0x0) returned 1
	[0085.280] WriteFile (in: hFile=0x1b0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x650, lpOverlapped=0x0) returned 1
	[0085.281] ReadFile (in: hFile=0x1ac, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.281] WriteFile (in: hFile=0x1b0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0085.281] SetEndOfFile (hFile=0x1b0) returned 1
	[0085.281] CloseHandle (hObject=0x1b0) returned 1
	[0085.282] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.282] SetEndOfFile (hFile=0x1ac) returned 1
	[0085.283] CloseHandle (hObject=0x1ac) returned 1
	[0085.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.283] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1
	[0085.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0085.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0085.284] lstrlenW (lpString=".doc") returned 4
	[0085.284] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.284] lstrlenW (lpString=".docx") returned 5
	[0085.284] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0085.284] lstrlenW (lpString=".pdf") returned 4
	[0085.284] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.284] lstrlenW (lpString=".xls") returned 4
	[0085.284] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.284] lstrlenW (lpString=".xlsx") returned 5
	[0085.284] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0085.284] lstrlenW (lpString=".ppt") returned 4
	[0085.284] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0085.284] lstrlenW (lpString=".zip") returned 4
	[0085.284] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.284] lstrlenW (lpString=".rar") returned 4
	[0085.284] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.284] lstrlenW (lpString=".bz2") returned 4
	[0085.284] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.284] lstrlenW (lpString=".7z") returned 3
	[0085.284] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0085.284] lstrlenW (lpString=".dbf") returned 4
	[0085.284] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0085.285] lstrlenW (lpString=".1cd") returned 4
	[0085.285] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0085.285] lstrlenW (lpString=".jpg") returned 4
	[0085.285] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0085.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0085.285] lstrlenW (lpString=".doc") returned 4
	[0085.285] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.285] lstrlenW (lpString=".docx") returned 5
	[0085.285] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0085.285] lstrlenW (lpString=".pdf") returned 4
	[0085.285] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.285] lstrlenW (lpString=".xls") returned 4
	[0085.285] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.285] lstrlenW (lpString=".xlsx") returned 5
	[0085.285] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0085.285] lstrlenW (lpString=".ppt") returned 4
	[0085.285] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0085.285] lstrlenW (lpString=".zip") returned 4
	[0085.285] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.285] lstrlenW (lpString=".rar") returned 4
	[0085.285] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.285] lstrlenW (lpString=".bz2") returned 4
	[0085.285] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.286] lstrlenW (lpString=".7z") returned 3
	[0085.286] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0085.286] lstrlenW (lpString=".dbf") returned 4
	[0085.286] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0085.286] lstrlenW (lpString=".1cd") returned 4
	[0085.286] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0085.286] lstrlenW (lpString=".jpg") returned 4
	[0085.286] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.286] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.286] lstrlenW (lpString="OutlookMUI.XML") returned 14
	[0085.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0085.287] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3186) returned 1
	[0085.287] CloseHandle (hObject=0x1ac) returned 1
	[0085.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20
	[0085.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0085.288] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.288] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0085.335] GetLastError () returned 0x0
	[0085.335] ReadFile (in: hFile=0x1ac, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xc72, lpOverlapped=0x0) returned 1
	[0085.351] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xc80, lpOverlapped=0x0) returned 1
	[0085.354] ReadFile (in: hFile=0x1ac, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.354] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0085.354] SetEndOfFile (hFile=0x1a8) returned 1
	[0085.354] CloseHandle (hObject=0x1a8) returned 1
	[0085.354] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.354] SetEndOfFile (hFile=0x1ac) returned 1
	[0085.355] CloseHandle (hObject=0x1ac) returned 1
	[0085.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.356] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1
	[0085.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0085.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0085.356] lstrlenW (lpString=".doc") returned 4
	[0085.356] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.356] lstrlenW (lpString=".docx") returned 5
	[0085.356] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0085.356] lstrlenW (lpString=".pdf") returned 4
	[0085.356] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.356] lstrlenW (lpString=".xls") returned 4
	[0085.356] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.356] lstrlenW (lpString=".xlsx") returned 5
	[0085.357] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0085.357] lstrlenW (lpString=".ppt") returned 4
	[0085.357] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0085.357] lstrlenW (lpString=".zip") returned 4
	[0085.357] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.357] lstrlenW (lpString=".rar") returned 4
	[0085.357] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.357] lstrlenW (lpString=".bz2") returned 4
	[0085.357] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.357] lstrlenW (lpString=".7z") returned 3
	[0085.357] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0085.357] lstrlenW (lpString=".dbf") returned 4
	[0085.357] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0085.357] lstrlenW (lpString=".1cd") returned 4
	[0085.357] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0085.357] lstrlenW (lpString=".jpg") returned 4
	[0085.357] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0085.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0085.357] lstrlenW (lpString=".doc") returned 4
	[0085.357] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.358] lstrlenW (lpString=".docx") returned 5
	[0085.358] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0085.358] lstrlenW (lpString=".pdf") returned 4
	[0085.358] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.358] lstrlenW (lpString=".xls") returned 4
	[0085.358] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.358] lstrlenW (lpString=".xlsx") returned 5
	[0085.358] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0085.358] lstrlenW (lpString=".ppt") returned 4
	[0085.358] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0085.358] lstrlenW (lpString=".zip") returned 4
	[0085.358] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.358] lstrlenW (lpString=".rar") returned 4
	[0085.358] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.358] lstrlenW (lpString=".bz2") returned 4
	[0085.358] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.358] lstrlenW (lpString=".7z") returned 3
	[0085.358] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0085.358] lstrlenW (lpString=".dbf") returned 4
	[0085.358] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0085.358] lstrlenW (lpString=".1cd") returned 4
	[0085.358] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0085.359] lstrlenW (lpString=".jpg") returned 4
	[0085.359] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.359] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.359] lstrlenW (lpString="SETUP.XML") returned 9
	[0085.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0085.493] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=16683) returned 1
	[0085.493] CloseHandle (hObject=0x19c) returned 1
	[0085.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20
	[0085.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.763] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.763] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0085.886] GetLastError () returned 0x0
	[0085.886] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x412b, lpOverlapped=0x0) returned 1
	[0085.900] WriteFile (in: hFile=0x1b0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x4130, lpOverlapped=0x0) returned 1
	[0085.901] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.901] WriteFile (in: hFile=0x1b0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0085.901] SetEndOfFile (hFile=0x1b0) returned 1
	[0085.901] CloseHandle (hObject=0x1b0) returned 1
	[0085.902] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.902] SetEndOfFile (hFile=0x198) returned 1
	[0085.903] CloseHandle (hObject=0x198) returned 1
	[0085.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.903] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1
	[0085.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0085.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0085.903] lstrlenW (lpString=".doc") returned 4
	[0085.903] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.903] lstrlenW (lpString=".docx") returned 5
	[0085.903] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.903] lstrlenW (lpString=".pdf") returned 4
	[0085.903] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.903] lstrlenW (lpString=".xls") returned 4
	[0085.903] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.903] lstrlenW (lpString=".xlsx") returned 5
	[0085.903] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.903] lstrlenW (lpString=".ppt") returned 4
	[0085.903] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0085.904] lstrlenW (lpString=".zip") returned 4
	[0085.904] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.904] lstrlenW (lpString=".rar") returned 4
	[0085.904] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.904] lstrlenW (lpString=".bz2") returned 4
	[0085.904] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.904] lstrlenW (lpString=".7z") returned 3
	[0085.904] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0085.904] lstrlenW (lpString=".dbf") returned 4
	[0085.904] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0085.904] lstrlenW (lpString=".1cd") returned 4
	[0085.904] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0085.904] lstrlenW (lpString=".jpg") returned 4
	[0085.904] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0085.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0085.904] lstrlenW (lpString=".doc") returned 4
	[0085.904] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.904] lstrlenW (lpString=".docx") returned 5
	[0085.904] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.904] lstrlenW (lpString=".pdf") returned 4
	[0085.904] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.904] lstrlenW (lpString=".xls") returned 4
	[0085.904] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.904] lstrlenW (lpString=".xlsx") returned 5
	[0085.904] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.904] lstrlenW (lpString=".ppt") returned 4
	[0085.904] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0085.905] lstrlenW (lpString=".zip") returned 4
	[0085.905] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.905] lstrlenW (lpString=".rar") returned 4
	[0085.905] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.905] lstrlenW (lpString=".bz2") returned 4
	[0085.905] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.905] lstrlenW (lpString=".7z") returned 3
	[0085.905] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0085.905] lstrlenW (lpString=".dbf") returned 4
	[0085.905] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0085.905] lstrlenW (lpString=".1cd") returned 4
	[0085.905] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0085.905] lstrlenW (lpString=".jpg") returned 4
	[0085.905] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.905] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.905] lstrlenW (lpString="SETUP.XML") returned 9
	[0085.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.984] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1608) returned 1
	[0085.984] CloseHandle (hObject=0x1a4) returned 1
	[0085.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20
	[0085.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.985] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.985] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0085.985] GetLastError () returned 0x0
	[0085.985] ReadFile (in: hFile=0x1a4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x648, lpOverlapped=0x0) returned 1
	[0086.011] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x650, lpOverlapped=0x0) returned 1
	[0086.012] ReadFile (in: hFile=0x1a4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.012] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0086.012] SetEndOfFile (hFile=0x160) returned 1
	[0086.012] CloseHandle (hObject=0x160) returned 1
	[0086.012] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.012] SetEndOfFile (hFile=0x1a4) returned 1
	[0086.013] CloseHandle (hObject=0x1a4) returned 1
	[0086.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.014] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1
	[0086.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0086.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0086.014] lstrlenW (lpString=".doc") returned 4
	[0086.014] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.014] lstrlenW (lpString=".docx") returned 5
	[0086.014] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0086.014] lstrlenW (lpString=".pdf") returned 4
	[0086.014] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.014] lstrlenW (lpString=".xls") returned 4
	[0086.014] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.014] lstrlenW (lpString=".xlsx") returned 5
	[0086.014] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0086.014] lstrlenW (lpString=".ppt") returned 4
	[0086.014] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0086.014] lstrlenW (lpString=".zip") returned 4
	[0086.014] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.014] lstrlenW (lpString=".rar") returned 4
	[0086.014] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.014] lstrlenW (lpString=".bz2") returned 4
	[0086.014] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.014] lstrlenW (lpString=".7z") returned 3
	[0086.014] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0086.015] lstrlenW (lpString=".dbf") returned 4
	[0086.015] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0086.015] lstrlenW (lpString=".1cd") returned 4
	[0086.015] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0086.015] lstrlenW (lpString=".jpg") returned 4
	[0086.015] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0086.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0086.015] lstrlenW (lpString=".doc") returned 4
	[0086.015] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.015] lstrlenW (lpString=".docx") returned 5
	[0086.015] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0086.015] lstrlenW (lpString=".pdf") returned 4
	[0086.015] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.015] lstrlenW (lpString=".xls") returned 4
	[0086.015] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.015] lstrlenW (lpString=".xlsx") returned 5
	[0086.015] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0086.015] lstrlenW (lpString=".ppt") returned 4
	[0086.015] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0086.015] lstrlenW (lpString=".zip") returned 4
	[0086.015] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.015] lstrlenW (lpString=".rar") returned 4
	[0086.015] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.015] lstrlenW (lpString=".bz2") returned 4
	[0086.015] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.015] lstrlenW (lpString=".7z") returned 3
	[0086.015] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0086.016] lstrlenW (lpString=".dbf") returned 4
	[0086.016] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0086.016] lstrlenW (lpString=".1cd") returned 4
	[0086.016] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0086.016] lstrlenW (lpString=".jpg") returned 4
	[0086.016] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.016] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0086.016] lstrlenW (lpString="VisioMUI.XML") returned 12
	[0086.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.035] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=9503) returned 1
	[0086.035] CloseHandle (hObject=0x194) returned 1
	[0086.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20
	[0086.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0086.056] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.056] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.058] GetLastError () returned 0x0
	[0086.058] ReadFile (in: hFile=0x1a4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x251f, lpOverlapped=0x0) returned 1
	[0086.067] WriteFile (in: hFile=0x194, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2520, lpOverlapped=0x0) returned 1
	[0086.068] ReadFile (in: hFile=0x1a4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.068] WriteFile (in: hFile=0x194, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0086.068] SetEndOfFile (hFile=0x194) returned 1
	[0086.068] CloseHandle (hObject=0x194) returned 1
	[0086.068] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.068] SetEndOfFile (hFile=0x1a4) returned 1
	[0086.069] CloseHandle (hObject=0x1a4) returned 1
	[0086.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.069] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1
	[0086.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0086.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0086.070] lstrlenW (lpString=".doc") returned 4
	[0086.070] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.070] lstrlenW (lpString=".docx") returned 5
	[0086.070] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0086.070] lstrlenW (lpString=".pdf") returned 4
	[0086.070] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.070] lstrlenW (lpString=".xls") returned 4
	[0086.070] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.070] lstrlenW (lpString=".xlsx") returned 5
	[0086.070] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0086.070] lstrlenW (lpString=".ppt") returned 4
	[0086.070] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0086.070] lstrlenW (lpString=".zip") returned 4
	[0086.070] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.070] lstrlenW (lpString=".rar") returned 4
	[0086.070] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.070] lstrlenW (lpString=".bz2") returned 4
	[0086.070] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.070] lstrlenW (lpString=".7z") returned 3
	[0086.070] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0086.070] lstrlenW (lpString=".dbf") returned 4
	[0086.070] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0086.070] lstrlenW (lpString=".1cd") returned 4
	[0086.070] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0086.070] lstrlenW (lpString=".jpg") returned 4
	[0086.070] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0086.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0086.071] lstrlenW (lpString=".doc") returned 4
	[0086.071] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.071] lstrlenW (lpString=".docx") returned 5
	[0086.071] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0086.071] lstrlenW (lpString=".pdf") returned 4
	[0086.071] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.071] lstrlenW (lpString=".xls") returned 4
	[0086.071] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.071] lstrlenW (lpString=".xlsx") returned 5
	[0086.071] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0086.071] lstrlenW (lpString=".ppt") returned 4
	[0086.071] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0086.071] lstrlenW (lpString=".zip") returned 4
	[0086.071] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.071] lstrlenW (lpString=".rar") returned 4
	[0086.071] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.071] lstrlenW (lpString=".bz2") returned 4
	[0086.071] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.071] lstrlenW (lpString=".7z") returned 3
	[0086.071] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0086.071] lstrlenW (lpString=".dbf") returned 4
	[0086.071] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0086.071] lstrlenW (lpString=".1cd") returned 4
	[0086.071] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0086.071] lstrlenW (lpString=".jpg") returned 4
	[0086.071] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.072] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0086.072] lstrlenW (lpString="WordMUI.XML") returned 11
	[0086.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.223] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1800) returned 1
	[0086.223] CloseHandle (hObject=0x19c) returned 1
	[0086.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20
	[0086.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0086.272] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.272] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0086.277] GetLastError () returned 0x0
	[0086.277] ReadFile (in: hFile=0x1a4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x708, lpOverlapped=0x0) returned 1
	[0086.279] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x710, lpOverlapped=0x0) returned 1
	[0086.280] ReadFile (in: hFile=0x1a4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.280] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0086.281] SetEndOfFile (hFile=0x1b4) returned 1
	[0086.281] CloseHandle (hObject=0x1b4) returned 1
	[0086.281] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.281] SetEndOfFile (hFile=0x1a4) returned 1
	[0086.282] CloseHandle (hObject=0x1a4) returned 1
	[0086.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.283] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1
	[0086.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0086.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0086.283] lstrlenW (lpString=".doc") returned 4
	[0086.283] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.283] lstrlenW (lpString=".docx") returned 5
	[0086.283] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0086.283] lstrlenW (lpString=".pdf") returned 4
	[0086.283] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.283] lstrlenW (lpString=".xls") returned 4
	[0086.283] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.283] lstrlenW (lpString=".xlsx") returned 5
	[0086.283] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0086.283] lstrlenW (lpString=".ppt") returned 4
	[0086.283] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0086.283] lstrlenW (lpString=".zip") returned 4
	[0086.283] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.284] lstrlenW (lpString=".rar") returned 4
	[0086.284] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.284] lstrlenW (lpString=".bz2") returned 4
	[0086.284] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.284] lstrlenW (lpString=".7z") returned 3
	[0086.284] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0086.284] lstrlenW (lpString=".dbf") returned 4
	[0086.284] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0086.284] lstrlenW (lpString=".1cd") returned 4
	[0086.284] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0086.284] lstrlenW (lpString=".jpg") returned 4
	[0086.284] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0086.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0086.284] lstrlenW (lpString=".doc") returned 4
	[0086.284] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.284] lstrlenW (lpString=".docx") returned 5
	[0086.284] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0086.284] lstrlenW (lpString=".pdf") returned 4
	[0086.284] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.284] lstrlenW (lpString=".xls") returned 4
	[0086.284] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.284] lstrlenW (lpString=".xlsx") returned 5
	[0086.285] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0086.285] lstrlenW (lpString=".ppt") returned 4
	[0086.285] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0086.285] lstrlenW (lpString=".zip") returned 4
	[0086.285] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.285] lstrlenW (lpString=".rar") returned 4
	[0086.285] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.285] lstrlenW (lpString=".bz2") returned 4
	[0086.285] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.285] lstrlenW (lpString=".7z") returned 3
	[0086.285] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0086.285] lstrlenW (lpString=".dbf") returned 4
	[0086.285] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0086.285] lstrlenW (lpString=".1cd") returned 4
	[0086.285] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0086.285] lstrlenW (lpString=".jpg") returned 4
	[0086.285] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.285] lstrcmpiW (lpString1=".DAT", lpString2=".adobe") returned 1
	[0086.286] lstrlenW (lpString="STOCKS.DAT") returned 10
	[0086.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.358] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=39017) returned 1
	[0086.358] CloseHandle (hObject=0x174) returned 1
	[0086.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20
	[0086.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0086.746] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.746] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.776] GetLastError () returned 0x0
	[0086.776] ReadFile (in: hFile=0x1a4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x9869, lpOverlapped=0x0) returned 1
	[0086.781] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x9870, lpOverlapped=0x0) returned 1
	[0086.784] ReadFile (in: hFile=0x1a4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.784] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0086.784] SetEndOfFile (hFile=0x174) returned 1
	[0086.785] CloseHandle (hObject=0x174) returned 1
	[0086.789] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.789] SetEndOfFile (hFile=0x1a4) returned 1
	[0086.832] CloseHandle (hObject=0x1a4) returned 1
	[0086.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.950] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1
	[0087.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0087.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0087.010] lstrlenW (lpString=".doc") returned 4
	[0087.010] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0087.010] lstrlenW (lpString=".docx") returned 5
	[0087.010] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1
	[0087.010] lstrlenW (lpString=".pdf") returned 4
	[0087.010] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0087.010] lstrlenW (lpString=".xls") returned 4
	[0087.010] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0087.010] lstrlenW (lpString=".xlsx") returned 5
	[0087.010] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1
	[0087.010] lstrlenW (lpString=".ppt") returned 4
	[0087.010] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0087.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0087.010] lstrlenW (lpString=".zip") returned 4
	[0087.010] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0087.010] lstrlenW (lpString=".rar") returned 4
	[0087.010] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0087.010] lstrlenW (lpString=".bz2") returned 4
	[0087.010] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0087.010] lstrlenW (lpString=".7z") returned 3
	[0087.010] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0087.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0087.010] lstrlenW (lpString=".dbf") returned 4
	[0087.010] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0087.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0087.011] lstrlenW (lpString=".1cd") returned 4
	[0087.011] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0087.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0087.011] lstrlenW (lpString=".jpg") returned 4
	[0087.011] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0087.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0087.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0087.011] lstrlenW (lpString=".doc") returned 4
	[0087.011] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0087.011] lstrlenW (lpString=".docx") returned 5
	[0087.011] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1
	[0087.011] lstrlenW (lpString=".pdf") returned 4
	[0087.011] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0087.011] lstrlenW (lpString=".xls") returned 4
	[0087.011] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0087.011] lstrlenW (lpString=".xlsx") returned 5
	[0087.011] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1
	[0087.011] lstrlenW (lpString=".ppt") returned 4
	[0087.011] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0087.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0087.011] lstrlenW (lpString=".zip") returned 4
	[0087.011] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0087.011] lstrlenW (lpString=".rar") returned 4
	[0087.011] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0087.011] lstrlenW (lpString=".bz2") returned 4
	[0087.011] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0087.012] lstrlenW (lpString=".7z") returned 3
	[0087.012] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0087.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0087.012] lstrlenW (lpString=".dbf") returned 4
	[0087.012] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0087.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0087.012] lstrlenW (lpString=".1cd") returned 4
	[0087.012] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0087.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0087.012] lstrlenW (lpString=".jpg") returned 4
	[0087.012] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0087.012] lstrcmpiW (lpString1=".emf", lpString2=".adobe") returned 1
	[0087.012] lstrlenW (lpString="Genko_2.emf") returned 11
	[0087.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0087.025] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=10340) returned 1
	[0087.025] CloseHandle (hObject=0x19c) returned 1
	[0087.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20
	[0087.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0087.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0087.062] lstrlenW (lpString=".doc") returned 4
	[0087.062] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0087.062] lstrlenW (lpString=".docx") returned 5
	[0087.062] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1
	[0087.062] lstrlenW (lpString=".pdf") returned 4
	[0087.062] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0087.062] lstrlenW (lpString=".xls") returned 4
	[0087.062] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0087.062] lstrlenW (lpString=".xlsx") returned 5
	[0087.062] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1
	[0087.062] lstrlenW (lpString=".ppt") returned 4
	[0087.062] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0087.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0087.063] lstrlenW (lpString=".zip") returned 4
	[0087.063] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0087.063] lstrlenW (lpString=".rar") returned 4
	[0087.063] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0087.063] lstrlenW (lpString=".bz2") returned 4
	[0087.063] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0087.063] lstrlenW (lpString=".7z") returned 3
	[0087.063] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0087.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0087.063] lstrlenW (lpString=".dbf") returned 4
	[0087.063] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0087.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0087.063] lstrlenW (lpString=".1cd") returned 4
	[0087.063] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0087.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0087.063] lstrlenW (lpString=".jpg") returned 4
	[0087.063] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0087.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0087.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0087.063] lstrlenW (lpString=".doc") returned 4
	[0087.063] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0087.063] lstrlenW (lpString=".docx") returned 5
	[0087.063] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1
	[0087.063] lstrlenW (lpString=".pdf") returned 4
	[0087.063] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0087.063] lstrlenW (lpString=".xls") returned 4
	[0087.064] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0087.064] lstrlenW (lpString=".xlsx") returned 5
	[0087.064] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1
	[0087.064] lstrlenW (lpString=".ppt") returned 4
	[0087.064] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0087.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0087.064] lstrlenW (lpString=".zip") returned 4
	[0087.064] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0087.064] lstrlenW (lpString=".rar") returned 4
	[0087.064] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0087.064] lstrlenW (lpString=".bz2") returned 4
	[0087.064] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0087.064] lstrlenW (lpString=".7z") returned 3
	[0087.064] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0087.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0087.064] lstrlenW (lpString=".dbf") returned 4
	[0087.064] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0087.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0087.064] lstrlenW (lpString=".1cd") returned 4
	[0087.064] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0087.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0087.064] lstrlenW (lpString=".jpg") returned 4
	[0087.064] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0087.065] lstrcmpiW (lpString1=".jpg", lpString2=".adobe") returned 1
	[0087.065] lstrlenW (lpString="GreenBubbles.jpg") returned 16
	[0087.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0087.127] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=6406) returned 1
	[0087.127] CloseHandle (hObject=0x1b4) returned 1
	[0087.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20
	[0087.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0087.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0087.226] lstrlenW (lpString=".doc") returned 4
	[0087.226] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0087.226] lstrlenW (lpString=".docx") returned 5
	[0087.226] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0087.226] lstrlenW (lpString=".pdf") returned 4
	[0087.226] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0087.226] lstrlenW (lpString=".xls") returned 4
	[0087.226] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0087.226] lstrlenW (lpString=".xlsx") returned 5
	[0087.226] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0087.226] lstrlenW (lpString=".ppt") returned 4
	[0087.226] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0087.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0087.227] lstrlenW (lpString=".zip") returned 4
	[0087.227] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0087.227] lstrlenW (lpString=".rar") returned 4
	[0087.227] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0087.227] lstrlenW (lpString=".bz2") returned 4
	[0087.227] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0087.227] lstrlenW (lpString=".7z") returned 3
	[0087.227] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0087.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0087.227] lstrlenW (lpString=".dbf") returned 4
	[0087.227] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0087.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0087.227] lstrlenW (lpString=".1cd") returned 4
	[0087.227] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0087.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0087.227] lstrlenW (lpString=".jpg") returned 4
	[0087.227] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0087.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0087.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0087.227] lstrlenW (lpString=".doc") returned 4
	[0087.227] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0087.227] lstrlenW (lpString=".docx") returned 5
	[0087.227] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0087.227] lstrlenW (lpString=".pdf") returned 4
	[0087.227] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0087.227] lstrlenW (lpString=".xls") returned 4
	[0087.228] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0087.228] lstrlenW (lpString=".xlsx") returned 5
	[0087.228] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0087.228] lstrlenW (lpString=".ppt") returned 4
	[0087.228] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0087.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0087.228] lstrlenW (lpString=".zip") returned 4
	[0087.228] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0087.228] lstrlenW (lpString=".rar") returned 4
	[0087.228] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0087.228] lstrlenW (lpString=".bz2") returned 4
	[0087.228] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0087.228] lstrlenW (lpString=".7z") returned 3
	[0087.228] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0087.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0087.228] lstrlenW (lpString=".dbf") returned 4
	[0087.228] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0087.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0087.228] lstrlenW (lpString=".1cd") returned 4
	[0087.228] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0087.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0087.228] lstrlenW (lpString=".jpg") returned 4
	[0087.228] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0087.229] lstrcmpiW (lpString1=".htm", lpString2=".adobe") returned 1
	[0087.229] lstrlenW (lpString="Hand Prints.htm") returned 15
	[0087.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0087.259] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=235) returned 1
	[0087.259] CloseHandle (hObject=0x190) returned 1
	[0087.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20
	[0087.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0087.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0087.290] lstrlenW (lpString=".doc") returned 4
	[0087.290] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0087.290] lstrlenW (lpString=".docx") returned 5
	[0087.290] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0087.290] lstrlenW (lpString=".pdf") returned 4
	[0087.290] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0087.290] lstrlenW (lpString=".xls") returned 4
	[0087.290] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0087.290] lstrlenW (lpString=".xlsx") returned 5
	[0087.290] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0087.290] lstrlenW (lpString=".ppt") returned 4
	[0087.290] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0087.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0087.290] lstrlenW (lpString=".zip") returned 4
	[0087.290] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0087.291] lstrlenW (lpString=".rar") returned 4
	[0087.291] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0087.291] lstrlenW (lpString=".bz2") returned 4
	[0087.291] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0087.291] lstrlenW (lpString=".7z") returned 3
	[0087.291] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0087.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0087.291] lstrlenW (lpString=".dbf") returned 4
	[0087.291] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0087.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0087.291] lstrlenW (lpString=".1cd") returned 4
	[0087.291] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0087.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0087.291] lstrlenW (lpString=".jpg") returned 4
	[0087.291] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0087.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0087.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0087.291] lstrlenW (lpString=".doc") returned 4
	[0087.291] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0087.291] lstrlenW (lpString=".docx") returned 5
	[0087.291] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0087.291] lstrlenW (lpString=".pdf") returned 4
	[0087.291] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0087.291] lstrlenW (lpString=".xls") returned 4
	[0087.291] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0087.291] lstrlenW (lpString=".xlsx") returned 5
	[0087.292] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0087.292] lstrlenW (lpString=".ppt") returned 4
	[0087.292] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0087.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0087.292] lstrlenW (lpString=".zip") returned 4
	[0087.292] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0087.292] lstrlenW (lpString=".rar") returned 4
	[0087.292] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0087.292] lstrlenW (lpString=".bz2") returned 4
	[0087.292] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0087.292] lstrlenW (lpString=".7z") returned 3
	[0087.292] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0087.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0087.292] lstrlenW (lpString=".dbf") returned 4
	[0087.292] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0087.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0087.292] lstrlenW (lpString=".1cd") returned 4
	[0087.292] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0087.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0087.292] lstrlenW (lpString=".jpg") returned 4
	[0087.292] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0087.292] lstrcmpiW (lpString1=".emf", lpString2=".adobe") returned 1
	[0087.292] lstrlenW (lpString="Month_Calendar.emf") returned 18
	[0087.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.335] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=4192) returned 1
	[0087.335] CloseHandle (hObject=0x174) returned 1
	[0087.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf")) returned 0x20
	[0087.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 76
	[0087.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 76
	[0087.377] lstrlenW (lpString=".doc") returned 4
	[0087.377] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0087.377] lstrlenW (lpString=".docx") returned 5
	[0087.377] lstrcmpiW (lpString1=".docx", lpString2="r.emf") returned -1
	[0087.377] lstrlenW (lpString=".pdf") returned 4
	[0087.377] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0087.377] lstrlenW (lpString=".xls") returned 4
	[0087.377] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0087.377] lstrlenW (lpString=".xlsx") returned 5
	[0087.378] lstrcmpiW (lpString1=".xlsx", lpString2="r.emf") returned -1
	[0087.378] lstrlenW (lpString=".ppt") returned 4
	[0087.378] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0087.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 76
	[0087.378] lstrlenW (lpString=".zip") returned 4
	[0087.378] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0087.378] lstrlenW (lpString=".rar") returned 4
	[0087.378] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0087.378] lstrlenW (lpString=".bz2") returned 4
	[0087.378] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0087.378] lstrlenW (lpString=".7z") returned 3
	[0087.378] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0087.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 76
	[0087.378] lstrlenW (lpString=".dbf") returned 4
	[0087.378] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0087.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 76
	[0087.378] lstrlenW (lpString=".1cd") returned 4
	[0087.378] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0087.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 76
	[0087.378] lstrlenW (lpString=".jpg") returned 4
	[0087.378] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0087.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 76
	[0087.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 76
	[0087.378] lstrlenW (lpString=".doc") returned 4
	[0087.378] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0087.378] lstrlenW (lpString=".docx") returned 5
	[0087.378] lstrcmpiW (lpString1=".docx", lpString2="r.emf") returned -1
	[0087.379] lstrlenW (lpString=".pdf") returned 4
	[0087.379] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0087.379] lstrlenW (lpString=".xls") returned 4
	[0087.379] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0087.379] lstrlenW (lpString=".xlsx") returned 5
	[0087.379] lstrcmpiW (lpString1=".xlsx", lpString2="r.emf") returned -1
	[0087.379] lstrlenW (lpString=".ppt") returned 4
	[0087.379] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0087.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 76
	[0087.379] lstrlenW (lpString=".zip") returned 4
	[0087.379] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0087.379] lstrlenW (lpString=".rar") returned 4
	[0087.379] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0087.379] lstrlenW (lpString=".bz2") returned 4
	[0087.379] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0087.379] lstrlenW (lpString=".7z") returned 3
	[0087.379] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0087.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 76
	[0087.379] lstrlenW (lpString=".dbf") returned 4
	[0087.379] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0087.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 76
	[0087.379] lstrlenW (lpString=".1cd") returned 4
	[0087.379] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0087.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 76
	[0087.379] lstrlenW (lpString=".jpg") returned 4
	[0087.379] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0087.380] lstrcmpiW (lpString1=".jpg", lpString2=".adobe") returned 1
	[0087.380] lstrlenW (lpString="OrangeCircles.jpg") returned 17
	[0087.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0087.406] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=6381) returned 1
	[0087.406] CloseHandle (hObject=0x19c) returned 1
	[0087.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20
	[0087.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0087.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0087.705] lstrlenW (lpString=".doc") returned 4
	[0087.705] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0087.705] lstrlenW (lpString=".docx") returned 5
	[0087.705] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0087.705] lstrlenW (lpString=".pdf") returned 4
	[0087.705] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0087.705] lstrlenW (lpString=".xls") returned 4
	[0087.705] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0087.705] lstrlenW (lpString=".xlsx") returned 5
	[0087.705] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0087.705] lstrlenW (lpString=".ppt") returned 4
	[0087.705] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0087.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0087.705] lstrlenW (lpString=".zip") returned 4
	[0087.705] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0087.705] lstrlenW (lpString=".rar") returned 4
	[0087.705] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0087.705] lstrlenW (lpString=".bz2") returned 4
	[0087.705] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0087.706] lstrlenW (lpString=".7z") returned 3
	[0087.706] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0087.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0087.706] lstrlenW (lpString=".dbf") returned 4
	[0087.706] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0087.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0087.706] lstrlenW (lpString=".1cd") returned 4
	[0087.706] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0087.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0087.706] lstrlenW (lpString=".jpg") returned 4
	[0087.706] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0087.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0087.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0087.706] lstrlenW (lpString=".doc") returned 4
	[0087.706] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0087.706] lstrlenW (lpString=".docx") returned 5
	[0087.706] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0087.706] lstrlenW (lpString=".pdf") returned 4
	[0087.706] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0087.706] lstrlenW (lpString=".xls") returned 4
	[0087.706] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0087.706] lstrlenW (lpString=".xlsx") returned 5
	[0087.706] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0087.706] lstrlenW (lpString=".ppt") returned 4
	[0087.706] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0087.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0087.707] lstrlenW (lpString=".zip") returned 4
	[0087.707] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0087.707] lstrlenW (lpString=".rar") returned 4
	[0087.707] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0087.707] lstrlenW (lpString=".bz2") returned 4
	[0087.707] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0087.707] lstrlenW (lpString=".7z") returned 3
	[0087.707] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0087.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0087.707] lstrlenW (lpString=".dbf") returned 4
	[0087.707] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0087.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0087.707] lstrlenW (lpString=".1cd") returned 4
	[0087.707] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0087.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0087.707] lstrlenW (lpString=".jpg") returned 4
	[0087.707] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0087.707] lstrcmpiW (lpString1=".jpg", lpString2=".adobe") returned 1
	[0087.707] lstrlenW (lpString="Pretty_Peacock.jpg") returned 18
	[0087.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0087.812] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=5115) returned 1
	[0087.812] CloseHandle (hObject=0x160) returned 1
	[0087.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0x20
	[0087.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76
	[0087.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76
	[0087.879] lstrlenW (lpString=".doc") returned 4
	[0087.879] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0087.879] lstrlenW (lpString=".docx") returned 5
	[0087.879] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1
	[0087.879] lstrlenW (lpString=".pdf") returned 4
	[0087.879] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0087.879] lstrlenW (lpString=".xls") returned 4
	[0087.879] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0087.879] lstrlenW (lpString=".xlsx") returned 5
	[0087.879] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1
	[0087.880] lstrlenW (lpString=".ppt") returned 4
	[0087.880] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0087.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76
	[0087.880] lstrlenW (lpString=".zip") returned 4
	[0087.880] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0087.880] lstrlenW (lpString=".rar") returned 4
	[0087.880] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0087.880] lstrlenW (lpString=".bz2") returned 4
	[0087.880] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0087.880] lstrlenW (lpString=".7z") returned 3
	[0087.880] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0087.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76
	[0087.880] lstrlenW (lpString=".dbf") returned 4
	[0087.880] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0088.452] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.452] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.458] GetLastError () returned 0x0
	[0088.458] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x621, lpOverlapped=0x0) returned 1
	[0088.463] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x630, lpOverlapped=0x0) returned 1
	[0088.464] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.464] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.464] SetEndOfFile (hFile=0x174) returned 1
	[0088.464] CloseHandle (hObject=0x174) returned 1
	[0088.465] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.465] SetEndOfFile (hFile=0x160) returned 1
	[0088.466] CloseHandle (hObject=0x160) returned 1
	[0088.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.466] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1
	[0088.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0088.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0088.467] lstrlenW (lpString=".doc") returned 4
	[0088.467] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.467] lstrlenW (lpString=".docx") returned 5
	[0088.467] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.467] lstrlenW (lpString=".pdf") returned 4
	[0088.467] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.467] lstrlenW (lpString=".xls") returned 4
	[0088.467] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.467] lstrlenW (lpString=".xlsx") returned 5
	[0088.467] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.467] lstrlenW (lpString=".ppt") returned 4
	[0088.467] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0088.467] lstrlenW (lpString=".zip") returned 4
	[0088.467] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.467] lstrlenW (lpString=".rar") returned 4
	[0088.467] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.467] lstrlenW (lpString=".bz2") returned 4
	[0088.467] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.467] lstrlenW (lpString=".7z") returned 3
	[0088.468] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0088.468] lstrlenW (lpString=".dbf") returned 4
	[0088.468] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0088.468] lstrlenW (lpString=".1cd") returned 4
	[0088.468] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0088.468] lstrlenW (lpString=".jpg") returned 4
	[0088.468] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0088.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0088.468] lstrlenW (lpString=".doc") returned 4
	[0088.468] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.468] lstrlenW (lpString=".docx") returned 5
	[0088.468] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.468] lstrlenW (lpString=".pdf") returned 4
	[0088.468] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.468] lstrlenW (lpString=".xls") returned 4
	[0088.468] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.468] lstrlenW (lpString=".xlsx") returned 5
	[0088.468] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.468] lstrlenW (lpString=".ppt") returned 4
	[0088.468] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0088.468] lstrlenW (lpString=".zip") returned 4
	[0088.469] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.469] lstrlenW (lpString=".rar") returned 4
	[0088.469] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.469] lstrlenW (lpString=".bz2") returned 4
	[0088.469] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.469] lstrlenW (lpString=".7z") returned 3
	[0088.469] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0088.469] lstrlenW (lpString=".dbf") returned 4
	[0088.469] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0088.469] lstrlenW (lpString=".1cd") returned 4
	[0088.469] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0088.469] lstrlenW (lpString=".jpg") returned 4
	[0088.469] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.469] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.469] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.474] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=25234) returned 1
	[0088.474] CloseHandle (hObject=0x160) returned 1
	[0088.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20
	[0088.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.475] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.475] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.475] GetLastError () returned 0x0
	[0088.475] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x6292, lpOverlapped=0x0) returned 1
	[0088.481] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x62a0, lpOverlapped=0x0) returned 1
	[0088.483] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.483] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.483] SetEndOfFile (hFile=0x174) returned 1
	[0088.483] CloseHandle (hObject=0x174) returned 1
	[0088.484] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.484] SetEndOfFile (hFile=0x160) returned 1
	[0088.485] CloseHandle (hObject=0x160) returned 1
	[0088.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.485] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1
	[0088.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0088.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0088.486] lstrlenW (lpString=".doc") returned 4
	[0088.486] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.486] lstrlenW (lpString=".docx") returned 5
	[0088.486] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.486] lstrlenW (lpString=".pdf") returned 4
	[0088.486] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.486] lstrlenW (lpString=".xls") returned 4
	[0088.486] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.486] lstrlenW (lpString=".xlsx") returned 5
	[0088.486] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.486] lstrlenW (lpString=".ppt") returned 4
	[0088.486] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0088.486] lstrlenW (lpString=".zip") returned 4
	[0088.486] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.486] lstrlenW (lpString=".rar") returned 4
	[0088.486] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.486] lstrlenW (lpString=".bz2") returned 4
	[0088.486] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.486] lstrlenW (lpString=".7z") returned 3
	[0088.486] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0088.486] lstrlenW (lpString=".dbf") returned 4
	[0088.486] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0088.486] lstrlenW (lpString=".1cd") returned 4
	[0088.487] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0088.487] lstrlenW (lpString=".jpg") returned 4
	[0088.487] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0088.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0088.487] lstrlenW (lpString=".doc") returned 4
	[0088.487] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.487] lstrlenW (lpString=".docx") returned 5
	[0088.487] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.487] lstrlenW (lpString=".pdf") returned 4
	[0088.487] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.487] lstrlenW (lpString=".xls") returned 4
	[0088.487] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.487] lstrlenW (lpString=".xlsx") returned 5
	[0088.487] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.487] lstrlenW (lpString=".ppt") returned 4
	[0088.487] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0088.487] lstrlenW (lpString=".zip") returned 4
	[0088.487] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.487] lstrlenW (lpString=".rar") returned 4
	[0088.487] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.487] lstrlenW (lpString=".bz2") returned 4
	[0088.487] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.487] lstrlenW (lpString=".7z") returned 3
	[0088.487] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0088.488] lstrlenW (lpString=".dbf") returned 4
	[0088.488] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0088.488] lstrlenW (lpString=".1cd") returned 4
	[0088.488] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0088.488] lstrlenW (lpString=".jpg") returned 4
	[0088.488] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.488] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.488] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.490] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2985) returned 1
	[0088.490] CloseHandle (hObject=0x160) returned 1
	[0088.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20
	[0088.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.491] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.491] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.494] GetLastError () returned 0x0
	[0088.494] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xba9, lpOverlapped=0x0) returned 1
	[0088.498] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xbb0, lpOverlapped=0x0) returned 1
	[0088.499] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.499] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.499] SetEndOfFile (hFile=0x174) returned 1
	[0088.499] CloseHandle (hObject=0x174) returned 1
	[0088.500] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.500] SetEndOfFile (hFile=0x160) returned 1
	[0088.501] CloseHandle (hObject=0x160) returned 1
	[0088.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.501] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1
	[0088.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0088.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0088.501] lstrlenW (lpString=".doc") returned 4
	[0088.501] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.502] lstrlenW (lpString=".docx") returned 5
	[0088.502] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.502] lstrlenW (lpString=".pdf") returned 4
	[0088.502] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.502] lstrlenW (lpString=".xls") returned 4
	[0088.502] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.502] lstrlenW (lpString=".xlsx") returned 5
	[0088.502] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.502] lstrlenW (lpString=".ppt") returned 4
	[0088.502] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0088.502] lstrlenW (lpString=".zip") returned 4
	[0088.502] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.502] lstrlenW (lpString=".rar") returned 4
	[0088.502] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.502] lstrlenW (lpString=".bz2") returned 4
	[0088.502] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.502] lstrlenW (lpString=".7z") returned 3
	[0088.502] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0088.502] lstrlenW (lpString=".dbf") returned 4
	[0088.502] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0088.502] lstrlenW (lpString=".1cd") returned 4
	[0088.502] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0088.502] lstrlenW (lpString=".jpg") returned 4
	[0088.502] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0088.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0088.503] lstrlenW (lpString=".doc") returned 4
	[0088.503] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.503] lstrlenW (lpString=".docx") returned 5
	[0088.503] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.503] lstrlenW (lpString=".pdf") returned 4
	[0088.503] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.503] lstrlenW (lpString=".xls") returned 4
	[0088.503] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.503] lstrlenW (lpString=".xlsx") returned 5
	[0088.503] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.503] lstrlenW (lpString=".ppt") returned 4
	[0088.503] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0088.503] lstrlenW (lpString=".zip") returned 4
	[0088.503] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.503] lstrlenW (lpString=".rar") returned 4
	[0088.503] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.503] lstrlenW (lpString=".bz2") returned 4
	[0088.503] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.503] lstrlenW (lpString=".7z") returned 3
	[0088.503] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0088.503] lstrlenW (lpString=".dbf") returned 4
	[0088.503] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0088.504] lstrlenW (lpString=".1cd") returned 4
	[0088.504] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0088.504] lstrlenW (lpString=".jpg") returned 4
	[0088.504] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.504] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.504] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.507] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=19780) returned 1
	[0088.507] CloseHandle (hObject=0x174) returned 1
	[0088.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20
	[0088.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.508] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.508] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.509] GetLastError () returned 0x0
	[0088.509] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x4d44, lpOverlapped=0x0) returned 1
	[0088.512] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x4d50, lpOverlapped=0x0) returned 1
	[0088.514] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.514] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.514] SetEndOfFile (hFile=0x188) returned 1
	[0088.514] CloseHandle (hObject=0x188) returned 1
	[0088.515] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.515] SetEndOfFile (hFile=0x174) returned 1
	[0088.516] CloseHandle (hObject=0x174) returned 1
	[0088.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.516] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1
	[0088.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0088.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0088.516] lstrlenW (lpString=".doc") returned 4
	[0088.516] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.517] lstrlenW (lpString=".docx") returned 5
	[0088.517] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.517] lstrlenW (lpString=".pdf") returned 4
	[0088.517] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.517] lstrlenW (lpString=".xls") returned 4
	[0088.517] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.517] lstrlenW (lpString=".xlsx") returned 5
	[0088.517] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.517] lstrlenW (lpString=".ppt") returned 4
	[0088.517] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0088.517] lstrlenW (lpString=".zip") returned 4
	[0088.517] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.517] lstrlenW (lpString=".rar") returned 4
	[0088.517] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.517] lstrlenW (lpString=".bz2") returned 4
	[0088.517] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.517] lstrlenW (lpString=".7z") returned 3
	[0088.517] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0088.517] lstrlenW (lpString=".dbf") returned 4
	[0088.517] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0088.517] lstrlenW (lpString=".1cd") returned 4
	[0088.517] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0088.517] lstrlenW (lpString=".jpg") returned 4
	[0088.518] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0088.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0088.518] lstrlenW (lpString=".doc") returned 4
	[0088.518] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.518] lstrlenW (lpString=".docx") returned 5
	[0088.518] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.518] lstrlenW (lpString=".pdf") returned 4
	[0088.518] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.518] lstrlenW (lpString=".xls") returned 4
	[0088.518] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.518] lstrlenW (lpString=".xlsx") returned 5
	[0088.518] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.518] lstrlenW (lpString=".ppt") returned 4
	[0088.518] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0088.518] lstrlenW (lpString=".zip") returned 4
	[0088.518] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.518] lstrlenW (lpString=".rar") returned 4
	[0088.518] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.518] lstrlenW (lpString=".bz2") returned 4
	[0088.518] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.518] lstrlenW (lpString=".7z") returned 3
	[0088.518] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0088.518] lstrlenW (lpString=".dbf") returned 4
	[0088.519] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0088.519] lstrlenW (lpString=".1cd") returned 4
	[0088.519] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0088.519] lstrlenW (lpString=".jpg") returned 4
	[0088.519] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.519] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.519] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.520] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2848) returned 1
	[0088.520] CloseHandle (hObject=0x174) returned 1
	[0088.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20
	[0088.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.521] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.521] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.525] GetLastError () returned 0x0
	[0088.525] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xb20, lpOverlapped=0x0) returned 1
	[0088.530] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xb30, lpOverlapped=0x0) returned 1
	[0088.531] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.531] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.531] SetEndOfFile (hFile=0x188) returned 1
	[0088.531] CloseHandle (hObject=0x188) returned 1
	[0088.531] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.532] SetEndOfFile (hFile=0x174) returned 1
	[0088.533] CloseHandle (hObject=0x174) returned 1
	[0088.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.533] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1
	[0088.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0088.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0088.533] lstrlenW (lpString=".doc") returned 4
	[0088.533] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.533] lstrlenW (lpString=".docx") returned 5
	[0088.533] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.533] lstrlenW (lpString=".pdf") returned 4
	[0088.533] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.534] lstrlenW (lpString=".xls") returned 4
	[0088.534] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.534] lstrlenW (lpString=".xlsx") returned 5
	[0088.534] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.534] lstrlenW (lpString=".ppt") returned 4
	[0088.534] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0088.534] lstrlenW (lpString=".zip") returned 4
	[0088.534] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.534] lstrlenW (lpString=".rar") returned 4
	[0088.534] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.534] lstrlenW (lpString=".bz2") returned 4
	[0088.534] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.534] lstrlenW (lpString=".7z") returned 3
	[0088.534] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0088.534] lstrlenW (lpString=".dbf") returned 4
	[0088.534] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0088.534] lstrlenW (lpString=".1cd") returned 4
	[0088.534] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0088.534] lstrlenW (lpString=".jpg") returned 4
	[0088.534] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0088.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0088.535] lstrlenW (lpString=".doc") returned 4
	[0088.535] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.535] lstrlenW (lpString=".docx") returned 5
	[0088.535] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.535] lstrlenW (lpString=".pdf") returned 4
	[0088.535] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.535] lstrlenW (lpString=".xls") returned 4
	[0088.535] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.535] lstrlenW (lpString=".xlsx") returned 5
	[0088.535] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.535] lstrlenW (lpString=".ppt") returned 4
	[0088.535] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0088.535] lstrlenW (lpString=".zip") returned 4
	[0088.535] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.535] lstrlenW (lpString=".rar") returned 4
	[0088.535] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.535] lstrlenW (lpString=".bz2") returned 4
	[0088.535] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.535] lstrlenW (lpString=".7z") returned 3
	[0088.535] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0088.535] lstrlenW (lpString=".dbf") returned 4
	[0088.535] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0088.536] lstrlenW (lpString=".1cd") returned 4
	[0088.536] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0088.536] lstrlenW (lpString=".jpg") returned 4
	[0088.536] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.536] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.536] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.536] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=34916) returned 1
	[0088.537] CloseHandle (hObject=0x174) returned 1
	[0088.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20
	[0088.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.537] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.537] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.538] GetLastError () returned 0x0
	[0088.538] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x8864, lpOverlapped=0x0) returned 1
	[0088.546] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x8870, lpOverlapped=0x0) returned 1
	[0088.548] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.548] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.548] SetEndOfFile (hFile=0x188) returned 1
	[0088.548] CloseHandle (hObject=0x188) returned 1
	[0088.548] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.548] SetEndOfFile (hFile=0x174) returned 1
	[0088.549] CloseHandle (hObject=0x174) returned 1
	[0088.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.550] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1
	[0088.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0088.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0088.550] lstrlenW (lpString=".doc") returned 4
	[0088.550] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.550] lstrlenW (lpString=".docx") returned 5
	[0088.550] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.550] lstrlenW (lpString=".pdf") returned 4
	[0088.550] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.550] lstrlenW (lpString=".xls") returned 4
	[0088.551] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.551] lstrlenW (lpString=".xlsx") returned 5
	[0088.551] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.551] lstrlenW (lpString=".ppt") returned 4
	[0088.551] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0088.551] lstrlenW (lpString=".zip") returned 4
	[0088.551] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.551] lstrlenW (lpString=".rar") returned 4
	[0088.551] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.551] lstrlenW (lpString=".bz2") returned 4
	[0088.551] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.551] lstrlenW (lpString=".7z") returned 3
	[0088.551] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0088.551] lstrlenW (lpString=".dbf") returned 4
	[0088.551] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0088.551] lstrlenW (lpString=".1cd") returned 4
	[0088.551] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0088.551] lstrlenW (lpString=".jpg") returned 4
	[0088.551] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0088.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0088.552] lstrlenW (lpString=".doc") returned 4
	[0088.552] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.552] lstrlenW (lpString=".docx") returned 5
	[0088.552] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.552] lstrlenW (lpString=".pdf") returned 4
	[0088.552] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.552] lstrlenW (lpString=".xls") returned 4
	[0088.552] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.552] lstrlenW (lpString=".xlsx") returned 5
	[0088.552] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.552] lstrlenW (lpString=".ppt") returned 4
	[0088.552] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0088.552] lstrlenW (lpString=".zip") returned 4
	[0088.552] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.552] lstrlenW (lpString=".rar") returned 4
	[0088.552] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.552] lstrlenW (lpString=".bz2") returned 4
	[0088.552] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.552] lstrlenW (lpString=".7z") returned 3
	[0088.552] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0088.552] lstrlenW (lpString=".dbf") returned 4
	[0088.552] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0088.553] lstrlenW (lpString=".1cd") returned 4
	[0088.553] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0088.553] lstrlenW (lpString=".jpg") returned 4
	[0088.553] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.553] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.553] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0088.570] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=20627) returned 1
	[0088.570] CloseHandle (hObject=0x190) returned 1
	[0088.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20
	[0088.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.671] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.671] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0088.689] GetLastError () returned 0x0
	[0088.689] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x5093, lpOverlapped=0x0) returned 1
	[0088.701] WriteFile (in: hFile=0x198, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x50a0, lpOverlapped=0x0) returned 1
	[0088.702] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.703] WriteFile (in: hFile=0x198, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.703] SetEndOfFile (hFile=0x198) returned 1
	[0088.703] CloseHandle (hObject=0x198) returned 1
	[0088.703] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.703] SetEndOfFile (hFile=0x174) returned 1
	[0088.704] CloseHandle (hObject=0x174) returned 1
	[0088.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.705] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1
	[0088.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0088.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0088.705] lstrlenW (lpString=".doc") returned 4
	[0088.705] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.705] lstrlenW (lpString=".docx") returned 5
	[0088.705] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.705] lstrlenW (lpString=".pdf") returned 4
	[0088.705] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.705] lstrlenW (lpString=".xls") returned 4
	[0088.705] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.705] lstrlenW (lpString=".xlsx") returned 5
	[0088.706] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.706] lstrlenW (lpString=".ppt") returned 4
	[0088.706] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0088.706] lstrlenW (lpString=".zip") returned 4
	[0088.706] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.706] lstrlenW (lpString=".rar") returned 4
	[0088.706] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.706] lstrlenW (lpString=".bz2") returned 4
	[0088.706] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.706] lstrlenW (lpString=".7z") returned 3
	[0088.706] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0088.706] lstrlenW (lpString=".dbf") returned 4
	[0088.706] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0088.706] lstrlenW (lpString=".1cd") returned 4
	[0088.706] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0088.706] lstrlenW (lpString=".jpg") returned 4
	[0088.706] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0088.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0088.706] lstrlenW (lpString=".doc") returned 4
	[0088.706] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.707] lstrlenW (lpString=".docx") returned 5
	[0088.707] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.707] lstrlenW (lpString=".pdf") returned 4
	[0088.707] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.707] lstrlenW (lpString=".xls") returned 4
	[0088.707] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.707] lstrlenW (lpString=".xlsx") returned 5
	[0088.707] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.707] lstrlenW (lpString=".ppt") returned 4
	[0088.707] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0088.707] lstrlenW (lpString=".zip") returned 4
	[0088.707] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.707] lstrlenW (lpString=".rar") returned 4
	[0088.707] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.707] lstrlenW (lpString=".bz2") returned 4
	[0088.707] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.707] lstrlenW (lpString=".7z") returned 3
	[0088.707] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0088.707] lstrlenW (lpString=".dbf") returned 4
	[0088.707] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0088.707] lstrlenW (lpString=".1cd") returned 4
	[0088.707] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0088.708] lstrlenW (lpString=".jpg") returned 4
	[0088.708] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.708] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.708] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.744] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=32607) returned 1
	[0088.744] CloseHandle (hObject=0x174) returned 1
	[0088.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20
	[0088.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.745] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.745] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0088.745] GetLastError () returned 0x0
	[0088.746] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x7f5f, lpOverlapped=0x0) returned 1
	[0088.760] WriteFile (in: hFile=0x1b0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x7f60, lpOverlapped=0x0) returned 1
	[0088.761] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.761] WriteFile (in: hFile=0x1b0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.761] SetEndOfFile (hFile=0x1b0) returned 1
	[0088.761] CloseHandle (hObject=0x1b0) returned 1
	[0088.762] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.762] SetEndOfFile (hFile=0x174) returned 1
	[0088.763] CloseHandle (hObject=0x174) returned 1
	[0088.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.763] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1
	[0088.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0088.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0088.764] lstrlenW (lpString=".doc") returned 4
	[0088.764] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.764] lstrlenW (lpString=".docx") returned 5
	[0088.764] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.764] lstrlenW (lpString=".pdf") returned 4
	[0088.764] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.764] lstrlenW (lpString=".xls") returned 4
	[0088.764] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.764] lstrlenW (lpString=".xlsx") returned 5
	[0088.764] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.764] lstrlenW (lpString=".ppt") returned 4
	[0088.764] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0088.764] lstrlenW (lpString=".zip") returned 4
	[0088.764] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.764] lstrlenW (lpString=".rar") returned 4
	[0088.764] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.764] lstrlenW (lpString=".bz2") returned 4
	[0088.764] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.764] lstrlenW (lpString=".7z") returned 3
	[0088.764] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0088.764] lstrlenW (lpString=".dbf") returned 4
	[0088.764] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0088.764] lstrlenW (lpString=".1cd") returned 4
	[0088.764] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0088.764] lstrlenW (lpString=".jpg") returned 4
	[0088.764] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0088.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0088.765] lstrlenW (lpString=".doc") returned 4
	[0088.765] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.765] lstrlenW (lpString=".docx") returned 5
	[0088.765] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.765] lstrlenW (lpString=".pdf") returned 4
	[0088.765] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.765] lstrlenW (lpString=".xls") returned 4
	[0088.765] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.765] lstrlenW (lpString=".xlsx") returned 5
	[0088.765] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.765] lstrlenW (lpString=".ppt") returned 4
	[0088.765] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0088.765] lstrlenW (lpString=".zip") returned 4
	[0088.765] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.765] lstrlenW (lpString=".rar") returned 4
	[0088.765] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.765] lstrlenW (lpString=".bz2") returned 4
	[0088.765] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.765] lstrlenW (lpString=".7z") returned 3
	[0088.765] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0088.765] lstrlenW (lpString=".dbf") returned 4
	[0088.765] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0088.765] lstrlenW (lpString=".1cd") returned 4
	[0088.765] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0088.765] lstrlenW (lpString=".jpg") returned 4
	[0088.765] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.766] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.766] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.774] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=20371) returned 1
	[0088.774] CloseHandle (hObject=0x174) returned 1
	[0088.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20
	[0088.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.774] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.775] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.775] GetLastError () returned 0x0
	[0088.775] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x4f93, lpOverlapped=0x0) returned 1
	[0088.784] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x4fa0, lpOverlapped=0x0) returned 1
	[0088.789] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.789] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.790] SetEndOfFile (hFile=0x188) returned 1
	[0088.790] CloseHandle (hObject=0x188) returned 1
	[0088.790] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.790] SetEndOfFile (hFile=0x174) returned 1
	[0088.791] CloseHandle (hObject=0x174) returned 1
	[0088.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.792] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1
	[0088.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0088.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0088.792] lstrlenW (lpString=".doc") returned 4
	[0088.792] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.792] lstrlenW (lpString=".docx") returned 5
	[0088.792] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.792] lstrlenW (lpString=".pdf") returned 4
	[0088.792] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.792] lstrlenW (lpString=".xls") returned 4
	[0088.793] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.793] lstrlenW (lpString=".xlsx") returned 5
	[0088.793] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.793] lstrlenW (lpString=".ppt") returned 4
	[0088.793] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0088.793] lstrlenW (lpString=".zip") returned 4
	[0088.793] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.793] lstrlenW (lpString=".rar") returned 4
	[0088.793] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.793] lstrlenW (lpString=".bz2") returned 4
	[0088.793] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.793] lstrlenW (lpString=".7z") returned 3
	[0088.793] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0088.793] lstrlenW (lpString=".dbf") returned 4
	[0088.793] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0088.793] lstrlenW (lpString=".1cd") returned 4
	[0088.793] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0088.793] lstrlenW (lpString=".jpg") returned 4
	[0088.793] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0088.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0088.794] lstrlenW (lpString=".doc") returned 4
	[0088.794] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.794] lstrlenW (lpString=".docx") returned 5
	[0088.794] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.794] lstrlenW (lpString=".pdf") returned 4
	[0088.794] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.794] lstrlenW (lpString=".xls") returned 4
	[0088.794] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.794] lstrlenW (lpString=".xlsx") returned 5
	[0088.794] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.794] lstrlenW (lpString=".ppt") returned 4
	[0088.794] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0088.794] lstrlenW (lpString=".zip") returned 4
	[0088.794] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.794] lstrlenW (lpString=".rar") returned 4
	[0088.794] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.794] lstrlenW (lpString=".bz2") returned 4
	[0088.794] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.794] lstrlenW (lpString=".7z") returned 3
	[0088.794] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0088.794] lstrlenW (lpString=".dbf") returned 4
	[0088.794] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0088.794] lstrlenW (lpString=".1cd") returned 4
	[0088.795] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0088.795] lstrlenW (lpString=".jpg") returned 4
	[0088.795] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.795] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.795] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0088.804] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=20575) returned 1
	[0088.804] CloseHandle (hObject=0x1b0) returned 1
	[0088.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20
	[0088.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0088.805] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.805] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0088.806] GetLastError () returned 0x0
	[0088.806] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x505f, lpOverlapped=0x0) returned 1
	[0088.815] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x5060, lpOverlapped=0x0) returned 1
	[0088.816] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.816] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.816] SetEndOfFile (hFile=0x1a8) returned 1
	[0088.816] CloseHandle (hObject=0x1a8) returned 1
	[0088.817] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.817] SetEndOfFile (hFile=0x1b0) returned 1
	[0088.817] CloseHandle (hObject=0x1b0) returned 1
	[0088.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.818] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1
	[0088.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0088.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0088.818] lstrlenW (lpString=".doc") returned 4
	[0088.818] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.818] lstrlenW (lpString=".docx") returned 5
	[0088.818] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.818] lstrlenW (lpString=".pdf") returned 4
	[0088.818] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.818] lstrlenW (lpString=".xls") returned 4
	[0088.818] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.818] lstrlenW (lpString=".xlsx") returned 5
	[0088.818] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.818] lstrlenW (lpString=".ppt") returned 4
	[0088.818] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0088.818] lstrlenW (lpString=".zip") returned 4
	[0088.818] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.818] lstrlenW (lpString=".rar") returned 4
	[0088.818] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.819] lstrlenW (lpString=".bz2") returned 4
	[0088.819] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.819] lstrlenW (lpString=".7z") returned 3
	[0088.819] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0088.819] lstrlenW (lpString=".dbf") returned 4
	[0088.819] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0088.819] lstrlenW (lpString=".1cd") returned 4
	[0088.819] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0088.819] lstrlenW (lpString=".jpg") returned 4
	[0088.819] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0088.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0088.819] lstrlenW (lpString=".doc") returned 4
	[0088.819] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.819] lstrlenW (lpString=".docx") returned 5
	[0088.819] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.819] lstrlenW (lpString=".pdf") returned 4
	[0088.819] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.819] lstrlenW (lpString=".xls") returned 4
	[0088.819] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.819] lstrlenW (lpString=".xlsx") returned 5
	[0088.819] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.819] lstrlenW (lpString=".ppt") returned 4
	[0088.819] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0088.819] lstrlenW (lpString=".zip") returned 4
	[0088.819] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.819] lstrlenW (lpString=".rar") returned 4
	[0088.819] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.819] lstrlenW (lpString=".bz2") returned 4
	[0088.820] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.820] lstrlenW (lpString=".7z") returned 3
	[0088.820] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0088.820] lstrlenW (lpString=".dbf") returned 4
	[0088.820] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0088.820] lstrlenW (lpString=".1cd") returned 4
	[0088.820] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0088.820] lstrlenW (lpString=".jpg") returned 4
	[0088.820] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.820] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.820] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0088.841] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=28595) returned 1
	[0088.841] CloseHandle (hObject=0x1b0) returned 1
	[0088.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20
	[0088.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0088.842] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.842] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.842] GetLastError () returned 0x0
	[0088.842] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x6fb3, lpOverlapped=0x0) returned 1
	[0088.858] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x6fc0, lpOverlapped=0x0) returned 1
	[0088.859] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.860] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.860] SetEndOfFile (hFile=0x188) returned 1
	[0088.860] CloseHandle (hObject=0x188) returned 1
	[0088.860] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.860] SetEndOfFile (hFile=0x1b0) returned 1
	[0088.861] CloseHandle (hObject=0x1b0) returned 1
	[0088.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.862] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1
	[0088.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0088.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0088.862] lstrlenW (lpString=".doc") returned 4
	[0088.862] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.862] lstrlenW (lpString=".docx") returned 5
	[0088.862] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.862] lstrlenW (lpString=".pdf") returned 4
	[0088.862] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.862] lstrlenW (lpString=".xls") returned 4
	[0088.862] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.862] lstrlenW (lpString=".xlsx") returned 5
	[0088.862] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.862] lstrlenW (lpString=".ppt") returned 4
	[0088.862] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0088.863] lstrlenW (lpString=".zip") returned 4
	[0088.863] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.863] lstrlenW (lpString=".rar") returned 4
	[0088.863] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.863] lstrlenW (lpString=".bz2") returned 4
	[0088.863] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.863] lstrlenW (lpString=".7z") returned 3
	[0088.863] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0088.863] lstrlenW (lpString=".dbf") returned 4
	[0088.863] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0088.863] lstrlenW (lpString=".1cd") returned 4
	[0088.863] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0088.863] lstrlenW (lpString=".jpg") returned 4
	[0088.863] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0088.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0088.863] lstrlenW (lpString=".doc") returned 4
	[0088.863] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.863] lstrlenW (lpString=".docx") returned 5
	[0088.863] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.863] lstrlenW (lpString=".pdf") returned 4
	[0088.863] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.863] lstrlenW (lpString=".xls") returned 4
	[0088.863] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.863] lstrlenW (lpString=".xlsx") returned 5
	[0088.864] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.864] lstrlenW (lpString=".ppt") returned 4
	[0088.864] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0088.864] lstrlenW (lpString=".zip") returned 4
	[0088.864] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.864] lstrlenW (lpString=".rar") returned 4
	[0088.864] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.864] lstrlenW (lpString=".bz2") returned 4
	[0088.864] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.864] lstrlenW (lpString=".7z") returned 3
	[0088.864] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0088.864] lstrlenW (lpString=".dbf") returned 4
	[0088.864] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0088.864] lstrlenW (lpString=".1cd") returned 4
	[0088.864] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0088.864] lstrlenW (lpString=".jpg") returned 4
	[0088.864] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.864] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.864] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0088.890] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=33277) returned 1
	[0088.890] CloseHandle (hObject=0x1b0) returned 1
	[0088.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20
	[0088.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0088.891] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.891] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.891] GetLastError () returned 0x0
	[0088.891] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x81fd, lpOverlapped=0x0) returned 1
	[0088.901] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x8200, lpOverlapped=0x0) returned 1
	[0088.902] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.902] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.902] SetEndOfFile (hFile=0x188) returned 1
	[0088.903] CloseHandle (hObject=0x188) returned 1
	[0088.903] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.903] SetEndOfFile (hFile=0x1b0) returned 1
	[0088.904] CloseHandle (hObject=0x1b0) returned 1
	[0088.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.904] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1
	[0088.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0088.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0088.904] lstrlenW (lpString=".doc") returned 4
	[0088.904] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.904] lstrlenW (lpString=".docx") returned 5
	[0088.904] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.904] lstrlenW (lpString=".pdf") returned 4
	[0088.905] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.905] lstrlenW (lpString=".xls") returned 4
	[0088.905] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.905] lstrlenW (lpString=".xlsx") returned 5
	[0088.905] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.905] lstrlenW (lpString=".ppt") returned 4
	[0088.905] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0088.905] lstrlenW (lpString=".zip") returned 4
	[0088.905] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.905] lstrlenW (lpString=".rar") returned 4
	[0088.905] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.905] lstrlenW (lpString=".bz2") returned 4
	[0088.905] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.905] lstrlenW (lpString=".7z") returned 3
	[0088.905] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0088.905] lstrlenW (lpString=".dbf") returned 4
	[0088.905] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0088.905] lstrlenW (lpString=".1cd") returned 4
	[0088.905] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0088.905] lstrlenW (lpString=".jpg") returned 4
	[0088.905] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0088.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0088.905] lstrlenW (lpString=".doc") returned 4
	[0088.905] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.905] lstrlenW (lpString=".docx") returned 5
	[0088.905] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.905] lstrlenW (lpString=".pdf") returned 4
	[0088.906] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.906] lstrlenW (lpString=".xls") returned 4
	[0088.906] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.906] lstrlenW (lpString=".xlsx") returned 5
	[0088.906] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.906] lstrlenW (lpString=".ppt") returned 4
	[0088.906] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0088.906] lstrlenW (lpString=".zip") returned 4
	[0088.906] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.906] lstrlenW (lpString=".rar") returned 4
	[0088.906] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.906] lstrlenW (lpString=".bz2") returned 4
	[0088.906] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.906] lstrlenW (lpString=".7z") returned 3
	[0088.906] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0088.906] lstrlenW (lpString=".dbf") returned 4
	[0088.906] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0088.906] lstrlenW (lpString=".1cd") returned 4
	[0088.906] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0088.906] lstrlenW (lpString=".jpg") returned 4
	[0088.906] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.906] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.906] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0088.920] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=32403) returned 1
	[0088.920] CloseHandle (hObject=0x1b0) returned 1
	[0088.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20
	[0088.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0089.031] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.031] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0089.100] GetLastError () returned 0x0
	[0089.100] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x7e93, lpOverlapped=0x0) returned 1
	[0089.145] WriteFile (in: hFile=0x1bc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x7ea0, lpOverlapped=0x0) returned 1
	[0089.146] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.147] WriteFile (in: hFile=0x1bc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.147] SetEndOfFile (hFile=0x1bc) returned 1
	[0089.147] CloseHandle (hObject=0x1bc) returned 1
	[0089.147] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.147] SetEndOfFile (hFile=0x174) returned 1
	[0089.148] CloseHandle (hObject=0x174) returned 1
	[0089.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.149] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1
	[0089.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0089.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0089.149] lstrlenW (lpString=".doc") returned 4
	[0089.149] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.149] lstrlenW (lpString=".docx") returned 5
	[0089.149] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.149] lstrlenW (lpString=".pdf") returned 4
	[0089.149] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.149] lstrlenW (lpString=".xls") returned 4
	[0089.149] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.150] lstrlenW (lpString=".xlsx") returned 5
	[0089.150] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.150] lstrlenW (lpString=".ppt") returned 4
	[0089.150] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0089.150] lstrlenW (lpString=".zip") returned 4
	[0089.150] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.150] lstrlenW (lpString=".rar") returned 4
	[0089.150] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.150] lstrlenW (lpString=".bz2") returned 4
	[0089.150] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.150] lstrlenW (lpString=".7z") returned 3
	[0089.150] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0089.151] lstrlenW (lpString=".dbf") returned 4
	[0089.151] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0089.151] lstrlenW (lpString=".1cd") returned 4
	[0089.151] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0089.151] lstrlenW (lpString=".jpg") returned 4
	[0089.151] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0089.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0089.151] lstrlenW (lpString=".doc") returned 4
	[0089.151] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.151] lstrlenW (lpString=".docx") returned 5
	[0089.151] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.151] lstrlenW (lpString=".pdf") returned 4
	[0089.151] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.151] lstrlenW (lpString=".xls") returned 4
	[0089.151] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.151] lstrlenW (lpString=".xlsx") returned 5
	[0089.151] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.151] lstrlenW (lpString=".ppt") returned 4
	[0089.151] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0089.151] lstrlenW (lpString=".zip") returned 4
	[0089.151] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.151] lstrlenW (lpString=".rar") returned 4
	[0089.151] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.151] lstrlenW (lpString=".bz2") returned 4
	[0089.151] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.151] lstrlenW (lpString=".7z") returned 3
	[0089.151] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0089.152] lstrlenW (lpString=".dbf") returned 4
	[0089.152] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0089.152] lstrlenW (lpString=".1cd") returned 4
	[0089.152] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0089.152] lstrlenW (lpString=".jpg") returned 4
	[0089.152] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.152] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0089.152] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0089.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0089.302] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=18817) returned 1
	[0089.302] CloseHandle (hObject=0x174) returned 1
	[0089.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20
	[0089.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0089.303] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.303] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.303] GetLastError () returned 0x0
	[0089.303] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x4981, lpOverlapped=0x0) returned 1
	[0089.374] WriteFile (in: hFile=0x1b0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x4990, lpOverlapped=0x0) returned 1
	[0089.375] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.375] WriteFile (in: hFile=0x1b0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.375] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.376] CloseHandle (hObject=0x1b0) returned 1
	[0089.376] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.376] SetEndOfFile (hFile=0x174) returned 1
	[0089.377] CloseHandle (hObject=0x174) returned 1
	[0089.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.377] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1
	[0089.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0089.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0089.377] lstrlenW (lpString=".doc") returned 4
	[0089.377] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.377] lstrlenW (lpString=".docx") returned 5
	[0089.377] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.377] lstrlenW (lpString=".pdf") returned 4
	[0089.377] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.377] lstrlenW (lpString=".xls") returned 4
	[0089.378] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.378] lstrlenW (lpString=".xlsx") returned 5
	[0089.378] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.378] lstrlenW (lpString=".ppt") returned 4
	[0089.378] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0089.378] lstrlenW (lpString=".zip") returned 4
	[0089.378] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.378] lstrlenW (lpString=".rar") returned 4
	[0089.378] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.378] lstrlenW (lpString=".bz2") returned 4
	[0089.378] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.378] lstrlenW (lpString=".7z") returned 3
	[0089.378] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0089.378] lstrlenW (lpString=".dbf") returned 4
	[0089.378] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0089.378] lstrlenW (lpString=".1cd") returned 4
	[0089.378] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0089.378] lstrlenW (lpString=".jpg") returned 4
	[0089.378] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0089.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0089.378] lstrlenW (lpString=".doc") returned 4
	[0089.378] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.378] lstrlenW (lpString=".docx") returned 5
	[0089.378] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.378] lstrlenW (lpString=".pdf") returned 4
	[0089.378] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.378] lstrlenW (lpString=".xls") returned 4
	[0089.379] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.379] lstrlenW (lpString=".xlsx") returned 5
	[0089.379] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.379] lstrlenW (lpString=".ppt") returned 4
	[0089.379] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0089.379] lstrlenW (lpString=".zip") returned 4
	[0089.379] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.379] lstrlenW (lpString=".rar") returned 4
	[0089.379] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.379] lstrlenW (lpString=".bz2") returned 4
	[0089.379] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.379] lstrlenW (lpString=".7z") returned 3
	[0089.379] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0089.379] lstrlenW (lpString=".dbf") returned 4
	[0089.379] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0089.379] lstrlenW (lpString=".1cd") returned 4
	[0089.379] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0089.379] lstrlenW (lpString=".jpg") returned 4
	[0089.379] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.379] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0089.379] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0089.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.446] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=19485) returned 1
	[0089.446] CloseHandle (hObject=0x1b0) returned 1
	[0089.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20
	[0089.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.447] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.447] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0089.448] GetLastError () returned 0x0
	[0089.448] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x4c1d, lpOverlapped=0x0) returned 1
	[0089.464] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x4c20, lpOverlapped=0x0) returned 1
	[0089.466] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.466] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.466] SetEndOfFile (hFile=0x174) returned 1
	[0089.466] CloseHandle (hObject=0x174) returned 1
	[0089.466] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.466] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.467] CloseHandle (hObject=0x1b0) returned 1
	[0089.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.468] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1
	[0089.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0089.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0089.468] lstrlenW (lpString=".doc") returned 4
	[0089.468] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.468] lstrlenW (lpString=".docx") returned 5
	[0089.468] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.468] lstrlenW (lpString=".pdf") returned 4
	[0089.468] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.468] lstrlenW (lpString=".xls") returned 4
	[0089.468] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.468] lstrlenW (lpString=".xlsx") returned 5
	[0089.468] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.468] lstrlenW (lpString=".ppt") returned 4
	[0089.468] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0089.468] lstrlenW (lpString=".zip") returned 4
	[0089.468] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.468] lstrlenW (lpString=".rar") returned 4
	[0089.468] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.468] lstrlenW (lpString=".bz2") returned 4
	[0089.468] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.468] lstrlenW (lpString=".7z") returned 3
	[0089.468] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0089.468] lstrlenW (lpString=".dbf") returned 4
	[0089.468] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0089.469] lstrlenW (lpString=".1cd") returned 4
	[0089.469] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0089.469] lstrlenW (lpString=".jpg") returned 4
	[0089.469] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0089.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0089.469] lstrlenW (lpString=".doc") returned 4
	[0089.469] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.469] lstrlenW (lpString=".docx") returned 5
	[0089.469] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.469] lstrlenW (lpString=".pdf") returned 4
	[0089.469] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.469] lstrlenW (lpString=".xls") returned 4
	[0089.469] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.469] lstrlenW (lpString=".xlsx") returned 5
	[0089.469] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.469] lstrlenW (lpString=".ppt") returned 4
	[0089.469] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0089.469] lstrlenW (lpString=".zip") returned 4
	[0089.469] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.469] lstrlenW (lpString=".rar") returned 4
	[0089.469] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.469] lstrlenW (lpString=".bz2") returned 4
	[0089.469] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.469] lstrlenW (lpString=".7z") returned 3
	[0089.469] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0089.469] lstrlenW (lpString=".dbf") returned 4
	[0089.469] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0089.470] lstrlenW (lpString=".1cd") returned 4
	[0089.470] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0089.470] lstrlenW (lpString=".jpg") returned 4
	[0089.470] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.470] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0089.470] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0089.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0089.608] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=44850) returned 1
	[0089.608] CloseHandle (hObject=0x1b8) returned 1
	[0089.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20
	[0089.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0089.609] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.609] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0089.609] GetLastError () returned 0x0
	[0089.609] ReadFile (in: hFile=0x1b8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xaf32, lpOverlapped=0x0) returned 1
	[0089.659] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xaf40, lpOverlapped=0x0) returned 1
	[0089.661] ReadFile (in: hFile=0x1b8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.661] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.661] SetEndOfFile (hFile=0x174) returned 1
	[0089.662] CloseHandle (hObject=0x174) returned 1
	[0089.662] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.662] SetEndOfFile (hFile=0x1b8) returned 1
	[0089.663] CloseHandle (hObject=0x1b8) returned 1
	[0089.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.663] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1
	[0089.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0089.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0089.664] lstrlenW (lpString=".doc") returned 4
	[0089.664] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.664] lstrlenW (lpString=".docx") returned 5
	[0089.664] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.664] lstrlenW (lpString=".pdf") returned 4
	[0089.664] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.664] lstrlenW (lpString=".xls") returned 4
	[0089.664] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.664] lstrlenW (lpString=".xlsx") returned 5
	[0089.664] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.664] lstrlenW (lpString=".ppt") returned 4
	[0089.664] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0089.664] lstrlenW (lpString=".zip") returned 4
	[0089.664] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.664] lstrlenW (lpString=".rar") returned 4
	[0089.664] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.664] lstrlenW (lpString=".bz2") returned 4
	[0089.664] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.664] lstrlenW (lpString=".7z") returned 3
	[0089.664] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0089.664] lstrlenW (lpString=".dbf") returned 4
	[0089.664] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0089.664] lstrlenW (lpString=".1cd") returned 4
	[0089.664] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0089.665] lstrlenW (lpString=".jpg") returned 4
	[0089.665] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0089.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0089.665] lstrlenW (lpString=".doc") returned 4
	[0089.665] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.665] lstrlenW (lpString=".docx") returned 5
	[0089.665] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.665] lstrlenW (lpString=".pdf") returned 4
	[0089.665] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.665] lstrlenW (lpString=".xls") returned 4
	[0089.665] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.665] lstrlenW (lpString=".xlsx") returned 5
	[0089.665] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.665] lstrlenW (lpString=".ppt") returned 4
	[0089.665] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0089.665] lstrlenW (lpString=".zip") returned 4
	[0089.665] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.665] lstrlenW (lpString=".rar") returned 4
	[0089.665] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.665] lstrlenW (lpString=".bz2") returned 4
	[0089.665] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.665] lstrlenW (lpString=".7z") returned 3
	[0089.665] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0089.665] lstrlenW (lpString=".dbf") returned 4
	[0089.665] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0089.665] lstrlenW (lpString=".1cd") returned 4
	[0089.665] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0089.666] lstrlenW (lpString=".jpg") returned 4
	[0089.666] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.666] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0089.666] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0089.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0089.901] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=11573) returned 1
	[0089.901] CloseHandle (hObject=0x184) returned 1
	[0089.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20
	[0089.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0089.902] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.902] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0089.902] GetLastError () returned 0x0
	[0089.903] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x2d35, lpOverlapped=0x0) returned 1
	[0089.926] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2d40, lpOverlapped=0x0) returned 1
	[0089.927] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.927] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.928] SetEndOfFile (hFile=0x1ac) returned 1
	[0089.928] CloseHandle (hObject=0x1ac) returned 1
	[0089.928] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.928] SetEndOfFile (hFile=0x184) returned 1
	[0089.929] CloseHandle (hObject=0x184) returned 1
	[0089.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.929] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1
	[0089.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0089.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0089.929] lstrlenW (lpString=".doc") returned 4
	[0089.929] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.929] lstrlenW (lpString=".docx") returned 5
	[0089.929] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.929] lstrlenW (lpString=".pdf") returned 4
	[0089.929] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.929] lstrlenW (lpString=".xls") returned 4
	[0089.930] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.930] lstrlenW (lpString=".xlsx") returned 5
	[0089.930] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.930] lstrlenW (lpString=".ppt") returned 4
	[0089.930] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0089.930] lstrlenW (lpString=".zip") returned 4
	[0089.930] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.930] lstrlenW (lpString=".rar") returned 4
	[0089.930] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.930] lstrlenW (lpString=".bz2") returned 4
	[0089.930] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.930] lstrlenW (lpString=".7z") returned 3
	[0089.930] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0089.930] lstrlenW (lpString=".dbf") returned 4
	[0089.930] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0089.930] lstrlenW (lpString=".1cd") returned 4
	[0089.930] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0089.930] lstrlenW (lpString=".jpg") returned 4
	[0089.930] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0089.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0089.930] lstrlenW (lpString=".doc") returned 4
	[0089.930] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.930] lstrlenW (lpString=".docx") returned 5
	[0089.930] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.930] lstrlenW (lpString=".pdf") returned 4
	[0089.930] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.930] lstrlenW (lpString=".xls") returned 4
	[0089.931] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.931] lstrlenW (lpString=".xlsx") returned 5
	[0089.931] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.931] lstrlenW (lpString=".ppt") returned 4
	[0089.931] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0089.931] lstrlenW (lpString=".zip") returned 4
	[0089.931] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.931] lstrlenW (lpString=".rar") returned 4
	[0089.931] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.931] lstrlenW (lpString=".bz2") returned 4
	[0089.931] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.931] lstrlenW (lpString=".7z") returned 3
	[0089.931] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0089.931] lstrlenW (lpString=".dbf") returned 4
	[0089.931] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0089.931] lstrlenW (lpString=".1cd") returned 4
	[0089.931] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0089.931] lstrlenW (lpString=".jpg") returned 4
	[0089.931] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.931] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0089.931] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0089.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0089.981] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=21745) returned 1
	[0089.981] CloseHandle (hObject=0x1ac) returned 1
	[0089.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20
	[0089.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0089.982] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.982] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.983] GetLastError () returned 0x0
	[0089.983] ReadFile (in: hFile=0x1ac, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x54f1, lpOverlapped=0x0) returned 1
	[0089.997] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x5500, lpOverlapped=0x0) returned 1
	[0089.998] ReadFile (in: hFile=0x1ac, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.998] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.998] SetEndOfFile (hFile=0x160) returned 1
	[0089.999] CloseHandle (hObject=0x160) returned 1
	[0089.999] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.999] SetEndOfFile (hFile=0x1ac) returned 1
	[0090.000] CloseHandle (hObject=0x1ac) returned 1
	[0090.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.001] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1
	[0090.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0090.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0090.001] lstrlenW (lpString=".doc") returned 4
	[0090.001] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.001] lstrlenW (lpString=".docx") returned 5
	[0090.001] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.001] lstrlenW (lpString=".pdf") returned 4
	[0090.001] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.001] lstrlenW (lpString=".xls") returned 4
	[0090.001] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.001] lstrlenW (lpString=".xlsx") returned 5
	[0090.001] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.001] lstrlenW (lpString=".ppt") returned 4
	[0090.001] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0090.002] lstrlenW (lpString=".zip") returned 4
	[0090.002] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.002] lstrlenW (lpString=".rar") returned 4
	[0090.002] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.002] lstrlenW (lpString=".bz2") returned 4
	[0090.002] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.002] lstrlenW (lpString=".7z") returned 3
	[0090.002] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0090.002] lstrlenW (lpString=".dbf") returned 4
	[0090.002] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0090.002] lstrlenW (lpString=".1cd") returned 4
	[0090.002] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0090.002] lstrlenW (lpString=".jpg") returned 4
	[0090.002] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0090.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0090.002] lstrlenW (lpString=".doc") returned 4
	[0090.002] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.002] lstrlenW (lpString=".docx") returned 5
	[0090.002] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.002] lstrlenW (lpString=".pdf") returned 4
	[0090.002] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.003] lstrlenW (lpString=".xls") returned 4
	[0090.003] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.003] lstrlenW (lpString=".xlsx") returned 5
	[0090.003] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.003] lstrlenW (lpString=".ppt") returned 4
	[0090.003] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0090.003] lstrlenW (lpString=".zip") returned 4
	[0090.003] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.003] lstrlenW (lpString=".rar") returned 4
	[0090.003] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.003] lstrlenW (lpString=".bz2") returned 4
	[0090.003] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.003] lstrlenW (lpString=".7z") returned 3
	[0090.003] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0090.003] lstrlenW (lpString=".dbf") returned 4
	[0090.003] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0090.003] lstrlenW (lpString=".1cd") returned 4
	[0090.003] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0090.003] lstrlenW (lpString=".jpg") returned 4
	[0090.003] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.004] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.004] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.043] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=37112) returned 1
	[0090.043] CloseHandle (hObject=0x160) returned 1
	[0090.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20
	[0090.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.044] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.044] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0090.045] GetLastError () returned 0x0
	[0090.045] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x90f8, lpOverlapped=0x0) returned 1
	[0090.058] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x9100, lpOverlapped=0x0) returned 1
	[0090.060] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.060] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.060] SetEndOfFile (hFile=0x1a8) returned 1
	[0090.060] CloseHandle (hObject=0x1a8) returned 1
	[0090.060] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.060] SetEndOfFile (hFile=0x160) returned 1
	[0090.062] CloseHandle (hObject=0x160) returned 1
	[0090.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.062] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1
	[0090.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0090.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0090.062] lstrlenW (lpString=".doc") returned 4
	[0090.062] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.062] lstrlenW (lpString=".docx") returned 5
	[0090.063] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.063] lstrlenW (lpString=".pdf") returned 4
	[0090.063] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.063] lstrlenW (lpString=".xls") returned 4
	[0090.063] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.063] lstrlenW (lpString=".xlsx") returned 5
	[0090.063] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.063] lstrlenW (lpString=".ppt") returned 4
	[0090.063] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0090.063] lstrlenW (lpString=".zip") returned 4
	[0090.063] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.063] lstrlenW (lpString=".rar") returned 4
	[0090.063] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.063] lstrlenW (lpString=".bz2") returned 4
	[0090.063] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.063] lstrlenW (lpString=".7z") returned 3
	[0090.063] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0090.063] lstrlenW (lpString=".dbf") returned 4
	[0090.063] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0090.063] lstrlenW (lpString=".1cd") returned 4
	[0090.063] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0090.063] lstrlenW (lpString=".jpg") returned 4
	[0090.063] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0090.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0090.064] lstrlenW (lpString=".doc") returned 4
	[0090.064] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.064] lstrlenW (lpString=".docx") returned 5
	[0090.064] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.064] lstrlenW (lpString=".pdf") returned 4
	[0090.064] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.064] lstrlenW (lpString=".xls") returned 4
	[0090.064] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.064] lstrlenW (lpString=".xlsx") returned 5
	[0090.064] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.064] lstrlenW (lpString=".ppt") returned 4
	[0090.064] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0090.064] lstrlenW (lpString=".zip") returned 4
	[0090.064] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.064] lstrlenW (lpString=".rar") returned 4
	[0090.064] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.064] lstrlenW (lpString=".bz2") returned 4
	[0090.064] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.064] lstrlenW (lpString=".7z") returned 3
	[0090.064] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0090.065] lstrlenW (lpString=".dbf") returned 4
	[0090.065] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0090.065] lstrlenW (lpString=".1cd") returned 4
	[0090.065] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0090.065] lstrlenW (lpString=".jpg") returned 4
	[0090.065] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.065] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.065] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0090.077] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=15737) returned 1
	[0090.077] CloseHandle (hObject=0x1b0) returned 1
	[0090.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20
	[0090.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0090.077] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.078] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0090.078] GetLastError () returned 0x0
	[0090.078] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x3d79, lpOverlapped=0x0) returned 1
	[0090.092] WriteFile (in: hFile=0x198, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x3d80, lpOverlapped=0x0) returned 1
	[0090.093] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.093] WriteFile (in: hFile=0x198, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.093] SetEndOfFile (hFile=0x198) returned 1
	[0090.093] CloseHandle (hObject=0x198) returned 1
	[0090.094] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.094] SetEndOfFile (hFile=0x1b0) returned 1
	[0090.095] CloseHandle (hObject=0x1b0) returned 1
	[0090.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.095] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1
	[0090.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0090.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0090.095] lstrlenW (lpString=".doc") returned 4
	[0090.095] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.096] lstrlenW (lpString=".docx") returned 5
	[0090.096] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.096] lstrlenW (lpString=".pdf") returned 4
	[0090.096] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.096] lstrlenW (lpString=".xls") returned 4
	[0090.096] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.096] lstrlenW (lpString=".xlsx") returned 5
	[0090.096] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.096] lstrlenW (lpString=".ppt") returned 4
	[0090.096] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0090.096] lstrlenW (lpString=".zip") returned 4
	[0090.096] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.096] lstrlenW (lpString=".rar") returned 4
	[0090.096] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.096] lstrlenW (lpString=".bz2") returned 4
	[0090.096] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.096] lstrlenW (lpString=".7z") returned 3
	[0090.096] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0090.096] lstrlenW (lpString=".dbf") returned 4
	[0090.096] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0090.096] lstrlenW (lpString=".1cd") returned 4
	[0090.096] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0090.096] lstrlenW (lpString=".jpg") returned 4
	[0090.097] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0090.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0090.097] lstrlenW (lpString=".doc") returned 4
	[0090.097] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.097] lstrlenW (lpString=".docx") returned 5
	[0090.097] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.097] lstrlenW (lpString=".pdf") returned 4
	[0090.097] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.097] lstrlenW (lpString=".xls") returned 4
	[0090.097] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.097] lstrlenW (lpString=".xlsx") returned 5
	[0090.097] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.097] lstrlenW (lpString=".ppt") returned 4
	[0090.097] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0090.097] lstrlenW (lpString=".zip") returned 4
	[0090.097] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.097] lstrlenW (lpString=".rar") returned 4
	[0090.097] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.097] lstrlenW (lpString=".bz2") returned 4
	[0090.097] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.097] lstrlenW (lpString=".7z") returned 3
	[0090.097] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0090.097] lstrlenW (lpString=".dbf") returned 4
	[0090.097] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0090.098] lstrlenW (lpString=".1cd") returned 4
	[0090.098] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0090.098] lstrlenW (lpString=".jpg") returned 4
	[0090.098] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.098] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.098] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0090.110] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=53115) returned 1
	[0090.110] CloseHandle (hObject=0x1b0) returned 1
	[0090.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20
	[0090.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0090.111] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.111] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0090.112] GetLastError () returned 0x0
	[0090.112] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xcf7b, lpOverlapped=0x0) returned 1
	[0090.125] WriteFile (in: hFile=0x198, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xcf80, lpOverlapped=0x0) returned 1
	[0090.127] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.127] WriteFile (in: hFile=0x198, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.127] SetEndOfFile (hFile=0x198) returned 1
	[0090.128] CloseHandle (hObject=0x198) returned 1
	[0090.128] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.128] SetEndOfFile (hFile=0x1b0) returned 1
	[0090.129] CloseHandle (hObject=0x1b0) returned 1
	[0090.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.130] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1
	[0090.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0090.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0090.130] lstrlenW (lpString=".doc") returned 4
	[0090.130] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.130] lstrlenW (lpString=".docx") returned 5
	[0090.130] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.130] lstrlenW (lpString=".pdf") returned 4
	[0090.130] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.130] lstrlenW (lpString=".xls") returned 4
	[0090.130] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.130] lstrlenW (lpString=".xlsx") returned 5
	[0090.130] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.131] lstrlenW (lpString=".ppt") returned 4
	[0090.131] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0090.131] lstrlenW (lpString=".zip") returned 4
	[0090.131] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.131] lstrlenW (lpString=".rar") returned 4
	[0090.131] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.131] lstrlenW (lpString=".bz2") returned 4
	[0090.131] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.131] lstrlenW (lpString=".7z") returned 3
	[0090.131] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0090.131] lstrlenW (lpString=".dbf") returned 4
	[0090.131] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0090.131] lstrlenW (lpString=".1cd") returned 4
	[0090.131] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0090.131] lstrlenW (lpString=".jpg") returned 4
	[0090.131] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0090.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0090.131] lstrlenW (lpString=".doc") returned 4
	[0090.131] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.131] lstrlenW (lpString=".docx") returned 5
	[0090.131] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.132] lstrlenW (lpString=".pdf") returned 4
	[0090.132] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.132] lstrlenW (lpString=".xls") returned 4
	[0090.132] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.132] lstrlenW (lpString=".xlsx") returned 5
	[0090.132] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.132] lstrlenW (lpString=".ppt") returned 4
	[0090.132] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0090.132] lstrlenW (lpString=".zip") returned 4
	[0090.132] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.132] lstrlenW (lpString=".rar") returned 4
	[0090.132] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.132] lstrlenW (lpString=".bz2") returned 4
	[0090.132] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.132] lstrlenW (lpString=".7z") returned 3
	[0090.132] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0090.132] lstrlenW (lpString=".dbf") returned 4
	[0090.132] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0090.132] lstrlenW (lpString=".1cd") returned 4
	[0090.132] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0090.132] lstrlenW (lpString=".jpg") returned 4
	[0090.132] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.133] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.133] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0090.160] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=31975) returned 1
	[0090.160] CloseHandle (hObject=0x1b4) returned 1
	[0090.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20
	[0090.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0090.161] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.161] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0090.163] GetLastError () returned 0x0
	[0090.163] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x7ce7, lpOverlapped=0x0) returned 1
	[0090.185] WriteFile (in: hFile=0x194, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x7cf0, lpOverlapped=0x0) returned 1
	[0090.187] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.187] WriteFile (in: hFile=0x194, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.187] SetEndOfFile (hFile=0x194) returned 1
	[0090.187] CloseHandle (hObject=0x194) returned 1
	[0090.187] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.187] SetEndOfFile (hFile=0x1b4) returned 1
	[0090.188] CloseHandle (hObject=0x1b4) returned 1
	[0090.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.191] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1
	[0090.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0090.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0090.192] lstrlenW (lpString=".doc") returned 4
	[0090.192] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.192] lstrlenW (lpString=".docx") returned 5
	[0090.192] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.192] lstrlenW (lpString=".pdf") returned 4
	[0090.192] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.192] lstrlenW (lpString=".xls") returned 4
	[0090.192] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.192] lstrlenW (lpString=".xlsx") returned 5
	[0090.192] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.192] lstrlenW (lpString=".ppt") returned 4
	[0090.192] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0090.192] lstrlenW (lpString=".zip") returned 4
	[0090.192] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.192] lstrlenW (lpString=".rar") returned 4
	[0090.192] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.192] lstrlenW (lpString=".bz2") returned 4
	[0090.192] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.192] lstrlenW (lpString=".7z") returned 3
	[0090.192] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0090.192] lstrlenW (lpString=".dbf") returned 4
	[0090.192] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0090.192] lstrlenW (lpString=".1cd") returned 4
	[0090.192] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0090.192] lstrlenW (lpString=".jpg") returned 4
	[0090.193] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0090.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0090.193] lstrlenW (lpString=".doc") returned 4
	[0090.193] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.193] lstrlenW (lpString=".docx") returned 5
	[0090.193] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.193] lstrlenW (lpString=".pdf") returned 4
	[0090.193] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.193] lstrlenW (lpString=".xls") returned 4
	[0090.193] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.193] lstrlenW (lpString=".xlsx") returned 5
	[0090.193] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.193] lstrlenW (lpString=".ppt") returned 4
	[0090.193] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0090.193] lstrlenW (lpString=".zip") returned 4
	[0090.193] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.193] lstrlenW (lpString=".rar") returned 4
	[0090.193] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.193] lstrlenW (lpString=".bz2") returned 4
	[0090.193] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.193] lstrlenW (lpString=".7z") returned 3
	[0090.193] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0090.193] lstrlenW (lpString=".dbf") returned 4
	[0090.193] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0090.193] lstrlenW (lpString=".1cd") returned 4
	[0090.193] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0090.194] lstrlenW (lpString=".jpg") returned 4
	[0090.194] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.194] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.194] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.240] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=47962) returned 1
	[0090.240] CloseHandle (hObject=0x184) returned 1
	[0090.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20
	[0090.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.241] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.241] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0090.241] GetLastError () returned 0x0
	[0090.241] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xbb5a, lpOverlapped=0x0) returned 1
	[0090.251] WriteFile (in: hFile=0x194, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xbb60, lpOverlapped=0x0) returned 1
	[0090.252] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.252] WriteFile (in: hFile=0x194, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.253] SetEndOfFile (hFile=0x194) returned 1
	[0090.253] CloseHandle (hObject=0x194) returned 1
	[0090.253] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.253] SetEndOfFile (hFile=0x184) returned 1
	[0090.254] CloseHandle (hObject=0x184) returned 1
	[0090.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.254] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1
	[0090.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0090.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0090.255] lstrlenW (lpString=".doc") returned 4
	[0090.255] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.255] lstrlenW (lpString=".docx") returned 5
	[0090.255] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.255] lstrlenW (lpString=".pdf") returned 4
	[0090.255] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.255] lstrlenW (lpString=".xls") returned 4
	[0090.255] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.255] lstrlenW (lpString=".xlsx") returned 5
	[0090.255] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.255] lstrlenW (lpString=".ppt") returned 4
	[0090.255] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0090.255] lstrlenW (lpString=".zip") returned 4
	[0090.255] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.255] lstrlenW (lpString=".rar") returned 4
	[0090.255] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.255] lstrlenW (lpString=".bz2") returned 4
	[0090.255] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.255] lstrlenW (lpString=".7z") returned 3
	[0090.255] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0090.255] lstrlenW (lpString=".dbf") returned 4
	[0090.255] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0090.255] lstrlenW (lpString=".1cd") returned 4
	[0090.255] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0090.255] lstrlenW (lpString=".jpg") returned 4
	[0090.255] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0090.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0090.255] lstrlenW (lpString=".doc") returned 4
	[0090.256] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.256] lstrlenW (lpString=".docx") returned 5
	[0090.256] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.256] lstrlenW (lpString=".pdf") returned 4
	[0090.256] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.256] lstrlenW (lpString=".xls") returned 4
	[0090.256] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.256] lstrlenW (lpString=".xlsx") returned 5
	[0090.256] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.256] lstrlenW (lpString=".ppt") returned 4
	[0090.256] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0090.256] lstrlenW (lpString=".zip") returned 4
	[0090.256] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.256] lstrlenW (lpString=".rar") returned 4
	[0090.256] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.256] lstrlenW (lpString=".bz2") returned 4
	[0090.256] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.256] lstrlenW (lpString=".7z") returned 3
	[0090.256] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0090.256] lstrlenW (lpString=".dbf") returned 4
	[0090.256] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0090.256] lstrlenW (lpString=".1cd") returned 4
	[0090.256] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0090.256] lstrlenW (lpString=".jpg") returned 4
	[0090.256] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.257] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.257] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0090.294] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=27177) returned 1
	[0090.294] CloseHandle (hObject=0x194) returned 1
	[0090.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20
	[0090.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0090.434] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.434] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.465] GetLastError () returned 0x0
	[0090.465] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x6a29, lpOverlapped=0x0) returned 1
	[0090.487] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x6a30, lpOverlapped=0x0) returned 1
	[0090.489] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.489] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.489] SetEndOfFile (hFile=0x184) returned 1
	[0090.489] CloseHandle (hObject=0x184) returned 1
	[0090.489] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.489] SetEndOfFile (hFile=0x190) returned 1
	[0090.490] CloseHandle (hObject=0x190) returned 1
	[0090.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.491] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1
	[0090.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0090.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0090.491] lstrlenW (lpString=".doc") returned 4
	[0090.491] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.491] lstrlenW (lpString=".docx") returned 5
	[0090.491] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.491] lstrlenW (lpString=".pdf") returned 4
	[0090.491] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.491] lstrlenW (lpString=".xls") returned 4
	[0090.491] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.491] lstrlenW (lpString=".xlsx") returned 5
	[0090.491] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.492] lstrlenW (lpString=".ppt") returned 4
	[0090.492] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0090.492] lstrlenW (lpString=".zip") returned 4
	[0090.492] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.492] lstrlenW (lpString=".rar") returned 4
	[0090.492] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.492] lstrlenW (lpString=".bz2") returned 4
	[0090.492] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.492] lstrlenW (lpString=".7z") returned 3
	[0090.492] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0090.492] lstrlenW (lpString=".dbf") returned 4
	[0090.492] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0090.492] lstrlenW (lpString=".1cd") returned 4
	[0090.492] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0090.492] lstrlenW (lpString=".jpg") returned 4
	[0090.492] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0090.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0090.492] lstrlenW (lpString=".doc") returned 4
	[0090.492] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.492] lstrlenW (lpString=".docx") returned 5
	[0090.492] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.493] lstrlenW (lpString=".pdf") returned 4
	[0090.493] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.493] lstrlenW (lpString=".xls") returned 4
	[0090.493] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.493] lstrlenW (lpString=".xlsx") returned 5
	[0090.493] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.493] lstrlenW (lpString=".ppt") returned 4
	[0090.493] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0090.493] lstrlenW (lpString=".zip") returned 4
	[0090.493] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.493] lstrlenW (lpString=".rar") returned 4
	[0090.493] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.493] lstrlenW (lpString=".bz2") returned 4
	[0090.493] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.493] lstrlenW (lpString=".7z") returned 3
	[0090.493] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0090.493] lstrlenW (lpString=".dbf") returned 4
	[0090.493] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0090.493] lstrlenW (lpString=".1cd") returned 4
	[0090.493] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0090.493] lstrlenW (lpString=".jpg") returned 4
	[0090.493] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.494] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.494] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0090.506] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=44302) returned 1
	[0090.506] CloseHandle (hObject=0x1b4) returned 1
	[0090.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20
	[0090.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0090.507] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.507] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0090.507] GetLastError () returned 0x0
	[0090.507] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xad0e, lpOverlapped=0x0) returned 1
	[0090.520] WriteFile (in: hFile=0x19c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xad10, lpOverlapped=0x0) returned 1
	[0090.522] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.522] WriteFile (in: hFile=0x19c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.522] SetEndOfFile (hFile=0x19c) returned 1
	[0090.522] CloseHandle (hObject=0x19c) returned 1
	[0090.522] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.522] SetEndOfFile (hFile=0x1b4) returned 1
	[0090.524] CloseHandle (hObject=0x1b4) returned 1
	[0090.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.524] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1
	[0090.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0090.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0090.524] lstrlenW (lpString=".doc") returned 4
	[0090.524] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.524] lstrlenW (lpString=".docx") returned 5
	[0090.524] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.524] lstrlenW (lpString=".pdf") returned 4
	[0090.524] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.525] lstrlenW (lpString=".xls") returned 4
	[0090.525] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.525] lstrlenW (lpString=".xlsx") returned 5
	[0090.525] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.525] lstrlenW (lpString=".ppt") returned 4
	[0090.525] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0090.525] lstrlenW (lpString=".zip") returned 4
	[0090.525] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.525] lstrlenW (lpString=".rar") returned 4
	[0090.525] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.525] lstrlenW (lpString=".bz2") returned 4
	[0090.525] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.525] lstrlenW (lpString=".7z") returned 3
	[0090.525] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0090.525] lstrlenW (lpString=".dbf") returned 4
	[0090.525] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0090.525] lstrlenW (lpString=".1cd") returned 4
	[0090.525] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0090.525] lstrlenW (lpString=".jpg") returned 4
	[0090.525] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0090.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0090.525] lstrlenW (lpString=".doc") returned 4
	[0090.526] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.526] lstrlenW (lpString=".docx") returned 5
	[0090.526] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.526] lstrlenW (lpString=".pdf") returned 4
	[0090.526] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.526] lstrlenW (lpString=".xls") returned 4
	[0090.526] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.526] lstrlenW (lpString=".xlsx") returned 5
	[0090.526] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.526] lstrlenW (lpString=".ppt") returned 4
	[0090.526] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0090.526] lstrlenW (lpString=".zip") returned 4
	[0090.526] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.526] lstrlenW (lpString=".rar") returned 4
	[0090.526] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.526] lstrlenW (lpString=".bz2") returned 4
	[0090.526] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.526] lstrlenW (lpString=".7z") returned 3
	[0090.526] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0090.526] lstrlenW (lpString=".dbf") returned 4
	[0090.526] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0090.526] lstrlenW (lpString=".1cd") returned 4
	[0090.526] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0090.527] lstrlenW (lpString=".jpg") returned 4
	[0090.527] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.527] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.527] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0090.536] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=42453) returned 1
	[0090.536] CloseHandle (hObject=0x190) returned 1
	[0090.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20
	[0090.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0090.537] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.537] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.537] GetLastError () returned 0x0
	[0090.538] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xa5d5, lpOverlapped=0x0) returned 1
	[0090.551] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xa5e0, lpOverlapped=0x0) returned 1
	[0090.553] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.553] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.553] SetEndOfFile (hFile=0x184) returned 1
	[0090.553] CloseHandle (hObject=0x184) returned 1
	[0090.554] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.554] SetEndOfFile (hFile=0x190) returned 1
	[0090.558] CloseHandle (hObject=0x190) returned 1
	[0090.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.559] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1
	[0090.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0090.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0090.559] lstrlenW (lpString=".doc") returned 4
	[0090.559] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.559] lstrlenW (lpString=".docx") returned 5
	[0090.559] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.559] lstrlenW (lpString=".pdf") returned 4
	[0090.559] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.559] lstrlenW (lpString=".xls") returned 4
	[0090.559] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.559] lstrlenW (lpString=".xlsx") returned 5
	[0090.559] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.559] lstrlenW (lpString=".ppt") returned 4
	[0090.560] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0090.560] lstrlenW (lpString=".zip") returned 4
	[0090.560] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.560] lstrlenW (lpString=".rar") returned 4
	[0090.560] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.560] lstrlenW (lpString=".bz2") returned 4
	[0090.560] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.560] lstrlenW (lpString=".7z") returned 3
	[0090.560] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0090.560] lstrlenW (lpString=".dbf") returned 4
	[0090.560] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0090.560] lstrlenW (lpString=".1cd") returned 4
	[0090.560] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0090.560] lstrlenW (lpString=".jpg") returned 4
	[0090.560] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0090.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0090.560] lstrlenW (lpString=".doc") returned 4
	[0090.560] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.560] lstrlenW (lpString=".docx") returned 5
	[0090.560] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.560] lstrlenW (lpString=".pdf") returned 4
	[0090.561] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.561] lstrlenW (lpString=".xls") returned 4
	[0090.561] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.561] lstrlenW (lpString=".xlsx") returned 5
	[0090.561] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.561] lstrlenW (lpString=".ppt") returned 4
	[0090.561] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0090.561] lstrlenW (lpString=".zip") returned 4
	[0090.561] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.561] lstrlenW (lpString=".rar") returned 4
	[0090.561] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.561] lstrlenW (lpString=".bz2") returned 4
	[0090.561] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.561] lstrlenW (lpString=".7z") returned 3
	[0090.561] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0090.561] lstrlenW (lpString=".dbf") returned 4
	[0090.561] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0090.561] lstrlenW (lpString=".1cd") returned 4
	[0090.561] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0090.561] lstrlenW (lpString=".jpg") returned 4
	[0090.561] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.562] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.562] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0090.576] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=30170) returned 1
	[0090.576] CloseHandle (hObject=0x190) returned 1
	[0090.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20
	[0090.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.643] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.643] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0090.651] GetLastError () returned 0x0
	[0090.651] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x75da, lpOverlapped=0x0) returned 1
	[0090.769] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x75e0, lpOverlapped=0x0) returned 1
	[0090.771] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.771] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.771] SetEndOfFile (hFile=0x1b4) returned 1
	[0090.772] CloseHandle (hObject=0x1b4) returned 1
	[0090.772] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.772] SetEndOfFile (hFile=0x160) returned 1
	[0090.773] CloseHandle (hObject=0x160) returned 1
	[0090.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.774] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1
	[0090.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0090.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0090.774] lstrlenW (lpString=".doc") returned 4
	[0090.774] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.774] lstrlenW (lpString=".docx") returned 5
	[0090.774] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.774] lstrlenW (lpString=".pdf") returned 4
	[0090.774] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.774] lstrlenW (lpString=".xls") returned 4
	[0090.774] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.774] lstrlenW (lpString=".xlsx") returned 5
	[0090.774] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.774] lstrlenW (lpString=".ppt") returned 4
	[0090.774] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0090.774] lstrlenW (lpString=".zip") returned 4
	[0090.775] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.775] lstrlenW (lpString=".rar") returned 4
	[0090.775] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.775] lstrlenW (lpString=".bz2") returned 4
	[0090.775] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.775] lstrlenW (lpString=".7z") returned 3
	[0090.775] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0090.775] lstrlenW (lpString=".dbf") returned 4
	[0090.775] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0090.775] lstrlenW (lpString=".1cd") returned 4
	[0090.775] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0090.775] lstrlenW (lpString=".jpg") returned 4
	[0090.775] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0090.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0090.775] lstrlenW (lpString=".doc") returned 4
	[0090.775] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.775] lstrlenW (lpString=".docx") returned 5
	[0090.775] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.775] lstrlenW (lpString=".pdf") returned 4
	[0090.775] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.775] lstrlenW (lpString=".xls") returned 4
	[0090.776] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.776] lstrlenW (lpString=".xlsx") returned 5
	[0090.776] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.776] lstrlenW (lpString=".ppt") returned 4
	[0090.776] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0090.776] lstrlenW (lpString=".zip") returned 4
	[0090.776] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.776] lstrlenW (lpString=".rar") returned 4
	[0090.776] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.776] lstrlenW (lpString=".bz2") returned 4
	[0090.776] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.776] lstrlenW (lpString=".7z") returned 3
	[0090.776] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0090.776] lstrlenW (lpString=".dbf") returned 4
	[0090.776] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0090.776] lstrlenW (lpString=".1cd") returned 4
	[0090.776] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0090.776] lstrlenW (lpString=".jpg") returned 4
	[0090.776] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.777] lstrcmpiW (lpString1=".CHM", lpString2=".adobe") returned 1
	[0090.777] lstrlenW (lpString="VBCN6.CHM") returned 9
	[0090.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.777] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=109718) returned 1
	[0090.777] CloseHandle (hObject=0x160) returned 1
	[0090.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20
	[0090.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.778] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.778] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0090.779] GetLastError () returned 0x0
	[0090.779] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1ac96, lpOverlapped=0x0) returned 1
	[0090.850] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1aca0, lpOverlapped=0x0) returned 1
	[0090.853] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.853] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0090.853] SetEndOfFile (hFile=0x1b4) returned 1
	[0090.853] CloseHandle (hObject=0x1b4) returned 1
	[0090.854] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.854] SetEndOfFile (hFile=0x160) returned 1
	[0090.855] CloseHandle (hObject=0x160) returned 1
	[0090.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.856] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1
	[0090.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0090.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0090.856] lstrlenW (lpString=".doc") returned 4
	[0090.856] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0090.856] lstrlenW (lpString=".docx") returned 5
	[0090.856] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0090.856] lstrlenW (lpString=".pdf") returned 4
	[0090.856] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0090.856] lstrlenW (lpString=".xls") returned 4
	[0090.856] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0090.856] lstrlenW (lpString=".xlsx") returned 5
	[0090.856] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0090.857] lstrlenW (lpString=".ppt") returned 4
	[0090.857] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0090.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0090.857] lstrlenW (lpString=".zip") returned 4
	[0090.857] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0090.857] lstrlenW (lpString=".rar") returned 4
	[0090.857] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0090.857] lstrlenW (lpString=".bz2") returned 4
	[0090.857] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0090.857] lstrlenW (lpString=".7z") returned 3
	[0090.857] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0090.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0090.857] lstrlenW (lpString=".dbf") returned 4
	[0090.857] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0090.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0090.857] lstrlenW (lpString=".1cd") returned 4
	[0090.857] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0090.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0090.857] lstrlenW (lpString=".jpg") returned 4
	[0090.857] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0090.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0090.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0090.857] lstrlenW (lpString=".doc") returned 4
	[0090.857] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0090.857] lstrlenW (lpString=".docx") returned 5
	[0090.857] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0090.858] lstrlenW (lpString=".pdf") returned 4
	[0090.858] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0090.858] lstrlenW (lpString=".xls") returned 4
	[0090.858] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0090.858] lstrlenW (lpString=".xlsx") returned 5
	[0090.858] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0090.858] lstrlenW (lpString=".ppt") returned 4
	[0090.858] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0090.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0090.858] lstrlenW (lpString=".zip") returned 4
	[0090.858] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0090.858] lstrlenW (lpString=".rar") returned 4
	[0090.858] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0090.858] lstrlenW (lpString=".bz2") returned 4
	[0090.858] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0090.858] lstrlenW (lpString=".7z") returned 3
	[0090.858] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0090.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0090.858] lstrlenW (lpString=".dbf") returned 4
	[0090.858] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0090.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0090.858] lstrlenW (lpString=".1cd") returned 4
	[0090.859] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0090.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0090.859] lstrlenW (lpString=".jpg") returned 4
	[0090.859] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0090.859] lstrcmpiW (lpString1=".CHM", lpString2=".adobe") returned 1
	[0090.859] lstrlenW (lpString="VBENDF98.CHM") returned 12
	[0090.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.860] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=72031) returned 1
	[0090.860] CloseHandle (hObject=0x160) returned 1
	[0090.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20
	[0090.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.861] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.861] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0090.862] GetLastError () returned 0x0
	[0090.862] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1195f, lpOverlapped=0x0) returned 1
	[0091.057] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x11960, lpOverlapped=0x0) returned 1
	[0091.060] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.060] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0091.060] SetEndOfFile (hFile=0x1b4) returned 1
	[0091.060] CloseHandle (hObject=0x1b4) returned 1
	[0091.061] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.061] SetEndOfFile (hFile=0x160) returned 1
	[0091.062] CloseHandle (hObject=0x160) returned 1
	[0091.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0091.063] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1
	[0091.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0091.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0091.063] lstrlenW (lpString=".doc") returned 4
	[0091.063] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0091.063] lstrlenW (lpString=".docx") returned 5
	[0091.063] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1
	[0091.064] lstrlenW (lpString=".pdf") returned 4
	[0091.064] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0091.064] lstrlenW (lpString=".xls") returned 4
	[0091.064] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0091.064] lstrlenW (lpString=".xlsx") returned 5
	[0091.064] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1
	[0091.064] lstrlenW (lpString=".ppt") returned 4
	[0091.064] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0091.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0091.064] lstrlenW (lpString=".zip") returned 4
	[0091.064] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0091.064] lstrlenW (lpString=".rar") returned 4
	[0091.064] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0091.064] lstrlenW (lpString=".bz2") returned 4
	[0091.064] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0091.064] lstrlenW (lpString=".7z") returned 3
	[0091.065] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0091.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0091.065] lstrlenW (lpString=".dbf") returned 4
	[0091.065] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0091.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0091.065] lstrlenW (lpString=".1cd") returned 4
	[0091.065] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0091.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0091.065] lstrlenW (lpString=".jpg") returned 4
	[0091.065] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0091.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0091.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0091.065] lstrlenW (lpString=".doc") returned 4
	[0091.065] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0091.065] lstrlenW (lpString=".docx") returned 5
	[0091.065] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1
	[0091.065] lstrlenW (lpString=".pdf") returned 4
	[0091.065] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0091.065] lstrlenW (lpString=".xls") returned 4
	[0091.065] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0091.065] lstrlenW (lpString=".xlsx") returned 5
	[0091.065] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1
	[0091.065] lstrlenW (lpString=".ppt") returned 4
	[0091.065] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0091.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0091.066] lstrlenW (lpString=".zip") returned 4
	[0091.066] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0091.066] lstrlenW (lpString=".rar") returned 4
	[0091.066] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0091.066] lstrlenW (lpString=".bz2") returned 4
	[0091.066] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0091.066] lstrlenW (lpString=".7z") returned 3
	[0091.066] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0091.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0091.066] lstrlenW (lpString=".dbf") returned 4
	[0091.066] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0091.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0091.066] lstrlenW (lpString=".1cd") returned 4
	[0091.066] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0091.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0091.066] lstrlenW (lpString=".jpg") returned 4
	[0091.066] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0091.066] lstrcmpiW (lpString1=".CHM", lpString2=".adobe") returned 1
	[0091.067] lstrlenW (lpString="VBOB6.CHM") returned 9
	[0091.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0091.067] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=123956) returned 1
	[0091.067] CloseHandle (hObject=0x160) returned 1
	[0091.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20
	[0091.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0091.068] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.068] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0091.069] GetLastError () returned 0x0
	[0091.069] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1e434, lpOverlapped=0x0) returned 1
	[0091.082] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1e440, lpOverlapped=0x0) returned 1
	[0091.085] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.085] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0091.085] SetEndOfFile (hFile=0x1b4) returned 1
	[0091.085] CloseHandle (hObject=0x1b4) returned 1
	[0091.086] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.086] SetEndOfFile (hFile=0x160) returned 1
	[0091.087] CloseHandle (hObject=0x160) returned 1
	[0091.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0091.088] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1
	[0091.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0091.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0091.088] lstrlenW (lpString=".doc") returned 4
	[0091.088] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0091.088] lstrlenW (lpString=".docx") returned 5
	[0091.088] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0091.088] lstrlenW (lpString=".pdf") returned 4
	[0091.088] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0091.088] lstrlenW (lpString=".xls") returned 4
	[0091.088] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0091.088] lstrlenW (lpString=".xlsx") returned 5
	[0091.089] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0091.089] lstrlenW (lpString=".ppt") returned 4
	[0091.089] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0091.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0091.089] lstrlenW (lpString=".zip") returned 4
	[0091.089] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0091.089] lstrlenW (lpString=".rar") returned 4
	[0091.089] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0091.089] lstrlenW (lpString=".bz2") returned 4
	[0091.089] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0091.089] lstrlenW (lpString=".7z") returned 3
	[0091.089] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0091.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0091.089] lstrlenW (lpString=".dbf") returned 4
	[0091.089] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0091.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0091.089] lstrlenW (lpString=".1cd") returned 4
	[0091.089] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0091.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0091.089] lstrlenW (lpString=".jpg") returned 4
	[0091.089] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0091.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0091.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0091.089] lstrlenW (lpString=".doc") returned 4
	[0091.089] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0091.089] lstrlenW (lpString=".docx") returned 5
	[0091.089] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0091.089] lstrlenW (lpString=".pdf") returned 4
	[0091.089] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0091.089] lstrlenW (lpString=".xls") returned 4
	[0091.089] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0091.090] lstrlenW (lpString=".xlsx") returned 5
	[0091.090] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0091.090] lstrlenW (lpString=".ppt") returned 4
	[0091.090] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0091.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0091.090] lstrlenW (lpString=".zip") returned 4
	[0091.090] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0091.090] lstrlenW (lpString=".rar") returned 4
	[0091.090] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0091.090] lstrlenW (lpString=".bz2") returned 4
	[0091.090] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0091.090] lstrlenW (lpString=".7z") returned 3
	[0091.090] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0091.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0091.090] lstrlenW (lpString=".dbf") returned 4
	[0091.090] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0091.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0091.090] lstrlenW (lpString=".1cd") returned 4
	[0091.090] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0091.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0091.090] lstrlenW (lpString=".jpg") returned 4
	[0091.090] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0091.090] lstrcmpiW (lpString1=".CHM", lpString2=".adobe") returned 1
	[0091.090] lstrlenW (lpString="VBUI6.CHM") returned 9
	[0091.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0091.092] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=416918) returned 1
	[0091.092] CloseHandle (hObject=0x160) returned 1
	[0091.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20
	[0091.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0091.092] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.092] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0091.093] GetLastError () returned 0x0
	[0091.093] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x65c96, lpOverlapped=0x0) returned 1
	[0091.284] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x65ca0, lpOverlapped=0x0) returned 1
	[0091.298] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.298] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0091.298] SetEndOfFile (hFile=0x1b4) returned 1
	[0091.298] CloseHandle (hObject=0x1b4) returned 1
	[0091.299] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.299] SetEndOfFile (hFile=0x160) returned 1
	[0091.304] CloseHandle (hObject=0x160) returned 1
	[0091.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0091.304] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1
	[0091.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0091.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0091.305] lstrlenW (lpString=".doc") returned 4
	[0091.305] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0091.305] lstrlenW (lpString=".docx") returned 5
	[0091.305] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0091.305] lstrlenW (lpString=".pdf") returned 4
	[0091.305] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0091.305] lstrlenW (lpString=".xls") returned 4
	[0091.305] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0091.305] lstrlenW (lpString=".xlsx") returned 5
	[0091.305] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0091.305] lstrlenW (lpString=".ppt") returned 4
	[0091.305] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0091.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0091.305] lstrlenW (lpString=".zip") returned 4
	[0091.305] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0091.305] lstrlenW (lpString=".rar") returned 4
	[0091.305] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0091.305] lstrlenW (lpString=".bz2") returned 4
	[0091.305] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0091.305] lstrlenW (lpString=".7z") returned 3
	[0091.305] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0091.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0091.306] lstrlenW (lpString=".dbf") returned 4
	[0091.306] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0091.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0091.306] lstrlenW (lpString=".1cd") returned 4
	[0091.306] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0091.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0091.306] lstrlenW (lpString=".jpg") returned 4
	[0091.306] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0091.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0091.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0091.306] lstrlenW (lpString=".doc") returned 4
	[0091.306] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0091.306] lstrlenW (lpString=".docx") returned 5
	[0091.306] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0091.306] lstrlenW (lpString=".pdf") returned 4
	[0091.306] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0091.306] lstrlenW (lpString=".xls") returned 4
	[0091.306] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0091.306] lstrlenW (lpString=".xlsx") returned 5
	[0091.306] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0091.306] lstrlenW (lpString=".ppt") returned 4
	[0091.306] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0091.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0091.306] lstrlenW (lpString=".zip") returned 4
	[0091.307] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0091.307] lstrlenW (lpString=".rar") returned 4
	[0091.307] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0091.307] lstrlenW (lpString=".bz2") returned 4
	[0091.307] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0091.307] lstrlenW (lpString=".7z") returned 3
	[0091.307] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0091.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0091.307] lstrlenW (lpString=".dbf") returned 4
	[0091.307] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0091.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0091.307] lstrlenW (lpString=".1cd") returned 4
	[0091.307] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0091.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0091.307] lstrlenW (lpString=".jpg") returned 4
	[0091.307] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0091.307] lstrcmpiW (lpString1=".config", lpString2=".adobe") returned 1
	[0091.307] lstrlenW (lpString="VSTOInstaller.config") returned 20
	[0091.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0091.422] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=716) returned 1
	[0091.422] CloseHandle (hObject=0x1b4) returned 1
	[0091.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20
	[0091.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0091.426] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.426] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0091.427] GetLastError () returned 0x0
	[0091.427] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x2cc, lpOverlapped=0x0) returned 1
	[0091.519] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2d0, lpOverlapped=0x0) returned 1
	[0091.521] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.521] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0091.521] SetEndOfFile (hFile=0x1a8) returned 1
	[0091.521] CloseHandle (hObject=0x1a8) returned 1
	[0091.521] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.522] SetEndOfFile (hFile=0x1b4) returned 1
	[0091.523] CloseHandle (hObject=0x1b4) returned 1
	[0091.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0091.523] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1
	[0091.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0091.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0091.523] lstrlenW (lpString=".doc") returned 4
	[0091.523] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1
	[0091.523] lstrlenW (lpString=".docx") returned 5
	[0091.523] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1
	[0091.524] lstrlenW (lpString=".pdf") returned 4
	[0091.524] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1
	[0091.524] lstrlenW (lpString=".xls") returned 4
	[0091.524] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1
	[0091.524] lstrlenW (lpString=".xlsx") returned 5
	[0091.524] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1
	[0091.524] lstrlenW (lpString=".ppt") returned 4
	[0091.524] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1
	[0091.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0091.524] lstrlenW (lpString=".zip") returned 4
	[0091.524] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1
	[0091.524] lstrlenW (lpString=".rar") returned 4
	[0091.524] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1
	[0091.524] lstrlenW (lpString=".bz2") returned 4
	[0091.524] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1
	[0091.524] lstrlenW (lpString=".7z") returned 3
	[0091.524] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1
	[0091.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0091.524] lstrlenW (lpString=".dbf") returned 4
	[0091.524] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1
	[0091.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0091.524] lstrlenW (lpString=".1cd") returned 4
	[0091.524] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1
	[0091.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0091.524] lstrlenW (lpString=".jpg") returned 4
	[0091.524] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1
	[0091.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0091.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0091.525] lstrlenW (lpString=".doc") returned 4
	[0091.525] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1
	[0091.525] lstrlenW (lpString=".docx") returned 5
	[0091.525] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1
	[0091.525] lstrlenW (lpString=".pdf") returned 4
	[0091.525] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1
	[0091.525] lstrlenW (lpString=".xls") returned 4
	[0091.525] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1
	[0091.525] lstrlenW (lpString=".xlsx") returned 5
	[0091.525] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1
	[0091.525] lstrlenW (lpString=".ppt") returned 4
	[0091.525] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1
	[0091.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0091.525] lstrlenW (lpString=".zip") returned 4
	[0091.525] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1
	[0091.525] lstrlenW (lpString=".rar") returned 4
	[0091.525] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1
	[0091.525] lstrlenW (lpString=".bz2") returned 4
	[0091.525] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1
	[0091.525] lstrlenW (lpString=".7z") returned 3
	[0091.525] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1
	[0091.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0091.525] lstrlenW (lpString=".dbf") returned 4
	[0091.525] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1
	[0091.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0091.526] lstrlenW (lpString=".1cd") returned 4
	[0091.526] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1
	[0091.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0091.526] lstrlenW (lpString=".jpg") returned 4
	[0091.526] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1
	[0091.526] lstrcmpiW (lpString1=".MSG", lpString2=".adobe") returned 1
	[0091.526] lstrlenW (lpString="FPEXT.MSG") returned 9
	[0091.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0091.527] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=169637) returned 1
	[0091.527] CloseHandle (hObject=0x1b4) returned 1
	[0091.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20
	[0091.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0091.529] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.529] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0091.530] GetLastError () returned 0x0
	[0091.530] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x296a5, lpOverlapped=0x0) returned 1
	[0091.536] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x296b0, lpOverlapped=0x0) returned 1
	[0091.541] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.541] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0091.541] SetEndOfFile (hFile=0x1a8) returned 1
	[0091.542] CloseHandle (hObject=0x1a8) returned 1
	[0091.542] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.542] SetEndOfFile (hFile=0x1b4) returned 1
	[0091.544] CloseHandle (hObject=0x1b4) returned 1
	[0091.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0091.544] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1
	[0091.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0091.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0091.545] lstrlenW (lpString=".doc") returned 4
	[0091.545] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1
	[0091.545] lstrlenW (lpString=".docx") returned 5
	[0091.545] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1
	[0091.545] lstrlenW (lpString=".pdf") returned 4
	[0091.545] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1
	[0091.545] lstrlenW (lpString=".xls") returned 4
	[0091.545] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1
	[0091.545] lstrlenW (lpString=".xlsx") returned 5
	[0091.545] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1
	[0091.545] lstrlenW (lpString=".ppt") returned 4
	[0091.545] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1
	[0091.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0091.545] lstrlenW (lpString=".zip") returned 4
	[0091.545] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1
	[0091.545] lstrlenW (lpString=".rar") returned 4
	[0091.545] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1
	[0091.545] lstrlenW (lpString=".bz2") returned 4
	[0091.545] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1
	[0091.546] lstrlenW (lpString=".7z") returned 3
	[0091.546] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1
	[0091.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0091.546] lstrlenW (lpString=".dbf") returned 4
	[0091.546] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1
	[0091.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0091.546] lstrlenW (lpString=".1cd") returned 4
	[0091.546] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1
	[0091.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0091.546] lstrlenW (lpString=".jpg") returned 4
	[0091.546] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1
	[0091.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0091.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0091.546] lstrlenW (lpString=".doc") returned 4
	[0091.546] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1
	[0091.546] lstrlenW (lpString=".docx") returned 5
	[0091.546] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1
	[0091.546] lstrlenW (lpString=".pdf") returned 4
	[0091.546] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1
	[0091.546] lstrlenW (lpString=".xls") returned 4
	[0091.547] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1
	[0091.547] lstrlenW (lpString=".xlsx") returned 5
	[0091.547] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1
	[0091.547] lstrlenW (lpString=".ppt") returned 4
	[0091.547] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1
	[0091.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0091.547] lstrlenW (lpString=".zip") returned 4
	[0091.547] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1
	[0091.547] lstrlenW (lpString=".rar") returned 4
	[0091.547] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1
	[0091.547] lstrlenW (lpString=".bz2") returned 4
	[0091.547] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1
	[0091.547] lstrlenW (lpString=".7z") returned 3
	[0091.547] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1
	[0091.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0091.547] lstrlenW (lpString=".dbf") returned 4
	[0091.548] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1
	[0091.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0091.548] lstrlenW (lpString=".1cd") returned 4
	[0091.548] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1
	[0091.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0091.548] lstrlenW (lpString=".jpg") returned 4
	[0091.548] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1
	[0091.548] lstrcmpiW (lpString1=".bmp", lpString2=".adobe") returned 1
	[0091.548] lstrlenW (lpString="verisign.bmp") returned 12
	[0091.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0091.549] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2702) returned 1
	[0091.550] CloseHandle (hObject=0x1b4) returned 1
	[0091.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20
	[0091.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0091.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0091.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0091.550] lstrlenW (lpString=".doc") returned 4
	[0091.550] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0091.550] lstrlenW (lpString=".docx") returned 5
	[0091.550] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1
	[0091.550] lstrlenW (lpString=".pdf") returned 4
	[0091.551] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0091.551] lstrlenW (lpString=".xls") returned 4
	[0091.551] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0091.551] lstrlenW (lpString=".xlsx") returned 5
	[0091.551] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1
	[0091.551] lstrlenW (lpString=".ppt") returned 4
	[0091.551] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0091.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0091.551] lstrlenW (lpString=".zip") returned 4
	[0091.551] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0091.551] lstrlenW (lpString=".rar") returned 4
	[0091.551] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0091.551] lstrlenW (lpString=".bz2") returned 4
	[0091.551] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0091.551] lstrlenW (lpString=".7z") returned 3
	[0091.551] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0091.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0091.551] lstrlenW (lpString=".dbf") returned 4
	[0091.551] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0091.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0091.551] lstrlenW (lpString=".1cd") returned 4
	[0091.551] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0091.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0091.551] lstrlenW (lpString=".jpg") returned 4
	[0091.551] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0091.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0091.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0091.553] lstrlenW (lpString=".doc") returned 4
	[0091.553] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0091.553] lstrlenW (lpString=".docx") returned 5
	[0091.554] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1
	[0091.554] lstrlenW (lpString=".pdf") returned 4
	[0091.554] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0091.554] lstrlenW (lpString=".xls") returned 4
	[0091.554] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0091.554] lstrlenW (lpString=".xlsx") returned 5
	[0091.554] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1
	[0091.554] lstrlenW (lpString=".ppt") returned 4
	[0091.554] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0091.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0091.554] lstrlenW (lpString=".zip") returned 4
	[0091.554] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0091.554] lstrlenW (lpString=".rar") returned 4
	[0091.554] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0091.554] lstrlenW (lpString=".bz2") returned 4
	[0091.554] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0091.554] lstrlenW (lpString=".7z") returned 3
	[0091.554] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0091.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0091.554] lstrlenW (lpString=".dbf") returned 4
	[0091.554] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0091.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0091.554] lstrlenW (lpString=".1cd") returned 4
	[0091.554] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0091.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0091.554] lstrlenW (lpString=".jpg") returned 4
	[0091.554] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0091.555] lstrcmpiW (lpString1=".inc", lpString2=".adobe") returned 1
	[0091.555] lstrlenW (lpString="adojavas.inc") returned 12
	[0091.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0091.774] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=14610) returned 1
	[0091.774] CloseHandle (hObject=0x1c0) returned 1
	[0091.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20
	[0091.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0091.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0091.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0091.793] lstrlenW (lpString=".doc") returned 4
	[0091.793] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0091.793] lstrlenW (lpString=".docx") returned 5
	[0091.793] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0091.793] lstrlenW (lpString=".pdf") returned 4
	[0091.793] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0091.793] lstrlenW (lpString=".xls") returned 4
	[0091.793] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0091.793] lstrlenW (lpString=".xlsx") returned 5
	[0091.793] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0091.793] lstrlenW (lpString=".ppt") returned 4
	[0091.793] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0091.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0091.793] lstrlenW (lpString=".zip") returned 4
	[0091.793] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0091.793] lstrlenW (lpString=".rar") returned 4
	[0091.793] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0091.793] lstrlenW (lpString=".bz2") returned 4
	[0091.793] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0091.793] lstrlenW (lpString=".7z") returned 3
	[0091.793] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0091.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0091.793] lstrlenW (lpString=".dbf") returned 4
	[0091.793] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0091.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0091.793] lstrlenW (lpString=".1cd") returned 4
	[0091.793] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0091.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0091.794] lstrlenW (lpString=".jpg") returned 4
	[0091.794] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0091.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0091.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0091.794] lstrlenW (lpString=".doc") returned 4
	[0091.794] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0091.794] lstrlenW (lpString=".docx") returned 5
	[0091.794] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0091.794] lstrlenW (lpString=".pdf") returned 4
	[0091.794] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0091.794] lstrlenW (lpString=".xls") returned 4
	[0091.794] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0091.794] lstrlenW (lpString=".xlsx") returned 5
	[0091.794] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0091.794] lstrlenW (lpString=".ppt") returned 4
	[0091.794] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0091.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0091.794] lstrlenW (lpString=".zip") returned 4
	[0091.794] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0091.794] lstrlenW (lpString=".rar") returned 4
	[0091.794] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0091.794] lstrlenW (lpString=".bz2") returned 4
	[0091.794] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0091.794] lstrlenW (lpString=".7z") returned 3
	[0091.794] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0091.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0091.794] lstrlenW (lpString=".dbf") returned 4
	[0091.794] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0091.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0091.795] lstrlenW (lpString=".1cd") returned 4
	[0091.795] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0091.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0091.795] lstrlenW (lpString=".jpg") returned 4
	[0091.795] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0091.795] lstrcmpiW (lpString1=".inc", lpString2=".adobe") returned 1
	[0091.795] lstrlenW (lpString="adcvbs.inc") returned 10
	[0091.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0091.810] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=623) returned 1
	[0091.810] CloseHandle (hObject=0x1c4) returned 1
	[0091.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20
	[0091.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0091.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0091.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0091.858] lstrlenW (lpString=".doc") returned 4
	[0091.858] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0091.858] lstrlenW (lpString=".docx") returned 5
	[0091.858] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0091.858] lstrlenW (lpString=".pdf") returned 4
	[0091.858] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0091.858] lstrlenW (lpString=".xls") returned 4
	[0091.858] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0091.858] lstrlenW (lpString=".xlsx") returned 5
	[0091.858] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0091.858] lstrlenW (lpString=".ppt") returned 4
	[0091.858] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0091.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0091.859] lstrlenW (lpString=".zip") returned 4
	[0091.859] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0091.859] lstrlenW (lpString=".rar") returned 4
	[0091.859] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0091.859] lstrlenW (lpString=".bz2") returned 4
	[0091.859] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0091.859] lstrlenW (lpString=".7z") returned 3
	[0091.859] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0091.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0091.859] lstrlenW (lpString=".dbf") returned 4
	[0091.859] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0091.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0091.859] lstrlenW (lpString=".1cd") returned 4
	[0091.859] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0091.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0091.859] lstrlenW (lpString=".jpg") returned 4
	[0091.859] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0091.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0091.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0091.859] lstrlenW (lpString=".doc") returned 4
	[0091.859] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0091.859] lstrlenW (lpString=".docx") returned 5
	[0091.859] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0091.859] lstrlenW (lpString=".pdf") returned 4
	[0091.860] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0091.860] lstrlenW (lpString=".xls") returned 4
	[0091.860] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0091.860] lstrlenW (lpString=".xlsx") returned 5
	[0091.860] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0091.860] lstrlenW (lpString=".ppt") returned 4
	[0091.860] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0091.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0091.860] lstrlenW (lpString=".zip") returned 4
	[0091.860] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0091.860] lstrlenW (lpString=".rar") returned 4
	[0091.860] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0091.860] lstrlenW (lpString=".bz2") returned 4
	[0091.860] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0091.860] lstrlenW (lpString=".7z") returned 3
	[0091.860] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0091.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0091.860] lstrlenW (lpString=".dbf") returned 4
	[0091.860] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0091.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0091.860] lstrlenW (lpString=".1cd") returned 4
	[0091.860] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0091.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0091.860] lstrlenW (lpString=".jpg") returned 4
	[0091.860] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0091.861] lstrcmpiW (lpString1=".inc", lpString2=".adobe") returned 1
	[0091.861] lstrlenW (lpString="oledbvbs.inc") returned 12
	[0091.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0091.870] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=9975) returned 1
	[0091.870] CloseHandle (hObject=0x1c0) returned 1
	[0091.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20
	[0091.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0091.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0091.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0091.903] lstrlenW (lpString=".doc") returned 4
	[0091.903] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0091.903] lstrlenW (lpString=".docx") returned 5
	[0091.903] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0091.903] lstrlenW (lpString=".pdf") returned 4
	[0091.903] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0091.903] lstrlenW (lpString=".xls") returned 4
	[0091.903] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0091.903] lstrlenW (lpString=".xlsx") returned 5
	[0091.903] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0091.903] lstrlenW (lpString=".ppt") returned 4
	[0091.903] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0091.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0091.903] lstrlenW (lpString=".zip") returned 4
	[0091.903] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0091.903] lstrlenW (lpString=".rar") returned 4
	[0091.903] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0091.903] lstrlenW (lpString=".bz2") returned 4
	[0091.903] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0091.903] lstrlenW (lpString=".7z") returned 3
	[0091.903] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0091.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0091.903] lstrlenW (lpString=".dbf") returned 4
	[0091.904] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0091.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0091.904] lstrlenW (lpString=".1cd") returned 4
	[0091.904] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0091.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0091.904] lstrlenW (lpString=".jpg") returned 4
	[0091.904] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0091.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0091.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0091.904] lstrlenW (lpString=".doc") returned 4
	[0091.904] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0091.904] lstrlenW (lpString=".docx") returned 5
	[0091.904] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0091.904] lstrlenW (lpString=".pdf") returned 4
	[0091.904] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0091.904] lstrlenW (lpString=".xls") returned 4
	[0091.904] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0091.904] lstrlenW (lpString=".xlsx") returned 5
	[0091.904] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0091.904] lstrlenW (lpString=".ppt") returned 4
	[0091.904] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0091.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0091.904] lstrlenW (lpString=".zip") returned 4
	[0091.904] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0091.904] lstrlenW (lpString=".rar") returned 4
	[0091.904] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0091.905] lstrlenW (lpString=".bz2") returned 4
	[0091.905] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0091.905] lstrlenW (lpString=".7z") returned 3
	[0091.905] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0091.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0091.905] lstrlenW (lpString=".dbf") returned 4
	[0091.905] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0091.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0091.905] lstrlenW (lpString=".1cd") returned 4
	[0091.905] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0091.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0091.905] lstrlenW (lpString=".jpg") returned 4
	[0091.905] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0091.905] lstrcmpiW (lpString1=".png", lpString2=".adobe") returned 1
	[0091.905] lstrlenW (lpString="DissolveNoise.png") returned 17
	[0091.905] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0091.918] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=751669) returned 1
	[0091.918] CloseHandle (hObject=0x1b0) returned 1
	[0091.918] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20
	[0091.946] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.964] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0091.965] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51
	[0091.965] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51
	[0091.965] lstrlenW (lpString=".doc") returned 4
	[0091.965] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0091.965] lstrlenW (lpString=".docx") returned 5
	[0091.965] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1
	[0091.965] lstrlenW (lpString=".pdf") returned 4
	[0091.965] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0091.965] lstrlenW (lpString=".xls") returned 4
	[0091.965] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0091.965] lstrlenW (lpString=".xlsx") returned 5
	[0091.965] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1
	[0091.965] lstrlenW (lpString=".ppt") returned 4
	[0091.965] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0091.965] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51
	[0091.965] lstrlenW (lpString=".zip") returned 4
	[0091.965] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0091.965] lstrlenW (lpString=".rar") returned 4
	[0091.965] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0091.965] lstrlenW (lpString=".bz2") returned 4
	[0091.965] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0091.965] lstrlenW (lpString=".7z") returned 3
	[0091.965] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0091.965] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51
	[0091.966] lstrlenW (lpString=".dbf") returned 4
	[0091.966] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0091.966] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51
	[0091.966] lstrlenW (lpString=".1cd") returned 4
	[0091.966] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0091.966] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51
	[0091.966] lstrlenW (lpString=".jpg") returned 4
	[0091.966] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0091.966] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51
	[0091.966] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51
	[0091.966] lstrlenW (lpString=".doc") returned 4
	[0091.966] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0091.966] lstrlenW (lpString=".docx") returned 5
	[0091.966] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1
	[0091.966] lstrlenW (lpString=".pdf") returned 4
	[0091.966] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0091.966] lstrlenW (lpString=".xls") returned 4
	[0091.966] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0091.966] lstrlenW (lpString=".xlsx") returned 5
	[0091.966] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1
	[0091.966] lstrlenW (lpString=".ppt") returned 4
	[0091.966] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0091.966] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51
	[0091.966] lstrlenW (lpString=".zip") returned 4
	[0091.966] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0091.967] lstrlenW (lpString=".rar") returned 4
	[0091.967] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0091.967] lstrlenW (lpString=".bz2") returned 4
	[0091.967] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0091.967] lstrlenW (lpString=".7z") returned 3
	[0091.967] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0091.967] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51
	[0091.967] lstrlenW (lpString=".dbf") returned 4
	[0091.967] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0091.967] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51
	[0091.967] lstrlenW (lpString=".1cd") returned 4
	[0091.967] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0091.967] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51
	[0091.967] lstrlenW (lpString=".jpg") returned 4
	[0091.967] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0091.967] lstrcmpiW (lpString1=".png", lpString2=".adobe") returned 1
	[0091.967] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40
	[0091.967] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0091.996] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3286) returned 1
	[0091.997] CloseHandle (hObject=0x1c0) returned 1
	[0091.997] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20
	[0092.002] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.011] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0092.011] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0092.011] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0092.011] lstrlenW (lpString=".doc") returned 4
	[0092.011] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0092.011] lstrlenW (lpString=".docx") returned 5
	[0092.012] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1
	[0092.012] lstrlenW (lpString=".pdf") returned 4
	[0092.012] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0092.012] lstrlenW (lpString=".xls") returned 4
	[0092.012] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0092.012] lstrlenW (lpString=".xlsx") returned 5
	[0092.012] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1
	[0092.012] lstrlenW (lpString=".ppt") returned 4
	[0092.012] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0092.012] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0092.012] lstrlenW (lpString=".zip") returned 4
	[0092.012] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0092.012] lstrlenW (lpString=".rar") returned 4
	[0092.012] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0092.012] lstrlenW (lpString=".bz2") returned 4
	[0092.012] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0092.012] lstrlenW (lpString=".7z") returned 3
	[0092.012] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0092.012] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0092.012] lstrlenW (lpString=".dbf") returned 4
	[0092.012] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0094.345] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0096.553] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0096.556] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0096.616] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0096.640] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0096.654] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0096.657] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0097.407] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=18738) returned 1
	[0097.407] CloseHandle (hObject=0x190) returned 1
	[0097.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 0x20
	[0097.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0097.453] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.453] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0097.465] GetLastError () returned 0x0
	[0097.465] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x4932, lpOverlapped=0x0) returned 1
	[0097.471] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x4940, lpOverlapped=0x0) returned 1
	[0097.472] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.473] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0097.473] SetEndOfFile (hFile=0x174) returned 1
	[0097.473] CloseHandle (hObject=0x174) returned 1
	[0097.473] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.473] SetEndOfFile (hFile=0x1b0) returned 1
	[0097.474] CloseHandle (hObject=0x1b0) returned 1
	[0097.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1
	[0097.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0097.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0097.475] lstrlenW (lpString=".doc") returned 4
	[0097.475] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0097.475] lstrlenW (lpString=".docx") returned 5
	[0097.475] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0097.475] lstrlenW (lpString=".pdf") returned 4
	[0097.475] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0097.475] lstrlenW (lpString=".xls") returned 4
	[0097.475] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0097.475] lstrlenW (lpString=".xlsx") returned 5
	[0097.475] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0097.475] lstrlenW (lpString=".ppt") returned 4
	[0097.475] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0097.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0097.475] lstrlenW (lpString=".zip") returned 4
	[0097.475] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0097.475] lstrlenW (lpString=".rar") returned 4
	[0097.475] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0097.475] lstrlenW (lpString=".bz2") returned 4
	[0097.475] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0097.475] lstrlenW (lpString=".7z") returned 3
	[0097.475] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0097.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0097.476] lstrlenW (lpString=".dbf") returned 4
	[0097.476] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0097.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0097.476] lstrlenW (lpString=".1cd") returned 4
	[0097.476] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0097.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0097.476] lstrlenW (lpString=".jpg") returned 4
	[0097.476] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0097.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0097.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0097.476] lstrlenW (lpString=".doc") returned 4
	[0097.476] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0097.476] lstrlenW (lpString=".docx") returned 5
	[0097.476] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0097.476] lstrlenW (lpString=".pdf") returned 4
	[0097.476] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0097.476] lstrlenW (lpString=".xls") returned 4
	[0097.476] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0097.476] lstrlenW (lpString=".xlsx") returned 5
	[0097.476] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0097.476] lstrlenW (lpString=".ppt") returned 4
	[0097.476] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0097.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0097.476] lstrlenW (lpString=".zip") returned 4
	[0097.476] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0097.476] lstrlenW (lpString=".rar") returned 4
	[0097.477] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0097.477] lstrlenW (lpString=".bz2") returned 4
	[0097.477] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0097.477] lstrlenW (lpString=".7z") returned 3
	[0097.477] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0097.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0097.477] lstrlenW (lpString=".dbf") returned 4
	[0097.477] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0097.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0097.477] lstrlenW (lpString=".1cd") returned 4
	[0097.477] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0097.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0097.477] lstrlenW (lpString=".jpg") returned 4
	[0097.477] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0097.477] lstrcmpiW (lpString1=".xsl", lpString2=".adobe") returned 1
	[0097.477] lstrlenW (lpString="msjet.xsl") returned 9
	[0097.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0097.478] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=28974) returned 1
	[0097.478] CloseHandle (hObject=0x1b0) returned 1
	[0097.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 0x20
	[0097.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0097.479] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.479] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0097.479] GetLastError () returned 0x0
	[0097.479] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x712e, lpOverlapped=0x0) returned 1
	[0097.492] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x7130, lpOverlapped=0x0) returned 1
	[0097.494] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.494] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0097.494] SetEndOfFile (hFile=0x174) returned 1
	[0097.494] CloseHandle (hObject=0x174) returned 1
	[0097.494] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.494] SetEndOfFile (hFile=0x1b0) returned 1
	[0097.496] CloseHandle (hObject=0x1b0) returned 1
	[0097.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1
	[0097.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0097.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0097.563] lstrlenW (lpString=".doc") returned 4
	[0097.563] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0097.563] lstrlenW (lpString=".docx") returned 5
	[0097.563] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1
	[0097.563] lstrlenW (lpString=".pdf") returned 4
	[0097.563] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0097.563] lstrlenW (lpString=".xls") returned 4
	[0097.563] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0097.563] lstrlenW (lpString=".xlsx") returned 5
	[0097.564] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1
	[0097.564] lstrlenW (lpString=".ppt") returned 4
	[0097.564] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0097.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0097.564] lstrlenW (lpString=".zip") returned 4
	[0097.564] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0097.564] lstrlenW (lpString=".rar") returned 4
	[0097.564] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0097.564] lstrlenW (lpString=".bz2") returned 4
	[0097.564] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0097.564] lstrlenW (lpString=".7z") returned 3
	[0097.564] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0097.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0097.564] lstrlenW (lpString=".dbf") returned 4
	[0097.564] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0097.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0097.564] lstrlenW (lpString=".1cd") returned 4
	[0097.564] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0097.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0097.564] lstrlenW (lpString=".jpg") returned 4
	[0097.564] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0097.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0097.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0097.564] lstrlenW (lpString=".doc") returned 4
	[0097.564] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0097.564] lstrlenW (lpString=".docx") returned 5
	[0097.564] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1
	[0097.565] lstrlenW (lpString=".pdf") returned 4
	[0097.565] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0097.565] lstrlenW (lpString=".xls") returned 4
	[0097.565] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0097.565] lstrlenW (lpString=".xlsx") returned 5
	[0097.565] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1
	[0097.565] lstrlenW (lpString=".ppt") returned 4
	[0097.565] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0097.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0097.565] lstrlenW (lpString=".zip") returned 4
	[0097.565] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0097.565] lstrlenW (lpString=".rar") returned 4
	[0097.565] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0097.565] lstrlenW (lpString=".bz2") returned 4
	[0097.565] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0097.565] lstrlenW (lpString=".7z") returned 3
	[0097.565] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0097.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0097.565] lstrlenW (lpString=".dbf") returned 4
	[0097.565] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0097.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0097.565] lstrlenW (lpString=".1cd") returned 4
	[0097.565] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0097.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0097.565] lstrlenW (lpString=".jpg") returned 4
	[0097.565] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0097.566] lstrcmpiW (lpString1=".xsl", lpString2=".adobe") returned 1
	[0097.566] lstrlenW (lpString="sql70.xsl") returned 9
	[0097.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0097.859] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=32146) returned 1
	[0097.859] CloseHandle (hObject=0x1cc) returned 1
	[0097.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20
	[0097.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0097.980] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.980] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0097.982] GetLastError () returned 0x0
	[0097.982] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x7d92, lpOverlapped=0x0) returned 1
	[0097.996] WriteFile (in: hFile=0x1c8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x7da0, lpOverlapped=0x0) returned 1
	[0097.998] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.998] WriteFile (in: hFile=0x1c8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0097.998] SetEndOfFile (hFile=0x1c8) returned 1
	[0097.998] CloseHandle (hObject=0x1c8) returned 1
	[0097.998] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.998] SetEndOfFile (hFile=0x190) returned 1
	[0097.999] CloseHandle (hObject=0x190) returned 1
	[0097.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1
	[0098.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0098.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0098.000] lstrlenW (lpString=".doc") returned 4
	[0098.000] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0098.000] lstrlenW (lpString=".docx") returned 5
	[0098.000] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0098.000] lstrlenW (lpString=".pdf") returned 4
	[0098.000] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0098.000] lstrlenW (lpString=".xls") returned 4
	[0098.000] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0098.000] lstrlenW (lpString=".xlsx") returned 5
	[0098.000] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0098.000] lstrlenW (lpString=".ppt") returned 4
	[0098.000] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0098.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0098.000] lstrlenW (lpString=".zip") returned 4
	[0098.000] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0098.000] lstrlenW (lpString=".rar") returned 4
	[0098.000] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0098.000] lstrlenW (lpString=".bz2") returned 4
	[0098.000] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0098.000] lstrlenW (lpString=".7z") returned 3
	[0098.000] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0098.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0098.000] lstrlenW (lpString=".dbf") returned 4
	[0098.001] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0098.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0098.001] lstrlenW (lpString=".1cd") returned 4
	[0098.001] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0098.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0098.001] lstrlenW (lpString=".jpg") returned 4
	[0098.001] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0098.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0098.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0098.001] lstrlenW (lpString=".doc") returned 4
	[0098.001] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0098.001] lstrlenW (lpString=".docx") returned 5
	[0098.001] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0098.001] lstrlenW (lpString=".pdf") returned 4
	[0098.001] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0098.001] lstrlenW (lpString=".xls") returned 4
	[0098.001] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0098.001] lstrlenW (lpString=".xlsx") returned 5
	[0098.001] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0098.001] lstrlenW (lpString=".ppt") returned 4
	[0098.001] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0098.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0098.001] lstrlenW (lpString=".zip") returned 4
	[0098.001] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0098.001] lstrlenW (lpString=".rar") returned 4
	[0098.001] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0098.001] lstrlenW (lpString=".bz2") returned 4
	[0098.001] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0098.001] lstrlenW (lpString=".7z") returned 3
	[0098.001] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0098.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0098.001] lstrlenW (lpString=".dbf") returned 4
	[0098.002] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0098.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0098.002] lstrlenW (lpString=".1cd") returned 4
	[0098.002] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0098.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0098.002] lstrlenW (lpString=".jpg") returned 4
	[0098.002] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0098.002] lstrcmpiW (lpString1=".xsl", lpString2=".adobe") returned 1
	[0098.002] lstrlenW (lpString="Sybase.xsl") returned 10
	[0098.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0098.020] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=29790) returned 1
	[0098.020] CloseHandle (hObject=0x1cc) returned 1
	[0098.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20
	[0098.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0098.020] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.020] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.021] GetLastError () returned 0x0
	[0098.021] ReadFile (in: hFile=0x1cc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x745e, lpOverlapped=0x0) returned 1
	[0098.033] WriteFile (in: hFile=0x190, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x7460, lpOverlapped=0x0) returned 1
	[0098.035] ReadFile (in: hFile=0x1cc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.036] WriteFile (in: hFile=0x190, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0098.036] SetEndOfFile (hFile=0x190) returned 1
	[0098.036] CloseHandle (hObject=0x190) returned 1
	[0098.036] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.036] SetEndOfFile (hFile=0x1cc) returned 1
	[0098.037] CloseHandle (hObject=0x1cc) returned 1
	[0098.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1
	[0098.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0098.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0098.038] lstrlenW (lpString=".doc") returned 4
	[0098.038] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0098.038] lstrlenW (lpString=".docx") returned 5
	[0098.038] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1
	[0098.038] lstrlenW (lpString=".pdf") returned 4
	[0098.038] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0098.038] lstrlenW (lpString=".xls") returned 4
	[0098.038] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0098.038] lstrlenW (lpString=".xlsx") returned 5
	[0098.038] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1
	[0098.038] lstrlenW (lpString=".ppt") returned 4
	[0098.038] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0098.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0098.038] lstrlenW (lpString=".zip") returned 4
	[0098.038] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0098.038] lstrlenW (lpString=".rar") returned 4
	[0098.038] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0098.038] lstrlenW (lpString=".bz2") returned 4
	[0098.038] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0098.039] lstrlenW (lpString=".7z") returned 3
	[0098.039] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0098.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0098.039] lstrlenW (lpString=".dbf") returned 4
	[0098.039] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0098.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0098.039] lstrlenW (lpString=".1cd") returned 4
	[0098.039] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0098.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0098.039] lstrlenW (lpString=".jpg") returned 4
	[0098.039] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0098.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0098.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0098.039] lstrlenW (lpString=".doc") returned 4
	[0098.039] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0098.039] lstrlenW (lpString=".docx") returned 5
	[0098.039] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1
	[0098.039] lstrlenW (lpString=".pdf") returned 4
	[0098.039] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0098.039] lstrlenW (lpString=".xls") returned 4
	[0098.039] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0098.039] lstrlenW (lpString=".xlsx") returned 5
	[0098.039] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1
	[0098.039] lstrlenW (lpString=".ppt") returned 4
	[0098.039] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0098.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0098.040] lstrlenW (lpString=".zip") returned 4
	[0098.040] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0098.040] lstrlenW (lpString=".rar") returned 4
	[0098.040] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0098.040] lstrlenW (lpString=".bz2") returned 4
	[0098.040] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0098.040] lstrlenW (lpString=".7z") returned 3
	[0098.040] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0098.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0098.040] lstrlenW (lpString=".dbf") returned 4
	[0098.040] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0098.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0098.040] lstrlenW (lpString=".1cd") returned 4
	[0098.040] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0098.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0098.040] lstrlenW (lpString=".jpg") returned 4
	[0098.040] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0098.040] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.040] lstrlenW (lpString="AG00021_.GIF") returned 12
	[0098.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.155] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=14873) returned 1
	[0098.155] CloseHandle (hObject=0x1a8) returned 1
	[0098.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20
	[0098.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.185] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.185] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0098.191] GetLastError () returned 0x0
	[0098.191] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x3a19, lpOverlapped=0x0) returned 1
	[0098.195] WriteFile (in: hFile=0x178, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x3a20, lpOverlapped=0x0) returned 1
	[0098.196] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.196] WriteFile (in: hFile=0x178, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.196] SetEndOfFile (hFile=0x178) returned 1
	[0098.196] CloseHandle (hObject=0x178) returned 1
	[0098.196] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.196] SetEndOfFile (hFile=0x1a8) returned 1
	[0098.197] CloseHandle (hObject=0x1a8) returned 1
	[0098.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.197] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1
	[0098.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0098.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0098.198] lstrlenW (lpString=".doc") returned 4
	[0098.198] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.198] lstrlenW (lpString=".docx") returned 5
	[0098.198] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.198] lstrlenW (lpString=".pdf") returned 4
	[0098.198] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.198] lstrlenW (lpString=".xls") returned 4
	[0098.198] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.198] lstrlenW (lpString=".xlsx") returned 5
	[0098.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.198] lstrlenW (lpString=".ppt") returned 4
	[0098.198] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0098.198] lstrlenW (lpString=".zip") returned 4
	[0098.198] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.198] lstrlenW (lpString=".rar") returned 4
	[0098.198] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.198] lstrlenW (lpString=".bz2") returned 4
	[0098.198] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.198] lstrlenW (lpString=".7z") returned 3
	[0098.198] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0098.198] lstrlenW (lpString=".dbf") returned 4
	[0098.198] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0098.198] lstrlenW (lpString=".1cd") returned 4
	[0098.198] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0098.198] lstrlenW (lpString=".jpg") returned 4
	[0098.199] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0098.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0098.199] lstrlenW (lpString=".doc") returned 4
	[0098.199] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.199] lstrlenW (lpString=".docx") returned 5
	[0098.199] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.199] lstrlenW (lpString=".pdf") returned 4
	[0098.199] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.199] lstrlenW (lpString=".xls") returned 4
	[0098.199] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.199] lstrlenW (lpString=".xlsx") returned 5
	[0098.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.199] lstrlenW (lpString=".ppt") returned 4
	[0098.199] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0098.199] lstrlenW (lpString=".zip") returned 4
	[0098.199] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.199] lstrlenW (lpString=".rar") returned 4
	[0098.199] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.199] lstrlenW (lpString=".bz2") returned 4
	[0098.199] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.199] lstrlenW (lpString=".7z") returned 3
	[0098.199] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0098.199] lstrlenW (lpString=".dbf") returned 4
	[0098.199] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0098.200] lstrlenW (lpString=".1cd") returned 4
	[0098.200] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0098.200] lstrlenW (lpString=".jpg") returned 4
	[0098.200] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.200] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.200] lstrlenW (lpString="AG00038_.GIF") returned 12
	[0098.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0098.216] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3251) returned 1
	[0098.216] CloseHandle (hObject=0x174) returned 1
	[0098.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20
	[0098.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.325] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.325] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.353] GetLastError () returned 0x0
	[0098.353] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xcb3, lpOverlapped=0x0) returned 1
	[0098.357] WriteFile (in: hFile=0x190, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xcc0, lpOverlapped=0x0) returned 1
	[0098.358] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.358] WriteFile (in: hFile=0x190, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.358] SetEndOfFile (hFile=0x190) returned 1
	[0098.358] CloseHandle (hObject=0x190) returned 1
	[0098.358] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.359] SetEndOfFile (hFile=0x160) returned 1
	[0098.359] CloseHandle (hObject=0x160) returned 1
	[0098.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1
	[0098.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0098.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0098.361] lstrlenW (lpString=".doc") returned 4
	[0098.361] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.361] lstrlenW (lpString=".docx") returned 5
	[0098.361] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.361] lstrlenW (lpString=".pdf") returned 4
	[0098.361] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.361] lstrlenW (lpString=".xls") returned 4
	[0098.361] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.361] lstrlenW (lpString=".xlsx") returned 5
	[0098.361] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.361] lstrlenW (lpString=".ppt") returned 4
	[0098.361] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0098.361] lstrlenW (lpString=".zip") returned 4
	[0098.361] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.361] lstrlenW (lpString=".rar") returned 4
	[0098.361] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.361] lstrlenW (lpString=".bz2") returned 4
	[0098.361] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.361] lstrlenW (lpString=".7z") returned 3
	[0098.361] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0098.361] lstrlenW (lpString=".dbf") returned 4
	[0098.361] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0098.362] lstrlenW (lpString=".1cd") returned 4
	[0098.362] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0098.362] lstrlenW (lpString=".jpg") returned 4
	[0098.362] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0098.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0098.362] lstrlenW (lpString=".doc") returned 4
	[0098.362] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.362] lstrlenW (lpString=".docx") returned 5
	[0098.362] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.362] lstrlenW (lpString=".pdf") returned 4
	[0098.362] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.362] lstrlenW (lpString=".xls") returned 4
	[0098.362] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.362] lstrlenW (lpString=".xlsx") returned 5
	[0098.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.362] lstrlenW (lpString=".ppt") returned 4
	[0098.362] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0098.362] lstrlenW (lpString=".zip") returned 4
	[0098.362] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.362] lstrlenW (lpString=".rar") returned 4
	[0098.362] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.362] lstrlenW (lpString=".bz2") returned 4
	[0098.362] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.363] lstrlenW (lpString=".7z") returned 3
	[0098.363] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0098.363] lstrlenW (lpString=".dbf") returned 4
	[0098.363] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0098.363] lstrlenW (lpString=".1cd") returned 4
	[0098.363] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0098.363] lstrlenW (lpString=".jpg") returned 4
	[0098.363] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.363] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.363] lstrlenW (lpString="AG00052_.GIF") returned 12
	[0098.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.364] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=7686) returned 1
	[0098.364] CloseHandle (hObject=0x160) returned 1
	[0098.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20
	[0098.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.364] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.364] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.365] GetLastError () returned 0x0
	[0098.365] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1e06, lpOverlapped=0x0) returned 1
	[0098.389] WriteFile (in: hFile=0x190, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1e10, lpOverlapped=0x0) returned 1
	[0098.391] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.391] WriteFile (in: hFile=0x190, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.391] SetEndOfFile (hFile=0x190) returned 1
	[0098.391] CloseHandle (hObject=0x190) returned 1
	[0098.391] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.391] SetEndOfFile (hFile=0x160) returned 1
	[0098.392] CloseHandle (hObject=0x160) returned 1
	[0098.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1
	[0098.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0098.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0098.393] lstrlenW (lpString=".doc") returned 4
	[0098.393] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.393] lstrlenW (lpString=".docx") returned 5
	[0098.393] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.393] lstrlenW (lpString=".pdf") returned 4
	[0098.393] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.393] lstrlenW (lpString=".xls") returned 4
	[0098.393] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.393] lstrlenW (lpString=".xlsx") returned 5
	[0098.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.393] lstrlenW (lpString=".ppt") returned 4
	[0098.393] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0098.393] lstrlenW (lpString=".zip") returned 4
	[0098.393] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.393] lstrlenW (lpString=".rar") returned 4
	[0098.393] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.393] lstrlenW (lpString=".bz2") returned 4
	[0098.393] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.393] lstrlenW (lpString=".7z") returned 3
	[0098.394] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0098.394] lstrlenW (lpString=".dbf") returned 4
	[0098.394] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0098.394] lstrlenW (lpString=".1cd") returned 4
	[0098.394] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0098.394] lstrlenW (lpString=".jpg") returned 4
	[0098.394] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0098.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0098.394] lstrlenW (lpString=".doc") returned 4
	[0098.394] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.394] lstrlenW (lpString=".docx") returned 5
	[0098.394] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.394] lstrlenW (lpString=".pdf") returned 4
	[0098.394] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.394] lstrlenW (lpString=".xls") returned 4
	[0098.394] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.394] lstrlenW (lpString=".xlsx") returned 5
	[0098.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.394] lstrlenW (lpString=".ppt") returned 4
	[0098.394] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0098.394] lstrlenW (lpString=".zip") returned 4
	[0098.395] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.395] lstrlenW (lpString=".rar") returned 4
	[0098.395] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.395] lstrlenW (lpString=".bz2") returned 4
	[0098.395] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.395] lstrlenW (lpString=".7z") returned 3
	[0098.395] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0098.395] lstrlenW (lpString=".dbf") returned 4
	[0098.395] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0098.395] lstrlenW (lpString=".1cd") returned 4
	[0098.395] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0098.395] lstrlenW (lpString=".jpg") returned 4
	[0098.395] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.395] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.395] lstrlenW (lpString="AG00090_.GIF") returned 12
	[0098.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.396] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=517) returned 1
	[0098.396] CloseHandle (hObject=0x160) returned 1
	[0098.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20
	[0098.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.397] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.397] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.397] GetLastError () returned 0x0
	[0098.397] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x205, lpOverlapped=0x0) returned 1
	[0098.399] WriteFile (in: hFile=0x190, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x210, lpOverlapped=0x0) returned 1
	[0098.400] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.400] WriteFile (in: hFile=0x190, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.400] SetEndOfFile (hFile=0x190) returned 1
	[0098.400] CloseHandle (hObject=0x190) returned 1
	[0098.401] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.401] SetEndOfFile (hFile=0x160) returned 1
	[0098.401] CloseHandle (hObject=0x160) returned 1
	[0098.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1
	[0098.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0098.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0098.402] lstrlenW (lpString=".doc") returned 4
	[0098.402] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.402] lstrlenW (lpString=".docx") returned 5
	[0098.402] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.402] lstrlenW (lpString=".pdf") returned 4
	[0098.402] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.402] lstrlenW (lpString=".xls") returned 4
	[0098.402] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.402] lstrlenW (lpString=".xlsx") returned 5
	[0098.402] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.402] lstrlenW (lpString=".ppt") returned 4
	[0098.403] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0098.403] lstrlenW (lpString=".zip") returned 4
	[0098.403] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.403] lstrlenW (lpString=".rar") returned 4
	[0098.403] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.403] lstrlenW (lpString=".bz2") returned 4
	[0098.403] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.403] lstrlenW (lpString=".7z") returned 3
	[0098.403] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0098.403] lstrlenW (lpString=".dbf") returned 4
	[0098.403] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0098.403] lstrlenW (lpString=".1cd") returned 4
	[0098.403] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0098.403] lstrlenW (lpString=".jpg") returned 4
	[0098.403] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0098.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0098.403] lstrlenW (lpString=".doc") returned 4
	[0098.403] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.403] lstrlenW (lpString=".docx") returned 5
	[0098.403] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.403] lstrlenW (lpString=".pdf") returned 4
	[0098.404] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.404] lstrlenW (lpString=".xls") returned 4
	[0098.404] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.404] lstrlenW (lpString=".xlsx") returned 5
	[0098.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.404] lstrlenW (lpString=".ppt") returned 4
	[0098.404] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0098.404] lstrlenW (lpString=".zip") returned 4
	[0098.404] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.404] lstrlenW (lpString=".rar") returned 4
	[0098.404] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.404] lstrlenW (lpString=".bz2") returned 4
	[0098.404] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.404] lstrlenW (lpString=".7z") returned 3
	[0098.404] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0098.404] lstrlenW (lpString=".dbf") returned 4
	[0098.404] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0098.404] lstrlenW (lpString=".1cd") returned 4
	[0098.404] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0098.404] lstrlenW (lpString=".jpg") returned 4
	[0098.404] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.405] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.405] lstrlenW (lpString="AG00092_.GIF") returned 12
	[0098.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.405] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=502) returned 1
	[0098.405] CloseHandle (hObject=0x160) returned 1
	[0098.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20
	[0098.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.406] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.406] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.407] GetLastError () returned 0x0
	[0098.407] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1f6, lpOverlapped=0x0) returned 1
	[0098.408] WriteFile (in: hFile=0x190, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x200, lpOverlapped=0x0) returned 1
	[0098.409] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.409] WriteFile (in: hFile=0x190, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.409] SetEndOfFile (hFile=0x190) returned 1
	[0098.409] CloseHandle (hObject=0x190) returned 1
	[0098.409] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.410] SetEndOfFile (hFile=0x160) returned 1
	[0098.410] CloseHandle (hObject=0x160) returned 1
	[0098.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1
	[0098.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0098.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0098.411] lstrlenW (lpString=".doc") returned 4
	[0098.411] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.411] lstrlenW (lpString=".docx") returned 5
	[0098.411] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.411] lstrlenW (lpString=".pdf") returned 4
	[0098.411] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.411] lstrlenW (lpString=".xls") returned 4
	[0098.411] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.411] lstrlenW (lpString=".xlsx") returned 5
	[0098.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.411] lstrlenW (lpString=".ppt") returned 4
	[0098.411] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0098.412] lstrlenW (lpString=".zip") returned 4
	[0098.412] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.412] lstrlenW (lpString=".rar") returned 4
	[0098.412] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.412] lstrlenW (lpString=".bz2") returned 4
	[0098.412] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.412] lstrlenW (lpString=".7z") returned 3
	[0098.412] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0098.412] lstrlenW (lpString=".dbf") returned 4
	[0098.412] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0098.412] lstrlenW (lpString=".1cd") returned 4
	[0098.412] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0098.412] lstrlenW (lpString=".jpg") returned 4
	[0098.412] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0098.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0098.412] lstrlenW (lpString=".doc") returned 4
	[0098.412] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.412] lstrlenW (lpString=".docx") returned 5
	[0098.412] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.412] lstrlenW (lpString=".pdf") returned 4
	[0098.412] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.413] lstrlenW (lpString=".xls") returned 4
	[0098.413] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.413] lstrlenW (lpString=".xlsx") returned 5
	[0098.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.413] lstrlenW (lpString=".ppt") returned 4
	[0098.413] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0098.413] lstrlenW (lpString=".zip") returned 4
	[0098.413] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.413] lstrlenW (lpString=".rar") returned 4
	[0098.413] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.413] lstrlenW (lpString=".bz2") returned 4
	[0098.413] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.413] lstrlenW (lpString=".7z") returned 3
	[0098.413] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0098.413] lstrlenW (lpString=".dbf") returned 4
	[0098.413] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0098.413] lstrlenW (lpString=".1cd") returned 4
	[0098.413] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0098.413] lstrlenW (lpString=".jpg") returned 4
	[0098.413] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.414] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.414] lstrlenW (lpString="AG00103_.GIF") returned 12
	[0098.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0098.437] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=12702) returned 1
	[0098.437] CloseHandle (hObject=0x1c0) returned 1
	[0098.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20
	[0098.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.454] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.454] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0098.469] GetLastError () returned 0x0
	[0098.469] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x319e, lpOverlapped=0x0) returned 1
	[0098.474] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x31a0, lpOverlapped=0x0) returned 1
	[0098.476] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.476] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.476] SetEndOfFile (hFile=0x174) returned 1
	[0098.476] CloseHandle (hObject=0x174) returned 1
	[0098.476] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.476] SetEndOfFile (hFile=0x160) returned 1
	[0098.478] CloseHandle (hObject=0x160) returned 1
	[0098.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1
	[0098.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0098.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0098.478] lstrlenW (lpString=".doc") returned 4
	[0098.479] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.479] lstrlenW (lpString=".docx") returned 5
	[0098.479] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.479] lstrlenW (lpString=".pdf") returned 4
	[0098.479] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.479] lstrlenW (lpString=".xls") returned 4
	[0098.479] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.479] lstrlenW (lpString=".xlsx") returned 5
	[0098.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.479] lstrlenW (lpString=".ppt") returned 4
	[0098.479] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0098.479] lstrlenW (lpString=".zip") returned 4
	[0098.479] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.479] lstrlenW (lpString=".rar") returned 4
	[0098.479] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.479] lstrlenW (lpString=".bz2") returned 4
	[0098.479] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.479] lstrlenW (lpString=".7z") returned 3
	[0098.479] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0098.479] lstrlenW (lpString=".dbf") returned 4
	[0098.479] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0098.480] lstrlenW (lpString=".1cd") returned 4
	[0098.480] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0098.480] lstrlenW (lpString=".jpg") returned 4
	[0098.480] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0098.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0098.480] lstrlenW (lpString=".doc") returned 4
	[0098.480] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.480] lstrlenW (lpString=".docx") returned 5
	[0098.480] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.480] lstrlenW (lpString=".pdf") returned 4
	[0098.480] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.480] lstrlenW (lpString=".xls") returned 4
	[0098.480] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.480] lstrlenW (lpString=".xlsx") returned 5
	[0098.480] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.480] lstrlenW (lpString=".ppt") returned 4
	[0098.480] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0098.480] lstrlenW (lpString=".zip") returned 4
	[0098.480] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.480] lstrlenW (lpString=".rar") returned 4
	[0098.480] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.480] lstrlenW (lpString=".bz2") returned 4
	[0098.481] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.481] lstrlenW (lpString=".7z") returned 3
	[0098.481] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0098.481] lstrlenW (lpString=".dbf") returned 4
	[0098.481] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0098.481] lstrlenW (lpString=".1cd") returned 4
	[0098.481] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0098.481] lstrlenW (lpString=".jpg") returned 4
	[0098.481] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.481] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.481] lstrlenW (lpString="AG00126_.GIF") returned 12
	[0098.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.482] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3140) returned 1
	[0098.482] CloseHandle (hObject=0x160) returned 1
	[0098.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20
	[0098.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.483] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.483] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0098.484] GetLastError () returned 0x0
	[0098.484] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xc44, lpOverlapped=0x0) returned 1
	[0098.496] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xc50, lpOverlapped=0x0) returned 1
	[0098.501] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.501] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.501] SetEndOfFile (hFile=0x174) returned 1
	[0098.501] CloseHandle (hObject=0x174) returned 1
	[0098.501] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.501] SetEndOfFile (hFile=0x160) returned 1
	[0098.502] CloseHandle (hObject=0x160) returned 1
	[0098.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1
	[0098.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0098.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0098.503] lstrlenW (lpString=".doc") returned 4
	[0098.503] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.503] lstrlenW (lpString=".docx") returned 5
	[0098.503] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.503] lstrlenW (lpString=".pdf") returned 4
	[0098.503] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.503] lstrlenW (lpString=".xls") returned 4
	[0098.503] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.503] lstrlenW (lpString=".xlsx") returned 5
	[0098.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.503] lstrlenW (lpString=".ppt") returned 4
	[0098.503] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0098.503] lstrlenW (lpString=".zip") returned 4
	[0098.503] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.503] lstrlenW (lpString=".rar") returned 4
	[0098.503] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.503] lstrlenW (lpString=".bz2") returned 4
	[0098.503] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.503] lstrlenW (lpString=".7z") returned 3
	[0098.503] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0098.503] lstrlenW (lpString=".dbf") returned 4
	[0098.504] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0098.504] lstrlenW (lpString=".1cd") returned 4
	[0098.504] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0098.504] lstrlenW (lpString=".jpg") returned 4
	[0098.504] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0098.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0098.504] lstrlenW (lpString=".doc") returned 4
	[0098.504] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.504] lstrlenW (lpString=".docx") returned 5
	[0098.504] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.504] lstrlenW (lpString=".pdf") returned 4
	[0098.504] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.504] lstrlenW (lpString=".xls") returned 4
	[0098.504] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.504] lstrlenW (lpString=".xlsx") returned 5
	[0098.504] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.504] lstrlenW (lpString=".ppt") returned 4
	[0098.504] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0098.504] lstrlenW (lpString=".zip") returned 4
	[0098.504] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.504] lstrlenW (lpString=".rar") returned 4
	[0098.505] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.505] lstrlenW (lpString=".bz2") returned 4
	[0098.505] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.505] lstrlenW (lpString=".7z") returned 3
	[0098.505] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0098.505] lstrlenW (lpString=".dbf") returned 4
	[0098.505] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0098.505] lstrlenW (lpString=".1cd") returned 4
	[0098.505] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0098.505] lstrlenW (lpString=".jpg") returned 4
	[0098.505] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.505] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.505] lstrlenW (lpString="AG00130_.GIF") returned 12
	[0098.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.506] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=5253) returned 1
	[0098.506] CloseHandle (hObject=0x160) returned 1
	[0098.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20
	[0098.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.507] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.507] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0098.508] GetLastError () returned 0x0
	[0098.508] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1485, lpOverlapped=0x0) returned 1
	[0098.551] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1490, lpOverlapped=0x0) returned 1
	[0098.552] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.552] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.552] SetEndOfFile (hFile=0x174) returned 1
	[0098.553] CloseHandle (hObject=0x174) returned 1
	[0098.553] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.553] SetEndOfFile (hFile=0x160) returned 1
	[0098.554] CloseHandle (hObject=0x160) returned 1
	[0098.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1
	[0098.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63
	[0098.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63
	[0098.600] lstrlenW (lpString=".doc") returned 4
	[0098.600] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.600] lstrlenW (lpString=".docx") returned 5
	[0098.600] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.600] lstrlenW (lpString=".pdf") returned 4
	[0098.600] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.600] lstrlenW (lpString=".xls") returned 4
	[0098.600] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.600] lstrlenW (lpString=".xlsx") returned 5
	[0098.600] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.600] lstrlenW (lpString=".ppt") returned 4
	[0098.600] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63
	[0098.600] lstrlenW (lpString=".zip") returned 4
	[0098.600] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.600] lstrlenW (lpString=".rar") returned 4
	[0098.600] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.600] lstrlenW (lpString=".bz2") returned 4
	[0098.600] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.600] lstrlenW (lpString=".7z") returned 3
	[0098.600] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63
	[0098.600] lstrlenW (lpString=".dbf") returned 4
	[0098.600] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63
	[0098.601] lstrlenW (lpString=".1cd") returned 4
	[0098.601] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63
	[0098.601] lstrlenW (lpString=".jpg") returned 4
	[0098.601] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63
	[0098.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63
	[0098.601] lstrlenW (lpString=".doc") returned 4
	[0098.601] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.601] lstrlenW (lpString=".docx") returned 5
	[0098.601] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.601] lstrlenW (lpString=".pdf") returned 4
	[0098.601] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.601] lstrlenW (lpString=".xls") returned 4
	[0098.601] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.601] lstrlenW (lpString=".xlsx") returned 5
	[0098.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.601] lstrlenW (lpString=".ppt") returned 4
	[0098.601] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63
	[0098.601] lstrlenW (lpString=".zip") returned 4
	[0098.601] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.601] lstrlenW (lpString=".rar") returned 4
	[0098.601] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.601] lstrlenW (lpString=".bz2") returned 4
	[0098.601] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.602] lstrlenW (lpString=".7z") returned 3
	[0098.602] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63
	[0098.602] lstrlenW (lpString=".dbf") returned 4
	[0098.602] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63
	[0098.602] lstrlenW (lpString=".1cd") returned 4
	[0098.602] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63
	[0098.602] lstrlenW (lpString=".jpg") returned 4
	[0098.602] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.602] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.602] lstrlenW (lpString="AG00139_.GIF") returned 12
	[0098.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.614] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=10607) returned 1
	[0098.614] CloseHandle (hObject=0x190) returned 1
	[0098.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20
	[0098.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.720] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.720] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.724] GetLastError () returned 0x0
	[0098.724] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x296f, lpOverlapped=0x0) returned 1
	[0098.736] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2970, lpOverlapped=0x0) returned 1
	[0098.738] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.738] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.738] SetEndOfFile (hFile=0x1a8) returned 1
	[0098.738] CloseHandle (hObject=0x1a8) returned 1
	[0098.738] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.738] SetEndOfFile (hFile=0x190) returned 1
	[0098.739] CloseHandle (hObject=0x190) returned 1
	[0098.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1
	[0098.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0098.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0098.740] lstrlenW (lpString=".doc") returned 4
	[0098.740] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.740] lstrlenW (lpString=".docx") returned 5
	[0098.740] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.740] lstrlenW (lpString=".pdf") returned 4
	[0098.740] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.740] lstrlenW (lpString=".xls") returned 4
	[0098.740] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.740] lstrlenW (lpString=".xlsx") returned 5
	[0098.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.740] lstrlenW (lpString=".ppt") returned 4
	[0098.740] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0098.740] lstrlenW (lpString=".zip") returned 4
	[0098.740] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.740] lstrlenW (lpString=".rar") returned 4
	[0098.741] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.741] lstrlenW (lpString=".bz2") returned 4
	[0098.741] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.741] lstrlenW (lpString=".7z") returned 3
	[0098.741] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0098.741] lstrlenW (lpString=".dbf") returned 4
	[0098.741] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0098.741] lstrlenW (lpString=".1cd") returned 4
	[0098.741] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0098.741] lstrlenW (lpString=".jpg") returned 4
	[0098.741] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0098.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0098.741] lstrlenW (lpString=".doc") returned 4
	[0098.741] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.741] lstrlenW (lpString=".docx") returned 5
	[0098.741] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.741] lstrlenW (lpString=".pdf") returned 4
	[0098.741] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.741] lstrlenW (lpString=".xls") returned 4
	[0098.741] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.741] lstrlenW (lpString=".xlsx") returned 5
	[0098.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.742] lstrlenW (lpString=".ppt") returned 4
	[0098.742] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0098.742] lstrlenW (lpString=".zip") returned 4
	[0098.742] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.742] lstrlenW (lpString=".rar") returned 4
	[0098.742] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.742] lstrlenW (lpString=".bz2") returned 4
	[0098.742] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.742] lstrlenW (lpString=".7z") returned 3
	[0098.742] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0098.742] lstrlenW (lpString=".dbf") returned 4
	[0098.742] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0098.742] lstrlenW (lpString=".1cd") returned 4
	[0098.742] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0098.742] lstrlenW (lpString=".jpg") returned 4
	[0098.742] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.742] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.743] lstrlenW (lpString="AG00154_.GIF") returned 12
	[0098.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.743] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=5315) returned 1
	[0098.743] CloseHandle (hObject=0x190) returned 1
	[0098.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20
	[0098.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.744] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.744] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.744] GetLastError () returned 0x0
	[0098.744] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x14c3, lpOverlapped=0x0) returned 1
	[0098.758] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x14d0, lpOverlapped=0x0) returned 1
	[0098.759] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.760] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.760] SetEndOfFile (hFile=0x1a8) returned 1
	[0098.760] CloseHandle (hObject=0x1a8) returned 1
	[0098.760] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.760] SetEndOfFile (hFile=0x190) returned 1
	[0098.761] CloseHandle (hObject=0x190) returned 1
	[0098.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1
	[0098.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0098.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0098.761] lstrlenW (lpString=".doc") returned 4
	[0098.761] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.761] lstrlenW (lpString=".docx") returned 5
	[0098.761] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.761] lstrlenW (lpString=".pdf") returned 4
	[0098.761] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.761] lstrlenW (lpString=".xls") returned 4
	[0098.761] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.761] lstrlenW (lpString=".xlsx") returned 5
	[0098.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.762] lstrlenW (lpString=".ppt") returned 4
	[0098.762] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0098.762] lstrlenW (lpString=".zip") returned 4
	[0098.762] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.762] lstrlenW (lpString=".rar") returned 4
	[0098.762] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.762] lstrlenW (lpString=".bz2") returned 4
	[0098.762] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.762] lstrlenW (lpString=".7z") returned 3
	[0098.762] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0098.762] lstrlenW (lpString=".dbf") returned 4
	[0098.762] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0098.762] lstrlenW (lpString=".1cd") returned 4
	[0098.762] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0098.762] lstrlenW (lpString=".jpg") returned 4
	[0098.762] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0098.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0098.762] lstrlenW (lpString=".doc") returned 4
	[0098.762] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.762] lstrlenW (lpString=".docx") returned 5
	[0098.762] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.762] lstrlenW (lpString=".pdf") returned 4
	[0098.762] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.762] lstrlenW (lpString=".xls") returned 4
	[0098.762] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.762] lstrlenW (lpString=".xlsx") returned 5
	[0098.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.763] lstrlenW (lpString=".ppt") returned 4
	[0098.763] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0098.763] lstrlenW (lpString=".zip") returned 4
	[0098.763] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.763] lstrlenW (lpString=".rar") returned 4
	[0098.763] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.763] lstrlenW (lpString=".bz2") returned 4
	[0098.763] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.763] lstrlenW (lpString=".7z") returned 3
	[0098.763] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0098.763] lstrlenW (lpString=".dbf") returned 4
	[0098.763] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0098.763] lstrlenW (lpString=".1cd") returned 4
	[0098.763] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0098.763] lstrlenW (lpString=".jpg") returned 4
	[0098.763] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.763] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.763] lstrlenW (lpString="AG00158_.GIF") returned 12
	[0098.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.764] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=5030) returned 1
	[0098.764] CloseHandle (hObject=0x190) returned 1
	[0098.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20
	[0098.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.764] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.764] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.765] GetLastError () returned 0x0
	[0098.765] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x13a6, lpOverlapped=0x0) returned 1
	[0098.791] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x13b0, lpOverlapped=0x0) returned 1
	[0098.793] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.793] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.793] SetEndOfFile (hFile=0x1a8) returned 1
	[0098.793] CloseHandle (hObject=0x1a8) returned 1
	[0098.793] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.793] SetEndOfFile (hFile=0x190) returned 1
	[0098.794] CloseHandle (hObject=0x190) returned 1
	[0098.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1
	[0098.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0098.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0098.794] lstrlenW (lpString=".doc") returned 4
	[0098.794] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.794] lstrlenW (lpString=".docx") returned 5
	[0098.794] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.794] lstrlenW (lpString=".pdf") returned 4
	[0098.794] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.794] lstrlenW (lpString=".xls") returned 4
	[0098.794] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.795] lstrlenW (lpString=".xlsx") returned 5
	[0098.795] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.795] lstrlenW (lpString=".ppt") returned 4
	[0098.795] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0098.795] lstrlenW (lpString=".zip") returned 4
	[0098.795] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.795] lstrlenW (lpString=".rar") returned 4
	[0098.795] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.795] lstrlenW (lpString=".bz2") returned 4
	[0098.795] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.795] lstrlenW (lpString=".7z") returned 3
	[0098.795] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0098.795] lstrlenW (lpString=".dbf") returned 4
	[0098.795] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0098.795] lstrlenW (lpString=".1cd") returned 4
	[0098.795] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0098.795] lstrlenW (lpString=".jpg") returned 4
	[0098.795] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0098.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0098.795] lstrlenW (lpString=".doc") returned 4
	[0098.795] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.795] lstrlenW (lpString=".docx") returned 5
	[0098.795] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.795] lstrlenW (lpString=".pdf") returned 4
	[0098.795] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.796] lstrlenW (lpString=".xls") returned 4
	[0098.796] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.796] lstrlenW (lpString=".xlsx") returned 5
	[0098.796] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.796] lstrlenW (lpString=".ppt") returned 4
	[0098.796] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0098.796] lstrlenW (lpString=".zip") returned 4
	[0098.796] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.796] lstrlenW (lpString=".rar") returned 4
	[0098.796] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.796] lstrlenW (lpString=".bz2") returned 4
	[0098.796] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.796] lstrlenW (lpString=".7z") returned 3
	[0098.796] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0098.796] lstrlenW (lpString=".dbf") returned 4
	[0098.796] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0098.796] lstrlenW (lpString=".1cd") returned 4
	[0098.796] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0098.796] lstrlenW (lpString=".jpg") returned 4
	[0098.796] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.797] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.797] lstrlenW (lpString="AG00161_.GIF") returned 12
	[0098.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.797] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=7583) returned 1
	[0098.797] CloseHandle (hObject=0x190) returned 1
	[0098.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20
	[0098.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.798] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.798] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.798] GetLastError () returned 0x0
	[0098.798] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1d9f, lpOverlapped=0x0) returned 1
	[0098.812] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1da0, lpOverlapped=0x0) returned 1
	[0098.814] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.814] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.814] SetEndOfFile (hFile=0x1a8) returned 1
	[0098.814] CloseHandle (hObject=0x1a8) returned 1
	[0098.814] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.814] SetEndOfFile (hFile=0x190) returned 1
	[0098.815] CloseHandle (hObject=0x190) returned 1
	[0098.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1
	[0098.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0098.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0098.816] lstrlenW (lpString=".doc") returned 4
	[0098.816] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.816] lstrlenW (lpString=".docx") returned 5
	[0098.816] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.816] lstrlenW (lpString=".pdf") returned 4
	[0098.816] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.816] lstrlenW (lpString=".xls") returned 4
	[0098.816] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.816] lstrlenW (lpString=".xlsx") returned 5
	[0098.816] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.816] lstrlenW (lpString=".ppt") returned 4
	[0098.816] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0098.816] lstrlenW (lpString=".zip") returned 4
	[0098.816] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.816] lstrlenW (lpString=".rar") returned 4
	[0098.816] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.816] lstrlenW (lpString=".bz2") returned 4
	[0098.816] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.816] lstrlenW (lpString=".7z") returned 3
	[0098.816] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0098.816] lstrlenW (lpString=".dbf") returned 4
	[0098.816] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0098.816] lstrlenW (lpString=".1cd") returned 4
	[0098.816] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0098.817] lstrlenW (lpString=".jpg") returned 4
	[0098.817] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0098.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0098.817] lstrlenW (lpString=".doc") returned 4
	[0098.817] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.817] lstrlenW (lpString=".docx") returned 5
	[0098.817] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.817] lstrlenW (lpString=".pdf") returned 4
	[0098.817] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.817] lstrlenW (lpString=".xls") returned 4
	[0098.817] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.817] lstrlenW (lpString=".xlsx") returned 5
	[0098.817] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.817] lstrlenW (lpString=".ppt") returned 4
	[0098.817] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0098.817] lstrlenW (lpString=".zip") returned 4
	[0098.817] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.817] lstrlenW (lpString=".rar") returned 4
	[0098.817] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.817] lstrlenW (lpString=".bz2") returned 4
	[0098.817] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.817] lstrlenW (lpString=".7z") returned 3
	[0098.817] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0098.817] lstrlenW (lpString=".dbf") returned 4
	[0098.817] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0098.817] lstrlenW (lpString=".1cd") returned 4
	[0098.817] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0098.818] lstrlenW (lpString=".jpg") returned 4
	[0098.818] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.818] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.818] lstrlenW (lpString="AG00164_.GIF") returned 12
	[0098.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.826] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=13254) returned 1
	[0098.826] CloseHandle (hObject=0x160) returned 1
	[0098.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20
	[0098.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.863] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.864] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.868] GetLastError () returned 0x0
	[0098.868] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x33c6, lpOverlapped=0x0) returned 1
	[0098.875] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x33d0, lpOverlapped=0x0) returned 1
	[0098.877] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.878] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.878] SetEndOfFile (hFile=0x160) returned 1
	[0098.878] CloseHandle (hObject=0x160) returned 1
	[0098.878] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.878] SetEndOfFile (hFile=0x190) returned 1
	[0098.879] CloseHandle (hObject=0x190) returned 1
	[0098.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1
	[0098.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0098.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0098.880] lstrlenW (lpString=".doc") returned 4
	[0098.880] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.880] lstrlenW (lpString=".docx") returned 5
	[0098.880] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.880] lstrlenW (lpString=".pdf") returned 4
	[0098.880] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.880] lstrlenW (lpString=".xls") returned 4
	[0098.880] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.880] lstrlenW (lpString=".xlsx") returned 5
	[0098.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.880] lstrlenW (lpString=".ppt") returned 4
	[0098.880] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0098.880] lstrlenW (lpString=".zip") returned 4
	[0098.880] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.880] lstrlenW (lpString=".rar") returned 4
	[0098.881] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.881] lstrlenW (lpString=".bz2") returned 4
	[0098.881] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.881] lstrlenW (lpString=".7z") returned 3
	[0098.881] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0098.881] lstrlenW (lpString=".dbf") returned 4
	[0098.881] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0098.881] lstrlenW (lpString=".1cd") returned 4
	[0098.881] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0098.881] lstrlenW (lpString=".jpg") returned 4
	[0098.881] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0098.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0098.881] lstrlenW (lpString=".doc") returned 4
	[0098.881] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.881] lstrlenW (lpString=".docx") returned 5
	[0098.881] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.881] lstrlenW (lpString=".pdf") returned 4
	[0098.881] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.881] lstrlenW (lpString=".xls") returned 4
	[0098.881] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.881] lstrlenW (lpString=".xlsx") returned 5
	[0098.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.881] lstrlenW (lpString=".ppt") returned 4
	[0098.881] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0098.881] lstrlenW (lpString=".zip") returned 4
	[0098.881] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.882] lstrlenW (lpString=".rar") returned 4
	[0098.882] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.882] lstrlenW (lpString=".bz2") returned 4
	[0098.882] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.882] lstrlenW (lpString=".7z") returned 3
	[0098.882] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0098.882] lstrlenW (lpString=".dbf") returned 4
	[0098.882] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0098.882] lstrlenW (lpString=".1cd") returned 4
	[0098.882] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0098.882] lstrlenW (lpString=".jpg") returned 4
	[0098.882] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.882] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.882] lstrlenW (lpString="AG00167_.GIF") returned 12
	[0098.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.909] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=4894) returned 1
	[0098.909] CloseHandle (hObject=0x190) returned 1
	[0098.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20
	[0098.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.935] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.935] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0098.939] GetLastError () returned 0x0
	[0098.939] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x131e, lpOverlapped=0x0) returned 1
	[0098.949] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1320, lpOverlapped=0x0) returned 1
	[0098.950] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.950] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.951] SetEndOfFile (hFile=0x174) returned 1
	[0098.951] CloseHandle (hObject=0x174) returned 1
	[0098.951] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.951] SetEndOfFile (hFile=0x190) returned 1
	[0098.952] CloseHandle (hObject=0x190) returned 1
	[0098.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1
	[0098.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0098.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0098.952] lstrlenW (lpString=".doc") returned 4
	[0098.952] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.952] lstrlenW (lpString=".docx") returned 5
	[0098.952] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.952] lstrlenW (lpString=".pdf") returned 4
	[0098.952] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.952] lstrlenW (lpString=".xls") returned 4
	[0098.952] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.952] lstrlenW (lpString=".xlsx") returned 5
	[0098.952] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.952] lstrlenW (lpString=".ppt") returned 4
	[0098.952] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0098.952] lstrlenW (lpString=".zip") returned 4
	[0098.953] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.953] lstrlenW (lpString=".rar") returned 4
	[0098.953] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.953] lstrlenW (lpString=".bz2") returned 4
	[0098.953] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.953] lstrlenW (lpString=".7z") returned 3
	[0098.953] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0098.953] lstrlenW (lpString=".dbf") returned 4
	[0098.953] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0098.953] lstrlenW (lpString=".1cd") returned 4
	[0098.953] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0098.953] lstrlenW (lpString=".jpg") returned 4
	[0098.953] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0098.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0098.953] lstrlenW (lpString=".doc") returned 4
	[0098.953] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.953] lstrlenW (lpString=".docx") returned 5
	[0098.953] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.953] lstrlenW (lpString=".pdf") returned 4
	[0098.953] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.953] lstrlenW (lpString=".xls") returned 4
	[0098.953] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.953] lstrlenW (lpString=".xlsx") returned 5
	[0098.953] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.953] lstrlenW (lpString=".ppt") returned 4
	[0098.953] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0098.953] lstrlenW (lpString=".zip") returned 4
	[0098.954] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.954] lstrlenW (lpString=".rar") returned 4
	[0098.954] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.954] lstrlenW (lpString=".bz2") returned 4
	[0098.954] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.954] lstrlenW (lpString=".7z") returned 3
	[0098.954] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0098.954] lstrlenW (lpString=".dbf") returned 4
	[0098.954] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0098.954] lstrlenW (lpString=".1cd") returned 4
	[0098.954] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0098.954] lstrlenW (lpString=".jpg") returned 4
	[0098.954] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.954] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.954] lstrlenW (lpString="AG00170_.GIF") returned 12
	[0098.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.955] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=9248) returned 1
	[0098.955] CloseHandle (hObject=0x190) returned 1
	[0098.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20
	[0098.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.955] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.955] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0098.956] GetLastError () returned 0x0
	[0098.956] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x2420, lpOverlapped=0x0) returned 1
	[0098.968] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2430, lpOverlapped=0x0) returned 1
	[0098.969] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.969] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.970] SetEndOfFile (hFile=0x174) returned 1
	[0098.970] CloseHandle (hObject=0x174) returned 1
	[0098.970] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.970] SetEndOfFile (hFile=0x190) returned 1
	[0098.971] CloseHandle (hObject=0x190) returned 1
	[0098.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1
	[0098.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0098.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0098.971] lstrlenW (lpString=".doc") returned 4
	[0098.971] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.971] lstrlenW (lpString=".docx") returned 5
	[0098.971] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.971] lstrlenW (lpString=".pdf") returned 4
	[0098.971] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.971] lstrlenW (lpString=".xls") returned 4
	[0098.971] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.971] lstrlenW (lpString=".xlsx") returned 5
	[0098.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.971] lstrlenW (lpString=".ppt") returned 4
	[0098.971] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0098.972] lstrlenW (lpString=".zip") returned 4
	[0098.972] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.972] lstrlenW (lpString=".rar") returned 4
	[0098.972] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.972] lstrlenW (lpString=".bz2") returned 4
	[0098.972] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.972] lstrlenW (lpString=".7z") returned 3
	[0098.972] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0098.972] lstrlenW (lpString=".dbf") returned 4
	[0098.972] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0098.972] lstrlenW (lpString=".1cd") returned 4
	[0098.972] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0098.972] lstrlenW (lpString=".jpg") returned 4
	[0098.972] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0098.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0098.972] lstrlenW (lpString=".doc") returned 4
	[0098.972] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.972] lstrlenW (lpString=".docx") returned 5
	[0098.972] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.972] lstrlenW (lpString=".pdf") returned 4
	[0098.972] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.972] lstrlenW (lpString=".xls") returned 4
	[0098.972] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.972] lstrlenW (lpString=".xlsx") returned 5
	[0098.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.972] lstrlenW (lpString=".ppt") returned 4
	[0098.973] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0098.973] lstrlenW (lpString=".zip") returned 4
	[0098.973] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.973] lstrlenW (lpString=".rar") returned 4
	[0098.973] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.973] lstrlenW (lpString=".bz2") returned 4
	[0098.973] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.973] lstrlenW (lpString=".7z") returned 3
	[0098.973] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0098.973] lstrlenW (lpString=".dbf") returned 4
	[0098.973] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0098.973] lstrlenW (lpString=".1cd") returned 4
	[0098.973] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0098.973] lstrlenW (lpString=".jpg") returned 4
	[0098.973] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.973] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.973] lstrlenW (lpString="AG00172_.GIF") returned 12
	[0098.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0098.985] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=4390) returned 1
	[0098.985] CloseHandle (hObject=0x188) returned 1
	[0098.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20
	[0098.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.003] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.003] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.010] GetLastError () returned 0x0
	[0099.010] ReadFile (in: hFile=0x178, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1126, lpOverlapped=0x0) returned 1
	[0099.013] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1130, lpOverlapped=0x0) returned 1
	[0099.014] ReadFile (in: hFile=0x178, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.014] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.014] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.014] CloseHandle (hObject=0x1c0) returned 1
	[0099.014] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.014] SetEndOfFile (hFile=0x178) returned 1
	[0099.015] CloseHandle (hObject=0x178) returned 1
	[0099.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1
	[0099.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0099.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0099.016] lstrlenW (lpString=".doc") returned 4
	[0099.016] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0099.016] lstrlenW (lpString=".docx") returned 5
	[0099.016] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0099.016] lstrlenW (lpString=".pdf") returned 4
	[0099.016] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0099.016] lstrlenW (lpString=".xls") returned 4
	[0099.016] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0099.016] lstrlenW (lpString=".xlsx") returned 5
	[0099.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0099.016] lstrlenW (lpString=".ppt") returned 4
	[0099.016] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0099.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0099.016] lstrlenW (lpString=".zip") returned 4
	[0099.016] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0099.016] lstrlenW (lpString=".rar") returned 4
	[0099.016] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0099.016] lstrlenW (lpString=".bz2") returned 4
	[0099.016] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0099.016] lstrlenW (lpString=".7z") returned 3
	[0099.016] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0099.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0099.016] lstrlenW (lpString=".dbf") returned 4
	[0099.016] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0099.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0099.016] lstrlenW (lpString=".1cd") returned 4
	[0099.016] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0099.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0099.016] lstrlenW (lpString=".jpg") returned 4
	[0099.017] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0099.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0099.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0099.017] lstrlenW (lpString=".doc") returned 4
	[0099.017] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0099.017] lstrlenW (lpString=".docx") returned 5
	[0099.017] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0099.017] lstrlenW (lpString=".pdf") returned 4
	[0099.017] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0099.017] lstrlenW (lpString=".xls") returned 4
	[0099.017] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0099.017] lstrlenW (lpString=".xlsx") returned 5
	[0099.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0099.017] lstrlenW (lpString=".ppt") returned 4
	[0099.017] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0099.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0099.017] lstrlenW (lpString=".zip") returned 4
	[0099.017] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0099.017] lstrlenW (lpString=".rar") returned 4
	[0099.017] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0099.017] lstrlenW (lpString=".bz2") returned 4
	[0099.017] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0099.017] lstrlenW (lpString=".7z") returned 3
	[0099.017] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0099.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0099.017] lstrlenW (lpString=".dbf") returned 4
	[0099.017] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0099.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0099.017] lstrlenW (lpString=".1cd") returned 4
	[0099.017] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0099.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0099.017] lstrlenW (lpString=".jpg") returned 4
	[0099.017] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0099.018] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0099.018] lstrlenW (lpString="AG00175_.GIF") returned 12
	[0099.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.018] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3378) returned 1
	[0099.018] CloseHandle (hObject=0x178) returned 1
	[0099.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20
	[0099.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.019] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.019] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.019] GetLastError () returned 0x0
	[0099.019] ReadFile (in: hFile=0x178, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xd32, lpOverlapped=0x0) returned 1
	[0099.028] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xd40, lpOverlapped=0x0) returned 1
	[0099.030] ReadFile (in: hFile=0x178, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.030] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.030] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.030] CloseHandle (hObject=0x1c0) returned 1
	[0099.030] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.030] SetEndOfFile (hFile=0x178) returned 1
	[0099.031] CloseHandle (hObject=0x178) returned 1
	[0099.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1
	[0099.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0099.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0099.031] lstrlenW (lpString=".doc") returned 4
	[0099.031] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0099.031] lstrlenW (lpString=".docx") returned 5
	[0099.031] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0099.031] lstrlenW (lpString=".pdf") returned 4
	[0099.031] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0099.031] lstrlenW (lpString=".xls") returned 4
	[0099.031] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0099.031] lstrlenW (lpString=".xlsx") returned 5
	[0099.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0099.032] lstrlenW (lpString=".ppt") returned 4
	[0099.032] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0099.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0099.032] lstrlenW (lpString=".zip") returned 4
	[0099.032] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0099.032] lstrlenW (lpString=".rar") returned 4
	[0099.032] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0099.032] lstrlenW (lpString=".bz2") returned 4
	[0099.032] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0099.032] lstrlenW (lpString=".7z") returned 3
	[0099.032] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0099.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0099.032] lstrlenW (lpString=".dbf") returned 4
	[0099.032] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0099.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0099.032] lstrlenW (lpString=".1cd") returned 4
	[0099.032] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0099.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0099.032] lstrlenW (lpString=".jpg") returned 4
	[0099.032] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0099.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0099.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0099.032] lstrlenW (lpString=".doc") returned 4
	[0099.032] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0099.032] lstrlenW (lpString=".docx") returned 5
	[0099.032] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0099.032] lstrlenW (lpString=".pdf") returned 4
	[0099.032] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0099.032] lstrlenW (lpString=".xls") returned 4
	[0099.032] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0099.032] lstrlenW (lpString=".xlsx") returned 5
	[0099.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0099.033] lstrlenW (lpString=".ppt") returned 4
	[0099.033] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0099.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0099.033] lstrlenW (lpString=".zip") returned 4
	[0099.033] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0099.033] lstrlenW (lpString=".rar") returned 4
	[0099.033] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0099.033] lstrlenW (lpString=".bz2") returned 4
	[0099.033] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0099.033] lstrlenW (lpString=".7z") returned 3
	[0099.033] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0099.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0099.033] lstrlenW (lpString=".dbf") returned 4
	[0099.033] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0099.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0099.033] lstrlenW (lpString=".1cd") returned 4
	[0099.033] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0099.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0099.033] lstrlenW (lpString=".jpg") returned 4
	[0099.033] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0099.033] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.033] lstrlenW (lpString="AN00010_.WMF") returned 12
	[0099.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.043] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3026) returned 1
	[0099.043] CloseHandle (hObject=0x178) returned 1
	[0099.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20
	[0099.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0099.058] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.058] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0099.068] GetLastError () returned 0x0
	[0099.068] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xbd2, lpOverlapped=0x0) returned 1
	[0099.071] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xbe0, lpOverlapped=0x0) returned 1
	[0099.072] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.072] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.072] SetEndOfFile (hFile=0x1b4) returned 1
	[0099.072] CloseHandle (hObject=0x1b4) returned 1
	[0099.072] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.072] SetEndOfFile (hFile=0x174) returned 1
	[0099.073] CloseHandle (hObject=0x174) returned 1
	[0099.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1
	[0099.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0099.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0099.074] lstrlenW (lpString=".doc") returned 4
	[0099.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.074] lstrlenW (lpString=".docx") returned 5
	[0099.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.074] lstrlenW (lpString=".pdf") returned 4
	[0099.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.074] lstrlenW (lpString=".xls") returned 4
	[0099.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.074] lstrlenW (lpString=".xlsx") returned 5
	[0099.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.074] lstrlenW (lpString=".ppt") returned 4
	[0099.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0099.074] lstrlenW (lpString=".zip") returned 4
	[0099.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.074] lstrlenW (lpString=".rar") returned 4
	[0099.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.074] lstrlenW (lpString=".bz2") returned 4
	[0099.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.074] lstrlenW (lpString=".7z") returned 3
	[0099.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0099.074] lstrlenW (lpString=".dbf") returned 4
	[0099.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0099.075] lstrlenW (lpString=".1cd") returned 4
	[0099.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0099.075] lstrlenW (lpString=".jpg") returned 4
	[0099.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0099.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0099.075] lstrlenW (lpString=".doc") returned 4
	[0099.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.075] lstrlenW (lpString=".docx") returned 5
	[0099.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.075] lstrlenW (lpString=".pdf") returned 4
	[0099.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.075] lstrlenW (lpString=".xls") returned 4
	[0099.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.075] lstrlenW (lpString=".xlsx") returned 5
	[0099.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.075] lstrlenW (lpString=".ppt") returned 4
	[0099.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0099.075] lstrlenW (lpString=".zip") returned 4
	[0099.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.075] lstrlenW (lpString=".rar") returned 4
	[0099.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.075] lstrlenW (lpString=".bz2") returned 4
	[0099.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.075] lstrlenW (lpString=".7z") returned 3
	[0099.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0099.075] lstrlenW (lpString=".dbf") returned 4
	[0099.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0099.076] lstrlenW (lpString=".1cd") returned 4
	[0099.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0099.076] lstrlenW (lpString=".jpg") returned 4
	[0099.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.076] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.076] lstrlenW (lpString="AN00790_.WMF") returned 12
	[0099.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.087] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=5684) returned 1
	[0099.088] CloseHandle (hObject=0x178) returned 1
	[0099.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20
	[0099.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.096] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.097] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0099.102] GetLastError () returned 0x0
	[0099.102] ReadFile (in: hFile=0x1a0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1634, lpOverlapped=0x0) returned 1
	[0099.106] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1640, lpOverlapped=0x0) returned 1
	[0099.107] ReadFile (in: hFile=0x1a0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.107] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.107] SetEndOfFile (hFile=0x1b4) returned 1
	[0099.107] CloseHandle (hObject=0x1b4) returned 1
	[0099.107] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.107] SetEndOfFile (hFile=0x1a0) returned 1
	[0099.108] CloseHandle (hObject=0x1a0) returned 1
	[0099.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1
	[0099.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0099.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0099.108] lstrlenW (lpString=".doc") returned 4
	[0099.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.108] lstrlenW (lpString=".docx") returned 5
	[0099.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.108] lstrlenW (lpString=".pdf") returned 4
	[0099.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.108] lstrlenW (lpString=".xls") returned 4
	[0099.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.108] lstrlenW (lpString=".xlsx") returned 5
	[0099.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.109] lstrlenW (lpString=".ppt") returned 4
	[0099.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0099.109] lstrlenW (lpString=".zip") returned 4
	[0099.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.109] lstrlenW (lpString=".rar") returned 4
	[0099.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.109] lstrlenW (lpString=".bz2") returned 4
	[0099.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.109] lstrlenW (lpString=".7z") returned 3
	[0099.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0099.109] lstrlenW (lpString=".dbf") returned 4
	[0099.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0099.109] lstrlenW (lpString=".1cd") returned 4
	[0099.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0099.109] lstrlenW (lpString=".jpg") returned 4
	[0099.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0099.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0099.109] lstrlenW (lpString=".doc") returned 4
	[0099.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.109] lstrlenW (lpString=".docx") returned 5
	[0099.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.109] lstrlenW (lpString=".pdf") returned 4
	[0099.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.109] lstrlenW (lpString=".xls") returned 4
	[0099.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.110] lstrlenW (lpString=".xlsx") returned 5
	[0099.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.110] lstrlenW (lpString=".ppt") returned 4
	[0099.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0099.110] lstrlenW (lpString=".zip") returned 4
	[0099.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.110] lstrlenW (lpString=".rar") returned 4
	[0099.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.110] lstrlenW (lpString=".bz2") returned 4
	[0099.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.110] lstrlenW (lpString=".7z") returned 3
	[0099.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0099.110] lstrlenW (lpString=".dbf") returned 4
	[0099.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0099.110] lstrlenW (lpString=".1cd") returned 4
	[0099.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0099.110] lstrlenW (lpString=".jpg") returned 4
	[0099.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.110] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.110] lstrlenW (lpString="AN00914_.WMF") returned 12
	[0099.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0099.124] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=10832) returned 1
	[0099.124] CloseHandle (hObject=0x1b4) returned 1
	[0099.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20
	[0099.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0099.137] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.137] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.139] GetLastError () returned 0x0
	[0099.139] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x2a50, lpOverlapped=0x0) returned 1
	[0099.142] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2a60, lpOverlapped=0x0) returned 1
	[0099.144] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.144] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.144] SetEndOfFile (hFile=0x1a0) returned 1
	[0099.144] CloseHandle (hObject=0x1a0) returned 1
	[0099.144] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.144] SetEndOfFile (hFile=0x1b4) returned 1
	[0099.145] CloseHandle (hObject=0x1b4) returned 1
	[0099.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1
	[0099.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0099.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0099.145] lstrlenW (lpString=".doc") returned 4
	[0099.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.146] lstrlenW (lpString=".docx") returned 5
	[0099.146] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.146] lstrlenW (lpString=".pdf") returned 4
	[0099.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.146] lstrlenW (lpString=".xls") returned 4
	[0099.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.146] lstrlenW (lpString=".xlsx") returned 5
	[0099.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.146] lstrlenW (lpString=".ppt") returned 4
	[0099.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0099.146] lstrlenW (lpString=".zip") returned 4
	[0099.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.146] lstrlenW (lpString=".rar") returned 4
	[0099.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.146] lstrlenW (lpString=".bz2") returned 4
	[0099.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.146] lstrlenW (lpString=".7z") returned 3
	[0099.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0099.146] lstrlenW (lpString=".dbf") returned 4
	[0099.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0099.146] lstrlenW (lpString=".1cd") returned 4
	[0099.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0099.146] lstrlenW (lpString=".jpg") returned 4
	[0099.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0099.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0099.147] lstrlenW (lpString=".doc") returned 4
	[0099.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.147] lstrlenW (lpString=".docx") returned 5
	[0099.147] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.147] lstrlenW (lpString=".pdf") returned 4
	[0099.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.147] lstrlenW (lpString=".xls") returned 4
	[0099.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.147] lstrlenW (lpString=".xlsx") returned 5
	[0099.147] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.147] lstrlenW (lpString=".ppt") returned 4
	[0099.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0099.147] lstrlenW (lpString=".zip") returned 4
	[0099.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.147] lstrlenW (lpString=".rar") returned 4
	[0099.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.147] lstrlenW (lpString=".bz2") returned 4
	[0099.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.147] lstrlenW (lpString=".7z") returned 3
	[0099.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0099.147] lstrlenW (lpString=".dbf") returned 4
	[0099.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0099.147] lstrlenW (lpString=".1cd") returned 4
	[0099.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0099.147] lstrlenW (lpString=".jpg") returned 4
	[0099.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.148] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.148] lstrlenW (lpString="AN00965_.WMF") returned 12
	[0099.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0099.148] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=7072) returned 1
	[0099.148] CloseHandle (hObject=0x1b4) returned 1
	[0099.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20
	[0099.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0099.149] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.149] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.149] GetLastError () returned 0x0
	[0099.149] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1ba0, lpOverlapped=0x0) returned 1
	[0099.160] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1bb0, lpOverlapped=0x0) returned 1
	[0099.161] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.161] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.161] SetEndOfFile (hFile=0x1a0) returned 1
	[0099.161] CloseHandle (hObject=0x1a0) returned 1
	[0099.161] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.161] SetEndOfFile (hFile=0x1b4) returned 1
	[0099.162] CloseHandle (hObject=0x1b4) returned 1
	[0099.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1
	[0099.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0099.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0099.163] lstrlenW (lpString=".doc") returned 4
	[0099.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.163] lstrlenW (lpString=".docx") returned 5
	[0099.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.163] lstrlenW (lpString=".pdf") returned 4
	[0099.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.163] lstrlenW (lpString=".xls") returned 4
	[0099.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.163] lstrlenW (lpString=".xlsx") returned 5
	[0099.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.163] lstrlenW (lpString=".ppt") returned 4
	[0099.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0099.163] lstrlenW (lpString=".zip") returned 4
	[0099.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.163] lstrlenW (lpString=".rar") returned 4
	[0099.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.163] lstrlenW (lpString=".bz2") returned 4
	[0099.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.163] lstrlenW (lpString=".7z") returned 3
	[0099.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0099.163] lstrlenW (lpString=".dbf") returned 4
	[0099.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0099.163] lstrlenW (lpString=".1cd") returned 4
	[0099.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0099.164] lstrlenW (lpString=".jpg") returned 4
	[0099.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0099.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0099.164] lstrlenW (lpString=".doc") returned 4
	[0099.164] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.164] lstrlenW (lpString=".docx") returned 5
	[0099.164] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.164] lstrlenW (lpString=".pdf") returned 4
	[0099.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.164] lstrlenW (lpString=".xls") returned 4
	[0099.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.164] lstrlenW (lpString=".xlsx") returned 5
	[0099.164] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.164] lstrlenW (lpString=".ppt") returned 4
	[0099.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0099.164] lstrlenW (lpString=".zip") returned 4
	[0099.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.164] lstrlenW (lpString=".rar") returned 4
	[0099.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.164] lstrlenW (lpString=".bz2") returned 4
	[0099.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.164] lstrlenW (lpString=".7z") returned 3
	[0099.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0099.164] lstrlenW (lpString=".dbf") returned 4
	[0099.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0099.164] lstrlenW (lpString=".1cd") returned 4
	[0099.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0099.165] lstrlenW (lpString=".jpg") returned 4
	[0099.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.165] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.165] lstrlenW (lpString="AN01044_.WMF") returned 12
	[0099.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0099.165] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1596) returned 1
	[0099.165] CloseHandle (hObject=0x1b4) returned 1
	[0099.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20
	[0099.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0099.166] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.166] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.166] GetLastError () returned 0x0
	[0099.166] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x63c, lpOverlapped=0x0) returned 1
	[0099.175] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x640, lpOverlapped=0x0) returned 1
	[0099.176] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.176] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.176] SetEndOfFile (hFile=0x1a0) returned 1
	[0099.176] CloseHandle (hObject=0x1a0) returned 1
	[0099.176] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.176] SetEndOfFile (hFile=0x1b4) returned 1
	[0099.177] CloseHandle (hObject=0x1b4) returned 1
	[0099.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1
	[0099.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0099.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0099.180] lstrlenW (lpString=".doc") returned 4
	[0099.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.180] lstrlenW (lpString=".docx") returned 5
	[0099.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.180] lstrlenW (lpString=".pdf") returned 4
	[0099.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.180] lstrlenW (lpString=".xls") returned 4
	[0099.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.180] lstrlenW (lpString=".xlsx") returned 5
	[0099.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.180] lstrlenW (lpString=".ppt") returned 4
	[0099.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0099.180] lstrlenW (lpString=".zip") returned 4
	[0099.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.180] lstrlenW (lpString=".rar") returned 4
	[0099.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.180] lstrlenW (lpString=".bz2") returned 4
	[0099.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.180] lstrlenW (lpString=".7z") returned 3
	[0099.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0099.180] lstrlenW (lpString=".dbf") returned 4
	[0099.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0099.180] lstrlenW (lpString=".1cd") returned 4
	[0099.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0099.180] lstrlenW (lpString=".jpg") returned 4
	[0099.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0099.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0099.181] lstrlenW (lpString=".doc") returned 4
	[0099.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.181] lstrlenW (lpString=".docx") returned 5
	[0099.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.181] lstrlenW (lpString=".pdf") returned 4
	[0099.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.181] lstrlenW (lpString=".xls") returned 4
	[0099.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.181] lstrlenW (lpString=".xlsx") returned 5
	[0099.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.181] lstrlenW (lpString=".ppt") returned 4
	[0099.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0099.181] lstrlenW (lpString=".zip") returned 4
	[0099.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.181] lstrlenW (lpString=".rar") returned 4
	[0099.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.181] lstrlenW (lpString=".bz2") returned 4
	[0099.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.181] lstrlenW (lpString=".7z") returned 3
	[0099.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0099.181] lstrlenW (lpString=".dbf") returned 4
	[0099.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0099.181] lstrlenW (lpString=".1cd") returned 4
	[0099.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0099.181] lstrlenW (lpString=".jpg") returned 4
	[0099.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.182] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.182] lstrlenW (lpString="AN01084_.WMF") returned 12
	[0099.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.191] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1832) returned 1
	[0099.191] CloseHandle (hObject=0x188) returned 1
	[0099.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20
	[0099.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.202] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.202] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0099.205] GetLastError () returned 0x0
	[0099.205] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x728, lpOverlapped=0x0) returned 1
	[0099.213] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x730, lpOverlapped=0x0) returned 1
	[0099.215] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.215] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.215] SetEndOfFile (hFile=0x1cc) returned 1
	[0099.215] CloseHandle (hObject=0x1cc) returned 1
	[0099.215] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.215] SetEndOfFile (hFile=0x198) returned 1
	[0099.216] CloseHandle (hObject=0x198) returned 1
	[0099.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1
	[0099.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0099.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0099.217] lstrlenW (lpString=".doc") returned 4
	[0099.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.217] lstrlenW (lpString=".docx") returned 5
	[0099.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.217] lstrlenW (lpString=".pdf") returned 4
	[0099.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.217] lstrlenW (lpString=".xls") returned 4
	[0099.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.217] lstrlenW (lpString=".xlsx") returned 5
	[0099.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.217] lstrlenW (lpString=".ppt") returned 4
	[0099.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0099.217] lstrlenW (lpString=".zip") returned 4
	[0099.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.217] lstrlenW (lpString=".rar") returned 4
	[0099.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.217] lstrlenW (lpString=".bz2") returned 4
	[0099.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.217] lstrlenW (lpString=".7z") returned 3
	[0099.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0099.217] lstrlenW (lpString=".dbf") returned 4
	[0099.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0099.217] lstrlenW (lpString=".1cd") returned 4
	[0099.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0099.218] lstrlenW (lpString=".jpg") returned 4
	[0099.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0099.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0099.218] lstrlenW (lpString=".doc") returned 4
	[0099.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.218] lstrlenW (lpString=".docx") returned 5
	[0099.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.218] lstrlenW (lpString=".pdf") returned 4
	[0099.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.218] lstrlenW (lpString=".xls") returned 4
	[0099.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.218] lstrlenW (lpString=".xlsx") returned 5
	[0099.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.218] lstrlenW (lpString=".ppt") returned 4
	[0099.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0099.218] lstrlenW (lpString=".zip") returned 4
	[0099.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.218] lstrlenW (lpString=".rar") returned 4
	[0099.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.218] lstrlenW (lpString=".bz2") returned 4
	[0099.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.218] lstrlenW (lpString=".7z") returned 3
	[0099.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0099.218] lstrlenW (lpString=".dbf") returned 4
	[0099.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0099.219] lstrlenW (lpString=".1cd") returned 4
	[0099.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0099.219] lstrlenW (lpString=".jpg") returned 4
	[0099.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.219] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.219] lstrlenW (lpString="AN01174_.WMF") returned 12
	[0099.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0099.225] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=27858) returned 1
	[0099.225] CloseHandle (hObject=0x1cc) returned 1
	[0099.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20
	[0099.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0099.250] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.250] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.253] GetLastError () returned 0x0
	[0099.253] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x6cd2, lpOverlapped=0x0) returned 1
	[0099.264] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x6ce0, lpOverlapped=0x0) returned 1
	[0099.266] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.266] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.266] SetEndOfFile (hFile=0x1a0) returned 1
	[0099.266] CloseHandle (hObject=0x1a0) returned 1
	[0099.266] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.267] SetEndOfFile (hFile=0x1b4) returned 1
	[0099.267] CloseHandle (hObject=0x1b4) returned 1
	[0099.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1
	[0099.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0099.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0099.268] lstrlenW (lpString=".doc") returned 4
	[0099.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.268] lstrlenW (lpString=".docx") returned 5
	[0099.268] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.268] lstrlenW (lpString=".pdf") returned 4
	[0099.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.268] lstrlenW (lpString=".xls") returned 4
	[0099.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.268] lstrlenW (lpString=".xlsx") returned 5
	[0099.268] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.268] lstrlenW (lpString=".ppt") returned 4
	[0099.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0099.268] lstrlenW (lpString=".zip") returned 4
	[0099.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.268] lstrlenW (lpString=".rar") returned 4
	[0099.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.268] lstrlenW (lpString=".bz2") returned 4
	[0099.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.269] lstrlenW (lpString=".7z") returned 3
	[0099.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0099.269] lstrlenW (lpString=".dbf") returned 4
	[0099.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0099.269] lstrlenW (lpString=".1cd") returned 4
	[0099.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0099.269] lstrlenW (lpString=".jpg") returned 4
	[0099.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0099.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0099.269] lstrlenW (lpString=".doc") returned 4
	[0099.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.269] lstrlenW (lpString=".docx") returned 5
	[0099.269] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.269] lstrlenW (lpString=".pdf") returned 4
	[0099.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.269] lstrlenW (lpString=".xls") returned 4
	[0099.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.269] lstrlenW (lpString=".xlsx") returned 5
	[0099.269] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.269] lstrlenW (lpString=".ppt") returned 4
	[0099.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0099.270] lstrlenW (lpString=".zip") returned 4
	[0099.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.270] lstrlenW (lpString=".rar") returned 4
	[0099.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.270] lstrlenW (lpString=".bz2") returned 4
	[0099.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.270] lstrlenW (lpString=".7z") returned 3
	[0099.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0099.270] lstrlenW (lpString=".dbf") returned 4
	[0099.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0099.270] lstrlenW (lpString=".1cd") returned 4
	[0099.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0099.270] lstrlenW (lpString=".jpg") returned 4
	[0099.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.270] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.270] lstrlenW (lpString="AN01216_.WMF") returned 12
	[0099.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0099.271] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=5836) returned 1
	[0099.271] CloseHandle (hObject=0x1b4) returned 1
	[0099.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20
	[0099.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0099.272] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.272] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.273] GetLastError () returned 0x0
	[0099.273] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x16cc, lpOverlapped=0x0) returned 1
	[0099.285] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x16d0, lpOverlapped=0x0) returned 1
	[0099.286] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.286] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.286] SetEndOfFile (hFile=0x1a0) returned 1
	[0099.286] CloseHandle (hObject=0x1a0) returned 1
	[0099.286] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.286] SetEndOfFile (hFile=0x1b4) returned 1
	[0099.287] CloseHandle (hObject=0x1b4) returned 1
	[0099.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1
	[0099.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0099.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0099.288] lstrlenW (lpString=".doc") returned 4
	[0099.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.288] lstrlenW (lpString=".docx") returned 5
	[0099.288] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.288] lstrlenW (lpString=".pdf") returned 4
	[0099.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.288] lstrlenW (lpString=".xls") returned 4
	[0099.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.288] lstrlenW (lpString=".xlsx") returned 5
	[0099.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.288] lstrlenW (lpString=".ppt") returned 4
	[0099.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0099.288] lstrlenW (lpString=".zip") returned 4
	[0099.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.288] lstrlenW (lpString=".rar") returned 4
	[0099.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.288] lstrlenW (lpString=".bz2") returned 4
	[0099.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.288] lstrlenW (lpString=".7z") returned 3
	[0099.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0099.288] lstrlenW (lpString=".dbf") returned 4
	[0099.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0099.288] lstrlenW (lpString=".1cd") returned 4
	[0099.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0099.288] lstrlenW (lpString=".jpg") returned 4
	[0099.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0099.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0099.289] lstrlenW (lpString=".doc") returned 4
	[0099.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.289] lstrlenW (lpString=".docx") returned 5
	[0099.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.289] lstrlenW (lpString=".pdf") returned 4
	[0099.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.289] lstrlenW (lpString=".xls") returned 4
	[0099.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.289] lstrlenW (lpString=".xlsx") returned 5
	[0099.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.289] lstrlenW (lpString=".ppt") returned 4
	[0099.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0099.289] lstrlenW (lpString=".zip") returned 4
	[0099.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.289] lstrlenW (lpString=".rar") returned 4
	[0099.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.289] lstrlenW (lpString=".bz2") returned 4
	[0099.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.289] lstrlenW (lpString=".7z") returned 3
	[0099.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0099.289] lstrlenW (lpString=".dbf") returned 4
	[0099.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0099.289] lstrlenW (lpString=".1cd") returned 4
	[0099.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0099.289] lstrlenW (lpString=".jpg") returned 4
	[0099.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.290] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.290] lstrlenW (lpString="AN01251_.WMF") returned 12
	[0099.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0099.290] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2756) returned 1
	[0099.290] CloseHandle (hObject=0x1b4) returned 1
	[0099.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20
	[0099.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0099.291] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.291] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.291] GetLastError () returned 0x0
	[0099.291] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xac4, lpOverlapped=0x0) returned 1
	[0099.301] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xad0, lpOverlapped=0x0) returned 1
	[0099.302] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.302] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.302] SetEndOfFile (hFile=0x1a0) returned 1
	[0099.302] CloseHandle (hObject=0x1a0) returned 1
	[0099.302] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.302] SetEndOfFile (hFile=0x1b4) returned 1
	[0099.303] CloseHandle (hObject=0x1b4) returned 1
	[0099.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1
	[0099.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0099.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0099.304] lstrlenW (lpString=".doc") returned 4
	[0099.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.304] lstrlenW (lpString=".docx") returned 5
	[0099.304] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.304] lstrlenW (lpString=".pdf") returned 4
	[0099.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.304] lstrlenW (lpString=".xls") returned 4
	[0099.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.304] lstrlenW (lpString=".xlsx") returned 5
	[0099.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.304] lstrlenW (lpString=".ppt") returned 4
	[0099.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0099.304] lstrlenW (lpString=".zip") returned 4
	[0099.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.304] lstrlenW (lpString=".rar") returned 4
	[0099.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.304] lstrlenW (lpString=".bz2") returned 4
	[0099.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.304] lstrlenW (lpString=".7z") returned 3
	[0099.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0099.304] lstrlenW (lpString=".dbf") returned 4
	[0099.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0099.305] lstrlenW (lpString=".1cd") returned 4
	[0099.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0099.305] lstrlenW (lpString=".jpg") returned 4
	[0099.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0099.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0099.305] lstrlenW (lpString=".doc") returned 4
	[0099.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.305] lstrlenW (lpString=".docx") returned 5
	[0099.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.305] lstrlenW (lpString=".pdf") returned 4
	[0099.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.305] lstrlenW (lpString=".xls") returned 4
	[0099.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.305] lstrlenW (lpString=".xlsx") returned 5
	[0099.305] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.305] lstrlenW (lpString=".ppt") returned 4
	[0099.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0099.305] lstrlenW (lpString=".zip") returned 4
	[0099.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.305] lstrlenW (lpString=".rar") returned 4
	[0099.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.305] lstrlenW (lpString=".bz2") returned 4
	[0099.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.305] lstrlenW (lpString=".7z") returned 3
	[0099.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0099.305] lstrlenW (lpString=".dbf") returned 4
	[0099.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0099.306] lstrlenW (lpString=".1cd") returned 4
	[0099.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0099.306] lstrlenW (lpString=".jpg") returned 4
	[0099.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.306] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.306] lstrlenW (lpString="AN02122_.WMF") returned 12
	[0099.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.319] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=7540) returned 1
	[0099.319] CloseHandle (hObject=0x178) returned 1
	[0099.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20
	[0099.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0099.330] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.330] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.333] GetLastError () returned 0x0
	[0099.333] ReadFile (in: hFile=0x170, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1d74, lpOverlapped=0x0) returned 1
	[0099.338] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1d80, lpOverlapped=0x0) returned 1
	[0099.339] ReadFile (in: hFile=0x170, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.339] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.339] SetEndOfFile (hFile=0x188) returned 1
	[0099.339] CloseHandle (hObject=0x188) returned 1
	[0099.339] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.340] SetEndOfFile (hFile=0x170) returned 1
	[0099.340] CloseHandle (hObject=0x170) returned 1
	[0099.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1
	[0099.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0099.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0099.341] lstrlenW (lpString=".doc") returned 4
	[0099.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.341] lstrlenW (lpString=".docx") returned 5
	[0099.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.341] lstrlenW (lpString=".pdf") returned 4
	[0099.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.341] lstrlenW (lpString=".xls") returned 4
	[0099.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.341] lstrlenW (lpString=".xlsx") returned 5
	[0099.341] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.341] lstrlenW (lpString=".ppt") returned 4
	[0099.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0099.341] lstrlenW (lpString=".zip") returned 4
	[0099.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.341] lstrlenW (lpString=".rar") returned 4
	[0099.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.342] lstrlenW (lpString=".bz2") returned 4
	[0099.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.342] lstrlenW (lpString=".7z") returned 3
	[0099.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0099.342] lstrlenW (lpString=".dbf") returned 4
	[0099.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0099.342] lstrlenW (lpString=".1cd") returned 4
	[0099.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0099.342] lstrlenW (lpString=".jpg") returned 4
	[0099.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0099.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0099.342] lstrlenW (lpString=".doc") returned 4
	[0099.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.342] lstrlenW (lpString=".docx") returned 5
	[0099.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.342] lstrlenW (lpString=".pdf") returned 4
	[0099.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.342] lstrlenW (lpString=".xls") returned 4
	[0099.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.342] lstrlenW (lpString=".xlsx") returned 5
	[0099.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.342] lstrlenW (lpString=".ppt") returned 4
	[0099.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0099.342] lstrlenW (lpString=".zip") returned 4
	[0099.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.343] lstrlenW (lpString=".rar") returned 4
	[0099.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.343] lstrlenW (lpString=".bz2") returned 4
	[0099.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.343] lstrlenW (lpString=".7z") returned 3
	[0099.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0099.343] lstrlenW (lpString=".dbf") returned 4
	[0099.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0099.343] lstrlenW (lpString=".1cd") returned 4
	[0099.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0099.343] lstrlenW (lpString=".jpg") returned 4
	[0099.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.343] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.343] lstrlenW (lpString="AN02724_.WMF") returned 12
	[0099.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0099.355] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2108) returned 1
	[0099.355] CloseHandle (hObject=0x164) returned 1
	[0099.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20
	[0099.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.375] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.375] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.377] GetLastError () returned 0x0
	[0099.378] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x83c, lpOverlapped=0x0) returned 1
	[0099.381] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x840, lpOverlapped=0x0) returned 1
	[0099.382] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.382] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.382] SetEndOfFile (hFile=0x184) returned 1
	[0099.382] CloseHandle (hObject=0x184) returned 1
	[0099.382] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.382] SetEndOfFile (hFile=0x198) returned 1
	[0099.383] CloseHandle (hObject=0x198) returned 1
	[0099.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1
	[0099.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0099.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0099.383] lstrlenW (lpString=".doc") returned 4
	[0099.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.384] lstrlenW (lpString=".docx") returned 5
	[0099.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.384] lstrlenW (lpString=".pdf") returned 4
	[0099.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.384] lstrlenW (lpString=".xls") returned 4
	[0099.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.384] lstrlenW (lpString=".xlsx") returned 5
	[0099.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.384] lstrlenW (lpString=".ppt") returned 4
	[0099.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0099.384] lstrlenW (lpString=".zip") returned 4
	[0099.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.384] lstrlenW (lpString=".rar") returned 4
	[0099.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.384] lstrlenW (lpString=".bz2") returned 4
	[0099.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.384] lstrlenW (lpString=".7z") returned 3
	[0099.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0099.384] lstrlenW (lpString=".dbf") returned 4
	[0099.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0099.384] lstrlenW (lpString=".1cd") returned 4
	[0099.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0099.384] lstrlenW (lpString=".jpg") returned 4
	[0099.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0099.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0099.384] lstrlenW (lpString=".doc") returned 4
	[0099.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.385] lstrlenW (lpString=".docx") returned 5
	[0099.385] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.385] lstrlenW (lpString=".pdf") returned 4
	[0099.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.385] lstrlenW (lpString=".xls") returned 4
	[0099.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.385] lstrlenW (lpString=".xlsx") returned 5
	[0099.385] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.385] lstrlenW (lpString=".ppt") returned 4
	[0099.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0099.385] lstrlenW (lpString=".zip") returned 4
	[0099.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.385] lstrlenW (lpString=".rar") returned 4
	[0099.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.385] lstrlenW (lpString=".bz2") returned 4
	[0099.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.385] lstrlenW (lpString=".7z") returned 3
	[0099.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0099.385] lstrlenW (lpString=".dbf") returned 4
	[0099.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0099.385] lstrlenW (lpString=".1cd") returned 4
	[0099.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0099.385] lstrlenW (lpString=".jpg") returned 4
	[0099.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.386] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.386] lstrlenW (lpString="AN04108_.WMF") returned 12
	[0099.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.386] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2344) returned 1
	[0099.386] CloseHandle (hObject=0x198) returned 1
	[0099.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20
	[0099.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.386] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.387] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.387] GetLastError () returned 0x0
	[0099.387] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x928, lpOverlapped=0x0) returned 1
	[0099.397] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x930, lpOverlapped=0x0) returned 1
	[0099.398] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.398] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.398] SetEndOfFile (hFile=0x184) returned 1
	[0099.398] CloseHandle (hObject=0x184) returned 1
	[0099.398] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.398] SetEndOfFile (hFile=0x198) returned 1
	[0099.399] CloseHandle (hObject=0x198) returned 1
	[0099.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1
	[0099.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0099.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0099.399] lstrlenW (lpString=".doc") returned 4
	[0099.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.399] lstrlenW (lpString=".docx") returned 5
	[0099.399] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.399] lstrlenW (lpString=".pdf") returned 4
	[0099.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.399] lstrlenW (lpString=".xls") returned 4
	[0099.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.400] lstrlenW (lpString=".xlsx") returned 5
	[0099.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.400] lstrlenW (lpString=".ppt") returned 4
	[0099.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0099.400] lstrlenW (lpString=".zip") returned 4
	[0099.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.400] lstrlenW (lpString=".rar") returned 4
	[0099.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.400] lstrlenW (lpString=".bz2") returned 4
	[0099.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.400] lstrlenW (lpString=".7z") returned 3
	[0099.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0099.400] lstrlenW (lpString=".dbf") returned 4
	[0099.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0099.400] lstrlenW (lpString=".1cd") returned 4
	[0099.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0099.400] lstrlenW (lpString=".jpg") returned 4
	[0099.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0099.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0099.400] lstrlenW (lpString=".doc") returned 4
	[0099.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.400] lstrlenW (lpString=".docx") returned 5
	[0099.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.400] lstrlenW (lpString=".pdf") returned 4
	[0099.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.400] lstrlenW (lpString=".xls") returned 4
	[0099.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.401] lstrlenW (lpString=".xlsx") returned 5
	[0099.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.401] lstrlenW (lpString=".ppt") returned 4
	[0099.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0099.401] lstrlenW (lpString=".zip") returned 4
	[0099.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.401] lstrlenW (lpString=".rar") returned 4
	[0099.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.401] lstrlenW (lpString=".bz2") returned 4
	[0099.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.401] lstrlenW (lpString=".7z") returned 3
	[0099.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0099.401] lstrlenW (lpString=".dbf") returned 4
	[0099.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0099.401] lstrlenW (lpString=".1cd") returned 4
	[0099.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0099.401] lstrlenW (lpString=".jpg") returned 4
	[0099.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.401] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.401] lstrlenW (lpString="AN04134_.WMF") returned 12
	[0099.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.402] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3416) returned 1
	[0099.402] CloseHandle (hObject=0x198) returned 1
	[0099.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20
	[0099.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.402] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.402] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.403] GetLastError () returned 0x0
	[0099.403] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xd58, lpOverlapped=0x0) returned 1
	[0099.411] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xd60, lpOverlapped=0x0) returned 1
	[0099.412] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.412] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.412] SetEndOfFile (hFile=0x184) returned 1
	[0099.412] CloseHandle (hObject=0x184) returned 1
	[0099.412] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.412] SetEndOfFile (hFile=0x198) returned 1
	[0099.416] CloseHandle (hObject=0x198) returned 1
	[0099.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1
	[0099.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0099.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0099.417] lstrlenW (lpString=".doc") returned 4
	[0099.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.417] lstrlenW (lpString=".docx") returned 5
	[0099.417] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.417] lstrlenW (lpString=".pdf") returned 4
	[0099.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.417] lstrlenW (lpString=".xls") returned 4
	[0099.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.417] lstrlenW (lpString=".xlsx") returned 5
	[0099.417] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.417] lstrlenW (lpString=".ppt") returned 4
	[0099.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0099.417] lstrlenW (lpString=".zip") returned 4
	[0099.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.417] lstrlenW (lpString=".rar") returned 4
	[0099.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.417] lstrlenW (lpString=".bz2") returned 4
	[0099.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.417] lstrlenW (lpString=".7z") returned 3
	[0099.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0099.418] lstrlenW (lpString=".dbf") returned 4
	[0099.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0099.418] lstrlenW (lpString=".1cd") returned 4
	[0099.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0099.418] lstrlenW (lpString=".jpg") returned 4
	[0099.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0099.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0099.418] lstrlenW (lpString=".doc") returned 4
	[0099.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.418] lstrlenW (lpString=".docx") returned 5
	[0099.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.418] lstrlenW (lpString=".pdf") returned 4
	[0099.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.418] lstrlenW (lpString=".xls") returned 4
	[0099.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.418] lstrlenW (lpString=".xlsx") returned 5
	[0099.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.418] lstrlenW (lpString=".ppt") returned 4
	[0099.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0099.419] lstrlenW (lpString=".zip") returned 4
	[0099.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.419] lstrlenW (lpString=".rar") returned 4
	[0099.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.419] lstrlenW (lpString=".bz2") returned 4
	[0099.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.419] lstrlenW (lpString=".7z") returned 3
	[0099.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0099.420] lstrlenW (lpString=".dbf") returned 4
	[0099.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0099.420] lstrlenW (lpString=".1cd") returned 4
	[0099.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0099.420] lstrlenW (lpString=".jpg") returned 4
	[0099.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.420] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.420] lstrlenW (lpString="AN04191_.WMF") returned 12
	[0099.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.431] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=6636) returned 1
	[0099.431] CloseHandle (hObject=0x1a0) returned 1
	[0099.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20
	[0099.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.449] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.449] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.454] GetLastError () returned 0x0
	[0099.454] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x19ec, lpOverlapped=0x0) returned 1
	[0099.465] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x19f0, lpOverlapped=0x0) returned 1
	[0099.466] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.466] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.467] SetEndOfFile (hFile=0x160) returned 1
	[0099.467] CloseHandle (hObject=0x160) returned 1
	[0099.467] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.467] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.468] CloseHandle (hObject=0x1c0) returned 1
	[0099.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1
	[0099.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0099.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0099.469] lstrlenW (lpString=".doc") returned 4
	[0099.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.469] lstrlenW (lpString=".docx") returned 5
	[0099.469] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.469] lstrlenW (lpString=".pdf") returned 4
	[0099.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.469] lstrlenW (lpString=".xls") returned 4
	[0099.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.469] lstrlenW (lpString=".xlsx") returned 5
	[0099.469] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.469] lstrlenW (lpString=".ppt") returned 4
	[0099.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0099.469] lstrlenW (lpString=".zip") returned 4
	[0099.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.469] lstrlenW (lpString=".rar") returned 4
	[0099.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.469] lstrlenW (lpString=".bz2") returned 4
	[0099.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.469] lstrlenW (lpString=".7z") returned 3
	[0099.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0099.469] lstrlenW (lpString=".dbf") returned 4
	[0099.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0099.470] lstrlenW (lpString=".1cd") returned 4
	[0099.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0099.470] lstrlenW (lpString=".jpg") returned 4
	[0099.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0099.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0099.470] lstrlenW (lpString=".doc") returned 4
	[0099.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.470] lstrlenW (lpString=".docx") returned 5
	[0099.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.470] lstrlenW (lpString=".pdf") returned 4
	[0099.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.470] lstrlenW (lpString=".xls") returned 4
	[0099.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.470] lstrlenW (lpString=".xlsx") returned 5
	[0099.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.470] lstrlenW (lpString=".ppt") returned 4
	[0099.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0099.470] lstrlenW (lpString=".zip") returned 4
	[0099.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.471] lstrlenW (lpString=".rar") returned 4
	[0099.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.471] lstrlenW (lpString=".bz2") returned 4
	[0099.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.471] lstrlenW (lpString=".7z") returned 3
	[0099.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0099.471] lstrlenW (lpString=".dbf") returned 4
	[0099.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0099.471] lstrlenW (lpString=".1cd") returned 4
	[0099.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0099.471] lstrlenW (lpString=".jpg") returned 4
	[0099.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.471] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.472] lstrlenW (lpString="AN04196_.WMF") returned 12
	[0099.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.472] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3144) returned 1
	[0099.472] CloseHandle (hObject=0x1c0) returned 1
	[0099.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20
	[0099.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.473] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.473] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.473] GetLastError () returned 0x0
	[0099.473] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xc48, lpOverlapped=0x0) returned 1
	[0099.487] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xc50, lpOverlapped=0x0) returned 1
	[0099.488] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.488] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.488] SetEndOfFile (hFile=0x160) returned 1
	[0099.488] CloseHandle (hObject=0x160) returned 1
	[0099.488] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.488] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.489] CloseHandle (hObject=0x1c0) returned 1
	[0099.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1
	[0099.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0099.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0099.490] lstrlenW (lpString=".doc") returned 4
	[0099.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.490] lstrlenW (lpString=".docx") returned 5
	[0099.490] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.490] lstrlenW (lpString=".pdf") returned 4
	[0099.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.490] lstrlenW (lpString=".xls") returned 4
	[0099.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.490] lstrlenW (lpString=".xlsx") returned 5
	[0099.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.490] lstrlenW (lpString=".ppt") returned 4
	[0099.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0099.490] lstrlenW (lpString=".zip") returned 4
	[0099.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.490] lstrlenW (lpString=".rar") returned 4
	[0099.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.490] lstrlenW (lpString=".bz2") returned 4
	[0099.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.490] lstrlenW (lpString=".7z") returned 3
	[0099.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0099.490] lstrlenW (lpString=".dbf") returned 4
	[0099.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0099.490] lstrlenW (lpString=".1cd") returned 4
	[0099.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0099.491] lstrlenW (lpString=".jpg") returned 4
	[0099.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0099.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0099.491] lstrlenW (lpString=".doc") returned 4
	[0099.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.491] lstrlenW (lpString=".docx") returned 5
	[0099.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.491] lstrlenW (lpString=".pdf") returned 4
	[0099.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.491] lstrlenW (lpString=".xls") returned 4
	[0099.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.491] lstrlenW (lpString=".xlsx") returned 5
	[0099.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.491] lstrlenW (lpString=".ppt") returned 4
	[0099.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0099.491] lstrlenW (lpString=".zip") returned 4
	[0099.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.491] lstrlenW (lpString=".rar") returned 4
	[0099.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.491] lstrlenW (lpString=".bz2") returned 4
	[0099.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.491] lstrlenW (lpString=".7z") returned 3
	[0099.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0099.491] lstrlenW (lpString=".dbf") returned 4
	[0099.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0099.492] lstrlenW (lpString=".1cd") returned 4
	[0099.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0099.492] lstrlenW (lpString=".jpg") returned 4
	[0099.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.492] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.492] lstrlenW (lpString="AN04225_.WMF") returned 12
	[0099.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.492] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=8492) returned 1
	[0099.492] CloseHandle (hObject=0x1c0) returned 1
	[0099.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20
	[0099.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.493] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.493] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.494] GetLastError () returned 0x0
	[0099.494] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x212c, lpOverlapped=0x0) returned 1
	[0099.505] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2130, lpOverlapped=0x0) returned 1
	[0099.507] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.507] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.507] SetEndOfFile (hFile=0x160) returned 1
	[0099.508] CloseHandle (hObject=0x160) returned 1
	[0099.508] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.508] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.508] CloseHandle (hObject=0x1c0) returned 1
	[0099.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1
	[0099.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0099.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0099.509] lstrlenW (lpString=".doc") returned 4
	[0099.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.509] lstrlenW (lpString=".docx") returned 5
	[0099.509] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.509] lstrlenW (lpString=".pdf") returned 4
	[0099.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.509] lstrlenW (lpString=".xls") returned 4
	[0099.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.509] lstrlenW (lpString=".xlsx") returned 5
	[0099.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.509] lstrlenW (lpString=".ppt") returned 4
	[0099.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0099.509] lstrlenW (lpString=".zip") returned 4
	[0099.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.509] lstrlenW (lpString=".rar") returned 4
	[0099.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.509] lstrlenW (lpString=".bz2") returned 4
	[0099.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.510] lstrlenW (lpString=".7z") returned 3
	[0099.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0099.510] lstrlenW (lpString=".dbf") returned 4
	[0099.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0099.510] lstrlenW (lpString=".1cd") returned 4
	[0099.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0099.510] lstrlenW (lpString=".jpg") returned 4
	[0099.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0099.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0099.510] lstrlenW (lpString=".doc") returned 4
	[0099.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.510] lstrlenW (lpString=".docx") returned 5
	[0099.510] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.510] lstrlenW (lpString=".pdf") returned 4
	[0099.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.510] lstrlenW (lpString=".xls") returned 4
	[0099.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.510] lstrlenW (lpString=".xlsx") returned 5
	[0099.510] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.510] lstrlenW (lpString=".ppt") returned 4
	[0099.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0099.510] lstrlenW (lpString=".zip") returned 4
	[0099.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.510] lstrlenW (lpString=".rar") returned 4
	[0099.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.511] lstrlenW (lpString=".bz2") returned 4
	[0099.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.511] lstrlenW (lpString=".7z") returned 3
	[0099.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0099.511] lstrlenW (lpString=".dbf") returned 4
	[0099.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0099.511] lstrlenW (lpString=".1cd") returned 4
	[0099.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0099.511] lstrlenW (lpString=".jpg") returned 4
	[0099.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.511] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.511] lstrlenW (lpString="AN04267_.WMF") returned 12
	[0099.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.512] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=7804) returned 1
	[0099.512] CloseHandle (hObject=0x1c0) returned 1
	[0099.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20
	[0099.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.512] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.512] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.513] GetLastError () returned 0x0
	[0099.513] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1e7c, lpOverlapped=0x0) returned 1
	[0099.525] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1e80, lpOverlapped=0x0) returned 1
	[0099.527] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.527] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.527] SetEndOfFile (hFile=0x160) returned 1
	[0099.527] CloseHandle (hObject=0x160) returned 1
	[0099.527] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.527] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.528] CloseHandle (hObject=0x1c0) returned 1
	[0099.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1
	[0099.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0099.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0099.529] lstrlenW (lpString=".doc") returned 4
	[0099.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.529] lstrlenW (lpString=".docx") returned 5
	[0099.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.529] lstrlenW (lpString=".pdf") returned 4
	[0099.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.529] lstrlenW (lpString=".xls") returned 4
	[0099.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.529] lstrlenW (lpString=".xlsx") returned 5
	[0099.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.529] lstrlenW (lpString=".ppt") returned 4
	[0099.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0099.529] lstrlenW (lpString=".zip") returned 4
	[0099.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.529] lstrlenW (lpString=".rar") returned 4
	[0099.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.529] lstrlenW (lpString=".bz2") returned 4
	[0099.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.529] lstrlenW (lpString=".7z") returned 3
	[0099.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0099.530] lstrlenW (lpString=".dbf") returned 4
	[0099.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0099.530] lstrlenW (lpString=".1cd") returned 4
	[0099.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0099.530] lstrlenW (lpString=".jpg") returned 4
	[0099.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0099.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0099.530] lstrlenW (lpString=".doc") returned 4
	[0099.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.530] lstrlenW (lpString=".docx") returned 5
	[0099.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.530] lstrlenW (lpString=".pdf") returned 4
	[0099.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.530] lstrlenW (lpString=".xls") returned 4
	[0099.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.530] lstrlenW (lpString=".xlsx") returned 5
	[0099.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.531] lstrlenW (lpString=".ppt") returned 4
	[0099.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0099.531] lstrlenW (lpString=".zip") returned 4
	[0099.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.531] lstrlenW (lpString=".rar") returned 4
	[0099.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.531] lstrlenW (lpString=".bz2") returned 4
	[0099.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.531] lstrlenW (lpString=".7z") returned 3
	[0099.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0099.531] lstrlenW (lpString=".dbf") returned 4
	[0099.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0099.531] lstrlenW (lpString=".1cd") returned 4
	[0099.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0099.531] lstrlenW (lpString=".jpg") returned 4
	[0099.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.531] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.532] lstrlenW (lpString="AN04323_.WMF") returned 12
	[0099.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.541] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2492) returned 1
	[0099.541] CloseHandle (hObject=0x198) returned 1
	[0099.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20
	[0099.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.555] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.555] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.562] GetLastError () returned 0x0
	[0099.562] ReadFile (in: hFile=0x1a0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x9bc, lpOverlapped=0x0) returned 1
	[0099.563] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x9c0, lpOverlapped=0x0) returned 1
	[0099.564] ReadFile (in: hFile=0x1a0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.564] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.564] SetEndOfFile (hFile=0x184) returned 1
	[0099.568] CloseHandle (hObject=0x184) returned 1
	[0099.568] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.568] SetEndOfFile (hFile=0x1a0) returned 1
	[0099.575] CloseHandle (hObject=0x1a0) returned 1
	[0099.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1
	[0099.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0099.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0099.575] lstrlenW (lpString=".doc") returned 4
	[0099.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.575] lstrlenW (lpString=".docx") returned 5
	[0099.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.576] lstrlenW (lpString=".pdf") returned 4
	[0099.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.576] lstrlenW (lpString=".xls") returned 4
	[0099.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.576] lstrlenW (lpString=".xlsx") returned 5
	[0099.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.576] lstrlenW (lpString=".ppt") returned 4
	[0099.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0099.576] lstrlenW (lpString=".zip") returned 4
	[0099.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.576] lstrlenW (lpString=".rar") returned 4
	[0099.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.576] lstrlenW (lpString=".bz2") returned 4
	[0099.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.576] lstrlenW (lpString=".7z") returned 3
	[0099.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0099.576] lstrlenW (lpString=".dbf") returned 4
	[0099.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0099.577] lstrlenW (lpString=".1cd") returned 4
	[0099.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0099.577] lstrlenW (lpString=".jpg") returned 4
	[0099.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0099.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0099.577] lstrlenW (lpString=".doc") returned 4
	[0099.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.577] lstrlenW (lpString=".docx") returned 5
	[0099.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.577] lstrlenW (lpString=".pdf") returned 4
	[0099.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.577] lstrlenW (lpString=".xls") returned 4
	[0099.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.577] lstrlenW (lpString=".xlsx") returned 5
	[0099.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.578] lstrlenW (lpString=".ppt") returned 4
	[0099.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0099.578] lstrlenW (lpString=".zip") returned 4
	[0099.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.578] lstrlenW (lpString=".rar") returned 4
	[0099.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.578] lstrlenW (lpString=".bz2") returned 4
	[0099.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.578] lstrlenW (lpString=".7z") returned 3
	[0099.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0099.578] lstrlenW (lpString=".dbf") returned 4
	[0099.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0099.578] lstrlenW (lpString=".1cd") returned 4
	[0099.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0099.578] lstrlenW (lpString=".jpg") returned 4
	[0099.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.579] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.579] lstrlenW (lpString="AN04332_.WMF") returned 12
	[0099.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.590] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=4296) returned 1
	[0099.590] CloseHandle (hObject=0x184) returned 1
	[0099.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20
	[0099.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.601] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.601] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0099.608] GetLastError () returned 0x0
	[0099.608] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x10c8, lpOverlapped=0x0) returned 1
	[0099.611] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x10d0, lpOverlapped=0x0) returned 1
	[0099.613] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.613] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.613] SetEndOfFile (hFile=0x1cc) returned 1
	[0099.613] CloseHandle (hObject=0x1cc) returned 1
	[0099.613] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.613] SetEndOfFile (hFile=0x184) returned 1
	[0099.614] CloseHandle (hObject=0x184) returned 1
	[0099.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1
	[0099.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0099.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0099.615] lstrlenW (lpString=".doc") returned 4
	[0099.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.615] lstrlenW (lpString=".docx") returned 5
	[0099.615] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.615] lstrlenW (lpString=".pdf") returned 4
	[0099.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.615] lstrlenW (lpString=".xls") returned 4
	[0099.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.615] lstrlenW (lpString=".xlsx") returned 5
	[0099.615] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.615] lstrlenW (lpString=".ppt") returned 4
	[0099.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0099.615] lstrlenW (lpString=".zip") returned 4
	[0099.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.615] lstrlenW (lpString=".rar") returned 4
	[0099.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.615] lstrlenW (lpString=".bz2") returned 4
	[0099.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.615] lstrlenW (lpString=".7z") returned 3
	[0099.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0099.615] lstrlenW (lpString=".dbf") returned 4
	[0099.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0099.615] lstrlenW (lpString=".1cd") returned 4
	[0099.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0099.615] lstrlenW (lpString=".jpg") returned 4
	[0099.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0099.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0099.616] lstrlenW (lpString=".doc") returned 4
	[0099.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.616] lstrlenW (lpString=".docx") returned 5
	[0099.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.616] lstrlenW (lpString=".pdf") returned 4
	[0099.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.616] lstrlenW (lpString=".xls") returned 4
	[0099.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.616] lstrlenW (lpString=".xlsx") returned 5
	[0099.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.616] lstrlenW (lpString=".ppt") returned 4
	[0099.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0099.616] lstrlenW (lpString=".zip") returned 4
	[0099.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.616] lstrlenW (lpString=".rar") returned 4
	[0099.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.616] lstrlenW (lpString=".bz2") returned 4
	[0099.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.616] lstrlenW (lpString=".7z") returned 3
	[0099.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0099.616] lstrlenW (lpString=".dbf") returned 4
	[0099.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0099.616] lstrlenW (lpString=".1cd") returned 4
	[0099.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0099.616] lstrlenW (lpString=".jpg") returned 4
	[0099.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.617] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.617] lstrlenW (lpString="AN04369_.WMF") returned 12
	[0099.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.617] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=4808) returned 1
	[0099.617] CloseHandle (hObject=0x184) returned 1
	[0099.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20
	[0099.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.618] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.618] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0099.619] GetLastError () returned 0x0
	[0099.619] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x12c8, lpOverlapped=0x0) returned 1
	[0099.629] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x12d0, lpOverlapped=0x0) returned 1
	[0099.630] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.630] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.631] SetEndOfFile (hFile=0x1cc) returned 1
	[0099.631] CloseHandle (hObject=0x1cc) returned 1
	[0099.631] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.631] SetEndOfFile (hFile=0x184) returned 1
	[0099.632] CloseHandle (hObject=0x184) returned 1
	[0099.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1
	[0099.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0099.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0099.633] lstrlenW (lpString=".doc") returned 4
	[0099.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.633] lstrlenW (lpString=".docx") returned 5
	[0099.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.633] lstrlenW (lpString=".pdf") returned 4
	[0099.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.633] lstrlenW (lpString=".xls") returned 4
	[0099.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.633] lstrlenW (lpString=".xlsx") returned 5
	[0099.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.633] lstrlenW (lpString=".ppt") returned 4
	[0099.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0099.633] lstrlenW (lpString=".zip") returned 4
	[0099.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.633] lstrlenW (lpString=".rar") returned 4
	[0099.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.633] lstrlenW (lpString=".bz2") returned 4
	[0099.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.633] lstrlenW (lpString=".7z") returned 3
	[0099.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0099.633] lstrlenW (lpString=".dbf") returned 4
	[0099.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0099.633] lstrlenW (lpString=".1cd") returned 4
	[0099.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0099.634] lstrlenW (lpString=".jpg") returned 4
	[0099.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0099.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0099.634] lstrlenW (lpString=".doc") returned 4
	[0099.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.634] lstrlenW (lpString=".docx") returned 5
	[0099.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.634] lstrlenW (lpString=".pdf") returned 4
	[0099.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.634] lstrlenW (lpString=".xls") returned 4
	[0099.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.634] lstrlenW (lpString=".xlsx") returned 5
	[0099.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.634] lstrlenW (lpString=".ppt") returned 4
	[0099.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0099.634] lstrlenW (lpString=".zip") returned 4
	[0099.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.634] lstrlenW (lpString=".rar") returned 4
	[0099.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.634] lstrlenW (lpString=".bz2") returned 4
	[0099.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.634] lstrlenW (lpString=".7z") returned 3
	[0099.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0099.634] lstrlenW (lpString=".dbf") returned 4
	[0099.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0099.635] lstrlenW (lpString=".1cd") returned 4
	[0099.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0099.635] lstrlenW (lpString=".jpg") returned 4
	[0099.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.635] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.635] lstrlenW (lpString="AN04385_.WMF") returned 12
	[0099.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.635] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=5004) returned 1
	[0099.636] CloseHandle (hObject=0x184) returned 1
	[0099.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20
	[0099.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.636] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.636] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0099.637] GetLastError () returned 0x0
	[0099.637] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x138c, lpOverlapped=0x0) returned 1
	[0099.645] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1390, lpOverlapped=0x0) returned 1
	[0099.646] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.646] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.646] SetEndOfFile (hFile=0x1cc) returned 1
	[0099.646] CloseHandle (hObject=0x1cc) returned 1
	[0099.646] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.646] SetEndOfFile (hFile=0x184) returned 1
	[0099.647] CloseHandle (hObject=0x184) returned 1
	[0099.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1
	[0099.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0099.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0099.649] lstrlenW (lpString=".doc") returned 4
	[0099.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.649] lstrlenW (lpString=".docx") returned 5
	[0099.649] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.649] lstrlenW (lpString=".pdf") returned 4
	[0099.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.649] lstrlenW (lpString=".xls") returned 4
	[0099.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.649] lstrlenW (lpString=".xlsx") returned 5
	[0099.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.649] lstrlenW (lpString=".ppt") returned 4
	[0099.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0099.649] lstrlenW (lpString=".zip") returned 4
	[0099.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.649] lstrlenW (lpString=".rar") returned 4
	[0099.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.649] lstrlenW (lpString=".bz2") returned 4
	[0099.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.649] lstrlenW (lpString=".7z") returned 3
	[0099.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0099.649] lstrlenW (lpString=".dbf") returned 4
	[0099.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0099.650] lstrlenW (lpString=".1cd") returned 4
	[0099.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0099.650] lstrlenW (lpString=".jpg") returned 4
	[0099.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0099.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0099.650] lstrlenW (lpString=".doc") returned 4
	[0099.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.650] lstrlenW (lpString=".docx") returned 5
	[0099.650] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.650] lstrlenW (lpString=".pdf") returned 4
	[0099.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.650] lstrlenW (lpString=".xls") returned 4
	[0099.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.650] lstrlenW (lpString=".xlsx") returned 5
	[0099.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.650] lstrlenW (lpString=".ppt") returned 4
	[0099.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0099.650] lstrlenW (lpString=".zip") returned 4
	[0099.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.650] lstrlenW (lpString=".rar") returned 4
	[0099.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.650] lstrlenW (lpString=".bz2") returned 4
	[0099.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.651] lstrlenW (lpString=".7z") returned 3
	[0099.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0099.651] lstrlenW (lpString=".dbf") returned 4
	[0099.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0099.651] lstrlenW (lpString=".1cd") returned 4
	[0099.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0099.651] lstrlenW (lpString=".jpg") returned 4
	[0099.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.651] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.651] lstrlenW (lpString="BD00141_.WMF") returned 12
	[0099.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.656] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=26886) returned 1
	[0099.656] CloseHandle (hObject=0x184) returned 1
	[0099.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20
	[0099.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.663] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.663] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.665] GetLastError () returned 0x0
	[0099.665] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x6906, lpOverlapped=0x0) returned 1
	[0099.676] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x6910, lpOverlapped=0x0) returned 1
	[0099.678] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.678] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.678] SetEndOfFile (hFile=0x1a0) returned 1
	[0099.678] CloseHandle (hObject=0x1a0) returned 1
	[0099.678] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.678] SetEndOfFile (hFile=0x184) returned 1
	[0099.679] CloseHandle (hObject=0x184) returned 1
	[0099.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1
	[0099.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0099.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0099.680] lstrlenW (lpString=".doc") returned 4
	[0099.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.680] lstrlenW (lpString=".docx") returned 5
	[0099.680] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.680] lstrlenW (lpString=".pdf") returned 4
	[0099.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.680] lstrlenW (lpString=".xls") returned 4
	[0099.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.680] lstrlenW (lpString=".xlsx") returned 5
	[0099.680] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.680] lstrlenW (lpString=".ppt") returned 4
	[0099.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0099.680] lstrlenW (lpString=".zip") returned 4
	[0099.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.681] lstrlenW (lpString=".rar") returned 4
	[0099.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.681] lstrlenW (lpString=".bz2") returned 4
	[0099.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.681] lstrlenW (lpString=".7z") returned 3
	[0099.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0099.681] lstrlenW (lpString=".dbf") returned 4
	[0099.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0099.681] lstrlenW (lpString=".1cd") returned 4
	[0099.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0099.681] lstrlenW (lpString=".jpg") returned 4
	[0099.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0099.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0099.681] lstrlenW (lpString=".doc") returned 4
	[0099.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.681] lstrlenW (lpString=".docx") returned 5
	[0099.681] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.681] lstrlenW (lpString=".pdf") returned 4
	[0099.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.681] lstrlenW (lpString=".xls") returned 4
	[0099.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.681] lstrlenW (lpString=".xlsx") returned 5
	[0099.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.681] lstrlenW (lpString=".ppt") returned 4
	[0099.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0099.682] lstrlenW (lpString=".zip") returned 4
	[0099.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.682] lstrlenW (lpString=".rar") returned 4
	[0099.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.682] lstrlenW (lpString=".bz2") returned 4
	[0099.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.682] lstrlenW (lpString=".7z") returned 3
	[0099.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0099.682] lstrlenW (lpString=".dbf") returned 4
	[0099.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0099.682] lstrlenW (lpString=".1cd") returned 4
	[0099.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0099.682] lstrlenW (lpString=".jpg") returned 4
	[0099.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.682] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.682] lstrlenW (lpString="BD00155_.WMF") returned 12
	[0099.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.683] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=11636) returned 1
	[0099.683] CloseHandle (hObject=0x184) returned 1
	[0099.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20
	[0099.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.683] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.683] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.685] GetLastError () returned 0x0
	[0099.685] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x2d74, lpOverlapped=0x0) returned 1
	[0099.694] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2d80, lpOverlapped=0x0) returned 1
	[0099.695] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.695] WriteFile (in: hFile=0x1a0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.696] SetEndOfFile (hFile=0x1a0) returned 1
	[0099.696] CloseHandle (hObject=0x1a0) returned 1
	[0099.696] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.696] SetEndOfFile (hFile=0x184) returned 1
	[0099.697] CloseHandle (hObject=0x184) returned 1
	[0099.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1
	[0099.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0099.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0099.698] lstrlenW (lpString=".doc") returned 4
	[0099.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.698] lstrlenW (lpString=".docx") returned 5
	[0099.698] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.698] lstrlenW (lpString=".pdf") returned 4
	[0099.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.698] lstrlenW (lpString=".xls") returned 4
	[0099.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.698] lstrlenW (lpString=".xlsx") returned 5
	[0099.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.698] lstrlenW (lpString=".ppt") returned 4
	[0099.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0099.699] lstrlenW (lpString=".zip") returned 4
	[0099.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.699] lstrlenW (lpString=".rar") returned 4
	[0099.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.699] lstrlenW (lpString=".bz2") returned 4
	[0099.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.699] lstrlenW (lpString=".7z") returned 3
	[0099.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0099.699] lstrlenW (lpString=".dbf") returned 4
	[0099.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0099.699] lstrlenW (lpString=".1cd") returned 4
	[0099.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0099.699] lstrlenW (lpString=".jpg") returned 4
	[0099.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0099.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0099.699] lstrlenW (lpString=".doc") returned 4
	[0099.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.699] lstrlenW (lpString=".docx") returned 5
	[0099.699] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.699] lstrlenW (lpString=".pdf") returned 4
	[0099.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.699] lstrlenW (lpString=".xls") returned 4
	[0099.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.699] lstrlenW (lpString=".xlsx") returned 5
	[0099.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.700] lstrlenW (lpString=".ppt") returned 4
	[0099.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0099.700] lstrlenW (lpString=".zip") returned 4
	[0099.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.700] lstrlenW (lpString=".rar") returned 4
	[0099.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.700] lstrlenW (lpString=".bz2") returned 4
	[0099.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.700] lstrlenW (lpString=".7z") returned 3
	[0099.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0099.700] lstrlenW (lpString=".dbf") returned 4
	[0099.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0099.700] lstrlenW (lpString=".1cd") returned 4
	[0099.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0099.700] lstrlenW (lpString=".jpg") returned 4
	[0099.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.700] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.700] lstrlenW (lpString="BD00173_.WMF") returned 12
	[0099.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.747] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=16180) returned 1
	[0099.747] CloseHandle (hObject=0x184) returned 1
	[0099.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20
	[0099.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.761] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.761] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.764] GetLastError () returned 0x0
	[0099.764] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x3f34, lpOverlapped=0x0) returned 1
	[0099.775] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x3f40, lpOverlapped=0x0) returned 1
	[0099.776] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.776] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.776] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.779] CloseHandle (hObject=0x1c0) returned 1
	[0099.779] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.779] SetEndOfFile (hFile=0x190) returned 1
	[0099.780] CloseHandle (hObject=0x190) returned 1
	[0099.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1
	[0099.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0099.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0099.781] lstrlenW (lpString=".doc") returned 4
	[0099.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.781] lstrlenW (lpString=".docx") returned 5
	[0099.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.781] lstrlenW (lpString=".pdf") returned 4
	[0099.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.781] lstrlenW (lpString=".xls") returned 4
	[0099.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.781] lstrlenW (lpString=".xlsx") returned 5
	[0099.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.781] lstrlenW (lpString=".ppt") returned 4
	[0099.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0099.781] lstrlenW (lpString=".zip") returned 4
	[0099.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.781] lstrlenW (lpString=".rar") returned 4
	[0099.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.781] lstrlenW (lpString=".bz2") returned 4
	[0099.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.781] lstrlenW (lpString=".7z") returned 3
	[0099.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0099.781] lstrlenW (lpString=".dbf") returned 4
	[0099.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0099.781] lstrlenW (lpString=".1cd") returned 4
	[0099.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0099.781] lstrlenW (lpString=".jpg") returned 4
	[0099.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0099.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0099.782] lstrlenW (lpString=".doc") returned 4
	[0099.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.782] lstrlenW (lpString=".docx") returned 5
	[0099.782] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.782] lstrlenW (lpString=".pdf") returned 4
	[0099.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.782] lstrlenW (lpString=".xls") returned 4
	[0099.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.782] lstrlenW (lpString=".xlsx") returned 5
	[0099.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.782] lstrlenW (lpString=".ppt") returned 4
	[0099.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0099.782] lstrlenW (lpString=".zip") returned 4
	[0099.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.782] lstrlenW (lpString=".rar") returned 4
	[0099.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.782] lstrlenW (lpString=".bz2") returned 4
	[0099.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.782] lstrlenW (lpString=".7z") returned 3
	[0099.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0099.782] lstrlenW (lpString=".dbf") returned 4
	[0099.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0099.782] lstrlenW (lpString=".1cd") returned 4
	[0099.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0099.783] lstrlenW (lpString=".jpg") returned 4
	[0099.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.783] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.783] lstrlenW (lpString="BD06102_.WMF") returned 12
	[0099.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.784] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=16112) returned 1
	[0099.784] CloseHandle (hObject=0x190) returned 1
	[0099.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20
	[0099.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.784] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.784] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.785] GetLastError () returned 0x0
	[0099.785] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x3ef0, lpOverlapped=0x0) returned 1
	[0099.796] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x3f00, lpOverlapped=0x0) returned 1
	[0099.799] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.799] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.799] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.799] CloseHandle (hObject=0x1c0) returned 1
	[0099.799] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.799] SetEndOfFile (hFile=0x190) returned 1
	[0099.800] CloseHandle (hObject=0x190) returned 1
	[0099.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1
	[0099.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0099.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0099.802] lstrlenW (lpString=".doc") returned 4
	[0099.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.802] lstrlenW (lpString=".docx") returned 5
	[0099.802] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.802] lstrlenW (lpString=".pdf") returned 4
	[0099.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.802] lstrlenW (lpString=".xls") returned 4
	[0099.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.802] lstrlenW (lpString=".xlsx") returned 5
	[0099.802] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.803] lstrlenW (lpString=".ppt") returned 4
	[0099.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0099.803] lstrlenW (lpString=".zip") returned 4
	[0099.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.803] lstrlenW (lpString=".rar") returned 4
	[0099.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.803] lstrlenW (lpString=".bz2") returned 4
	[0099.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.803] lstrlenW (lpString=".7z") returned 3
	[0099.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0099.803] lstrlenW (lpString=".dbf") returned 4
	[0099.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0099.803] lstrlenW (lpString=".1cd") returned 4
	[0099.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0099.803] lstrlenW (lpString=".jpg") returned 4
	[0099.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0099.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0099.803] lstrlenW (lpString=".doc") returned 4
	[0099.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.803] lstrlenW (lpString=".docx") returned 5
	[0099.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.803] lstrlenW (lpString=".pdf") returned 4
	[0099.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.803] lstrlenW (lpString=".xls") returned 4
	[0099.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.803] lstrlenW (lpString=".xlsx") returned 5
	[0099.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.804] lstrlenW (lpString=".ppt") returned 4
	[0099.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0099.804] lstrlenW (lpString=".zip") returned 4
	[0099.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.804] lstrlenW (lpString=".rar") returned 4
	[0099.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.804] lstrlenW (lpString=".bz2") returned 4
	[0099.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.804] lstrlenW (lpString=".7z") returned 3
	[0099.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0099.804] lstrlenW (lpString=".dbf") returned 4
	[0099.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0099.804] lstrlenW (lpString=".1cd") returned 4
	[0099.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0099.804] lstrlenW (lpString=".jpg") returned 4
	[0099.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.804] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.804] lstrlenW (lpString="BD07761_.WMF") returned 12
	[0099.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.812] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=26748) returned 1
	[0099.812] CloseHandle (hObject=0x190) returned 1
	[0099.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20
	[0099.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.855] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.855] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.858] GetLastError () returned 0x0
	[0099.858] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x687c, lpOverlapped=0x0) returned 1
	[0099.870] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x6880, lpOverlapped=0x0) returned 1
	[0099.871] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.872] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.872] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.872] CloseHandle (hObject=0x1c0) returned 1
	[0099.872] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.872] SetEndOfFile (hFile=0x160) returned 1
	[0099.873] CloseHandle (hObject=0x160) returned 1
	[0099.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1
	[0099.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0099.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0099.873] lstrlenW (lpString=".doc") returned 4
	[0099.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.873] lstrlenW (lpString=".docx") returned 5
	[0099.874] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.874] lstrlenW (lpString=".pdf") returned 4
	[0099.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.874] lstrlenW (lpString=".xls") returned 4
	[0099.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.874] lstrlenW (lpString=".xlsx") returned 5
	[0099.874] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.874] lstrlenW (lpString=".ppt") returned 4
	[0099.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0099.874] lstrlenW (lpString=".zip") returned 4
	[0099.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.874] lstrlenW (lpString=".rar") returned 4
	[0099.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.874] lstrlenW (lpString=".bz2") returned 4
	[0099.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.874] lstrlenW (lpString=".7z") returned 3
	[0099.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0099.874] lstrlenW (lpString=".dbf") returned 4
	[0099.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0099.874] lstrlenW (lpString=".1cd") returned 4
	[0099.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0099.874] lstrlenW (lpString=".jpg") returned 4
	[0099.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0099.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0099.875] lstrlenW (lpString=".doc") returned 4
	[0099.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.875] lstrlenW (lpString=".docx") returned 5
	[0099.875] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.875] lstrlenW (lpString=".pdf") returned 4
	[0099.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.875] lstrlenW (lpString=".xls") returned 4
	[0099.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.875] lstrlenW (lpString=".xlsx") returned 5
	[0099.875] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.875] lstrlenW (lpString=".ppt") returned 4
	[0099.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0099.875] lstrlenW (lpString=".zip") returned 4
	[0099.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.875] lstrlenW (lpString=".rar") returned 4
	[0099.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.875] lstrlenW (lpString=".bz2") returned 4
	[0099.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.875] lstrlenW (lpString=".7z") returned 3
	[0099.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0099.875] lstrlenW (lpString=".dbf") returned 4
	[0099.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0099.875] lstrlenW (lpString=".1cd") returned 4
	[0099.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0099.876] lstrlenW (lpString=".jpg") returned 4
	[0099.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.876] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.876] lstrlenW (lpString="BD07831_.WMF") returned 12
	[0099.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0099.885] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=4066) returned 1
	[0099.885] CloseHandle (hObject=0x1cc) returned 1
	[0099.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20
	[0099.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.919] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.919] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0099.927] GetLastError () returned 0x0
	[0099.927] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xfe2, lpOverlapped=0x0) returned 1
	[0099.931] WriteFile (in: hFile=0x170, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xff0, lpOverlapped=0x0) returned 1
	[0099.932] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.932] WriteFile (in: hFile=0x170, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.932] SetEndOfFile (hFile=0x170) returned 1
	[0099.932] CloseHandle (hObject=0x170) returned 1
	[0099.932] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.932] SetEndOfFile (hFile=0x160) returned 1
	[0099.933] CloseHandle (hObject=0x160) returned 1
	[0099.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1
	[0099.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0099.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0099.934] lstrlenW (lpString=".doc") returned 4
	[0099.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.934] lstrlenW (lpString=".docx") returned 5
	[0099.934] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.934] lstrlenW (lpString=".pdf") returned 4
	[0099.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.934] lstrlenW (lpString=".xls") returned 4
	[0099.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.934] lstrlenW (lpString=".xlsx") returned 5
	[0099.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.934] lstrlenW (lpString=".ppt") returned 4
	[0099.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0099.934] lstrlenW (lpString=".zip") returned 4
	[0099.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.934] lstrlenW (lpString=".rar") returned 4
	[0099.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.934] lstrlenW (lpString=".bz2") returned 4
	[0099.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.934] lstrlenW (lpString=".7z") returned 3
	[0099.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0099.934] lstrlenW (lpString=".dbf") returned 4
	[0099.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0099.934] lstrlenW (lpString=".1cd") returned 4
	[0099.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0099.934] lstrlenW (lpString=".jpg") returned 4
	[0099.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0099.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0099.935] lstrlenW (lpString=".doc") returned 4
	[0099.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.935] lstrlenW (lpString=".docx") returned 5
	[0099.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.935] lstrlenW (lpString=".pdf") returned 4
	[0099.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.935] lstrlenW (lpString=".xls") returned 4
	[0099.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.935] lstrlenW (lpString=".xlsx") returned 5
	[0099.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.935] lstrlenW (lpString=".ppt") returned 4
	[0099.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0099.935] lstrlenW (lpString=".zip") returned 4
	[0099.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.935] lstrlenW (lpString=".rar") returned 4
	[0099.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.935] lstrlenW (lpString=".bz2") returned 4
	[0099.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.935] lstrlenW (lpString=".7z") returned 3
	[0099.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0099.935] lstrlenW (lpString=".dbf") returned 4
	[0099.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0099.935] lstrlenW (lpString=".1cd") returned 4
	[0099.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0099.936] lstrlenW (lpString=".jpg") returned 4
	[0099.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.936] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.936] lstrlenW (lpString="BD08773_.WMF") returned 12
	[0099.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.936] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=24778) returned 1
	[0099.936] CloseHandle (hObject=0x160) returned 1
	[0099.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20
	[0099.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.937] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.937] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0099.938] GetLastError () returned 0x0
	[0099.938] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x60ca, lpOverlapped=0x0) returned 1
	[0099.948] WriteFile (in: hFile=0x170, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x60d0, lpOverlapped=0x0) returned 1
	[0099.950] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.950] WriteFile (in: hFile=0x170, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.950] SetEndOfFile (hFile=0x170) returned 1
	[0099.950] CloseHandle (hObject=0x170) returned 1
	[0099.950] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.950] SetEndOfFile (hFile=0x160) returned 1
	[0099.951] CloseHandle (hObject=0x160) returned 1
	[0099.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1
	[0099.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0099.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0099.952] lstrlenW (lpString=".doc") returned 4
	[0099.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.952] lstrlenW (lpString=".docx") returned 5
	[0099.952] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.952] lstrlenW (lpString=".pdf") returned 4
	[0099.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.952] lstrlenW (lpString=".xls") returned 4
	[0099.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.952] lstrlenW (lpString=".xlsx") returned 5
	[0099.952] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.952] lstrlenW (lpString=".ppt") returned 4
	[0099.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0099.952] lstrlenW (lpString=".zip") returned 4
	[0099.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.952] lstrlenW (lpString=".rar") returned 4
	[0099.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.952] lstrlenW (lpString=".bz2") returned 4
	[0099.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.952] lstrlenW (lpString=".7z") returned 3
	[0099.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0099.952] lstrlenW (lpString=".dbf") returned 4
	[0099.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0099.952] lstrlenW (lpString=".1cd") returned 4
	[0099.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0099.953] lstrlenW (lpString=".jpg") returned 4
	[0099.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0099.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0099.953] lstrlenW (lpString=".doc") returned 4
	[0099.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.953] lstrlenW (lpString=".docx") returned 5
	[0099.953] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.953] lstrlenW (lpString=".pdf") returned 4
	[0099.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.953] lstrlenW (lpString=".xls") returned 4
	[0099.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.953] lstrlenW (lpString=".xlsx") returned 5
	[0099.953] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.953] lstrlenW (lpString=".ppt") returned 4
	[0099.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0099.953] lstrlenW (lpString=".zip") returned 4
	[0099.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.953] lstrlenW (lpString=".rar") returned 4
	[0099.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.953] lstrlenW (lpString=".bz2") returned 4
	[0099.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.953] lstrlenW (lpString=".7z") returned 3
	[0099.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0099.953] lstrlenW (lpString=".dbf") returned 4
	[0099.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0099.954] lstrlenW (lpString=".1cd") returned 4
	[0099.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0099.954] lstrlenW (lpString=".jpg") returned 4
	[0099.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.954] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.954] lstrlenW (lpString="BD08868_.WMF") returned 12
	[0099.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.954] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=40206) returned 1
	[0099.955] CloseHandle (hObject=0x160) returned 1
	[0099.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20
	[0099.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.955] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.955] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0099.956] GetLastError () returned 0x0
	[0099.956] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x9d0e, lpOverlapped=0x0) returned 1
	[0099.970] WriteFile (in: hFile=0x170, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x9d10, lpOverlapped=0x0) returned 1
	[0099.972] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.972] WriteFile (in: hFile=0x170, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.972] SetEndOfFile (hFile=0x170) returned 1
	[0099.972] CloseHandle (hObject=0x170) returned 1
	[0099.972] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.972] SetEndOfFile (hFile=0x160) returned 1
	[0099.973] CloseHandle (hObject=0x160) returned 1
	[0099.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1
	[0099.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0099.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0099.974] lstrlenW (lpString=".doc") returned 4
	[0099.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.974] lstrlenW (lpString=".docx") returned 5
	[0099.974] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.974] lstrlenW (lpString=".pdf") returned 4
	[0099.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.974] lstrlenW (lpString=".xls") returned 4
	[0099.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.974] lstrlenW (lpString=".xlsx") returned 5
	[0099.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.974] lstrlenW (lpString=".ppt") returned 4
	[0099.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0099.975] lstrlenW (lpString=".zip") returned 4
	[0099.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.975] lstrlenW (lpString=".rar") returned 4
	[0099.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.975] lstrlenW (lpString=".bz2") returned 4
	[0099.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.975] lstrlenW (lpString=".7z") returned 3
	[0099.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0099.975] lstrlenW (lpString=".dbf") returned 4
	[0099.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0099.975] lstrlenW (lpString=".1cd") returned 4
	[0099.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0099.975] lstrlenW (lpString=".jpg") returned 4
	[0099.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0099.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0099.975] lstrlenW (lpString=".doc") returned 4
	[0099.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.975] lstrlenW (lpString=".docx") returned 5
	[0099.975] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.975] lstrlenW (lpString=".pdf") returned 4
	[0099.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.976] lstrlenW (lpString=".xls") returned 4
	[0099.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.976] lstrlenW (lpString=".xlsx") returned 5
	[0099.976] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.976] lstrlenW (lpString=".ppt") returned 4
	[0099.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0099.976] lstrlenW (lpString=".zip") returned 4
	[0099.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.976] lstrlenW (lpString=".rar") returned 4
	[0099.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.976] lstrlenW (lpString=".bz2") returned 4
	[0099.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.976] lstrlenW (lpString=".7z") returned 3
	[0099.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0099.976] lstrlenW (lpString=".dbf") returned 4
	[0099.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0099.976] lstrlenW (lpString=".1cd") returned 4
	[0099.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0099.976] lstrlenW (lpString=".jpg") returned 4
	[0099.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.977] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.977] lstrlenW (lpString="BD09194_.WMF") returned 12
	[0099.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.977] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=14540) returned 1
	[0099.977] CloseHandle (hObject=0x160) returned 1
	[0099.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20
	[0099.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.978] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.978] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0099.988] GetLastError () returned 0x0
	[0099.988] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x38cc, lpOverlapped=0x0) returned 1
	[0100.001] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x38d0, lpOverlapped=0x0) returned 1
	[0100.002] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.003] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.003] SetEndOfFile (hFile=0x1cc) returned 1
	[0100.003] CloseHandle (hObject=0x1cc) returned 1
	[0100.003] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.003] SetEndOfFile (hFile=0x160) returned 1
	[0100.004] CloseHandle (hObject=0x160) returned 1
	[0100.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1
	[0100.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0100.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0100.005] lstrlenW (lpString=".doc") returned 4
	[0100.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.005] lstrlenW (lpString=".docx") returned 5
	[0100.005] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.005] lstrlenW (lpString=".pdf") returned 4
	[0100.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.005] lstrlenW (lpString=".xls") returned 4
	[0100.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.005] lstrlenW (lpString=".xlsx") returned 5
	[0100.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.005] lstrlenW (lpString=".ppt") returned 4
	[0100.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0100.005] lstrlenW (lpString=".zip") returned 4
	[0100.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.005] lstrlenW (lpString=".rar") returned 4
	[0100.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.005] lstrlenW (lpString=".bz2") returned 4
	[0100.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.005] lstrlenW (lpString=".7z") returned 3
	[0100.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0100.006] lstrlenW (lpString=".dbf") returned 4
	[0100.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0100.006] lstrlenW (lpString=".1cd") returned 4
	[0100.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0100.006] lstrlenW (lpString=".jpg") returned 4
	[0100.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0100.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0100.006] lstrlenW (lpString=".doc") returned 4
	[0100.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.006] lstrlenW (lpString=".docx") returned 5
	[0100.006] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.006] lstrlenW (lpString=".pdf") returned 4
	[0100.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.006] lstrlenW (lpString=".xls") returned 4
	[0100.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.006] lstrlenW (lpString=".xlsx") returned 5
	[0100.006] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.006] lstrlenW (lpString=".ppt") returned 4
	[0100.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0100.006] lstrlenW (lpString=".zip") returned 4
	[0100.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.007] lstrlenW (lpString=".rar") returned 4
	[0100.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.007] lstrlenW (lpString=".bz2") returned 4
	[0100.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.007] lstrlenW (lpString=".7z") returned 3
	[0100.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0100.007] lstrlenW (lpString=".dbf") returned 4
	[0100.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0100.007] lstrlenW (lpString=".1cd") returned 4
	[0100.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0100.007] lstrlenW (lpString=".jpg") returned 4
	[0100.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.007] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.007] lstrlenW (lpString="BD09664_.WMF") returned 12
	[0100.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0100.008] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=7966) returned 1
	[0100.008] CloseHandle (hObject=0x160) returned 1
	[0100.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20
	[0100.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0100.008] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.009] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0100.009] GetLastError () returned 0x0
	[0100.009] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1f1e, lpOverlapped=0x0) returned 1
	[0100.022] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1f20, lpOverlapped=0x0) returned 1
	[0100.023] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.023] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.023] SetEndOfFile (hFile=0x1cc) returned 1
	[0100.023] CloseHandle (hObject=0x1cc) returned 1
	[0100.023] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.023] SetEndOfFile (hFile=0x160) returned 1
	[0100.024] CloseHandle (hObject=0x160) returned 1
	[0100.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1
	[0100.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0100.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0100.025] lstrlenW (lpString=".doc") returned 4
	[0100.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.025] lstrlenW (lpString=".docx") returned 5
	[0100.025] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.025] lstrlenW (lpString=".pdf") returned 4
	[0100.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.025] lstrlenW (lpString=".xls") returned 4
	[0100.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.025] lstrlenW (lpString=".xlsx") returned 5
	[0100.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.025] lstrlenW (lpString=".ppt") returned 4
	[0100.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0100.026] lstrlenW (lpString=".zip") returned 4
	[0100.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.026] lstrlenW (lpString=".rar") returned 4
	[0100.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.026] lstrlenW (lpString=".bz2") returned 4
	[0100.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.026] lstrlenW (lpString=".7z") returned 3
	[0100.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0100.026] lstrlenW (lpString=".dbf") returned 4
	[0100.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0100.026] lstrlenW (lpString=".1cd") returned 4
	[0100.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0100.026] lstrlenW (lpString=".jpg") returned 4
	[0100.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0100.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0100.026] lstrlenW (lpString=".doc") returned 4
	[0100.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.026] lstrlenW (lpString=".docx") returned 5
	[0100.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.026] lstrlenW (lpString=".pdf") returned 4
	[0100.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.027] lstrlenW (lpString=".xls") returned 4
	[0100.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.027] lstrlenW (lpString=".xlsx") returned 5
	[0100.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.027] lstrlenW (lpString=".ppt") returned 4
	[0100.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0100.027] lstrlenW (lpString=".zip") returned 4
	[0100.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.027] lstrlenW (lpString=".rar") returned 4
	[0100.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.027] lstrlenW (lpString=".bz2") returned 4
	[0100.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.027] lstrlenW (lpString=".7z") returned 3
	[0100.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0100.027] lstrlenW (lpString=".dbf") returned 4
	[0100.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0100.027] lstrlenW (lpString=".1cd") returned 4
	[0100.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0100.027] lstrlenW (lpString=".jpg") returned 4
	[0100.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.028] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0100.028] lstrlenW (lpString="BD10972_.GIF") returned 12
	[0100.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.042] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=20189) returned 1
	[0100.042] CloseHandle (hObject=0x174) returned 1
	[0100.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20
	[0100.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0100.053] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.053] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.058] GetLastError () returned 0x0
	[0100.058] ReadFile (in: hFile=0x170, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x4edd, lpOverlapped=0x0) returned 1
	[0100.062] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x4ee0, lpOverlapped=0x0) returned 1
	[0100.064] ReadFile (in: hFile=0x170, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.064] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.064] SetEndOfFile (hFile=0x184) returned 1
	[0100.064] CloseHandle (hObject=0x184) returned 1
	[0100.064] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.064] SetEndOfFile (hFile=0x170) returned 1
	[0100.065] CloseHandle (hObject=0x170) returned 1
	[0100.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1
	[0100.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0100.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0100.066] lstrlenW (lpString=".doc") returned 4
	[0100.066] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0100.066] lstrlenW (lpString=".docx") returned 5
	[0100.066] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0100.066] lstrlenW (lpString=".pdf") returned 4
	[0100.066] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0100.066] lstrlenW (lpString=".xls") returned 4
	[0100.066] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0100.066] lstrlenW (lpString=".xlsx") returned 5
	[0100.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0100.066] lstrlenW (lpString=".ppt") returned 4
	[0100.066] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0100.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0100.067] lstrlenW (lpString=".zip") returned 4
	[0100.067] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0100.067] lstrlenW (lpString=".rar") returned 4
	[0100.067] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0100.067] lstrlenW (lpString=".bz2") returned 4
	[0100.067] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0100.067] lstrlenW (lpString=".7z") returned 3
	[0100.067] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0100.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0100.067] lstrlenW (lpString=".dbf") returned 4
	[0100.067] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0100.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0100.067] lstrlenW (lpString=".1cd") returned 4
	[0100.067] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0100.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0100.067] lstrlenW (lpString=".jpg") returned 4
	[0100.067] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0100.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0100.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0100.067] lstrlenW (lpString=".doc") returned 4
	[0100.067] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0100.067] lstrlenW (lpString=".docx") returned 5
	[0100.067] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0100.067] lstrlenW (lpString=".pdf") returned 4
	[0100.067] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0100.067] lstrlenW (lpString=".xls") returned 4
	[0100.067] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0100.067] lstrlenW (lpString=".xlsx") returned 5
	[0100.067] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0100.068] lstrlenW (lpString=".ppt") returned 4
	[0100.068] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0100.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0100.068] lstrlenW (lpString=".zip") returned 4
	[0100.068] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0100.068] lstrlenW (lpString=".rar") returned 4
	[0100.068] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0100.068] lstrlenW (lpString=".bz2") returned 4
	[0100.068] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0100.068] lstrlenW (lpString=".7z") returned 3
	[0100.068] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0100.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0100.068] lstrlenW (lpString=".dbf") returned 4
	[0100.068] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0100.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0100.068] lstrlenW (lpString=".1cd") returned 4
	[0100.068] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0100.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0100.068] lstrlenW (lpString=".jpg") returned 4
	[0100.068] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0100.068] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0100.068] lstrlenW (lpString="BD19582_.GIF") returned 12
	[0100.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0100.069] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=15733) returned 1
	[0100.069] CloseHandle (hObject=0x170) returned 1
	[0100.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20
	[0100.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0100.070] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.070] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.070] GetLastError () returned 0x0
	[0100.070] ReadFile (in: hFile=0x170, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x3d75, lpOverlapped=0x0) returned 1
	[0100.082] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x3d80, lpOverlapped=0x0) returned 1
	[0100.083] ReadFile (in: hFile=0x170, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.083] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.083] SetEndOfFile (hFile=0x184) returned 1
	[0100.083] CloseHandle (hObject=0x184) returned 1
	[0100.084] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.084] SetEndOfFile (hFile=0x170) returned 1
	[0100.084] CloseHandle (hObject=0x170) returned 1
	[0100.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1
	[0100.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0100.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0100.085] lstrlenW (lpString=".doc") returned 4
	[0100.085] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0100.085] lstrlenW (lpString=".docx") returned 5
	[0100.085] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0100.085] lstrlenW (lpString=".pdf") returned 4
	[0100.085] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0100.085] lstrlenW (lpString=".xls") returned 4
	[0100.085] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0100.085] lstrlenW (lpString=".xlsx") returned 5
	[0100.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0100.085] lstrlenW (lpString=".ppt") returned 4
	[0100.085] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0100.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0100.086] lstrlenW (lpString=".zip") returned 4
	[0100.086] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0100.086] lstrlenW (lpString=".rar") returned 4
	[0100.086] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0100.086] lstrlenW (lpString=".bz2") returned 4
	[0100.086] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0100.086] lstrlenW (lpString=".7z") returned 3
	[0100.086] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0100.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0100.086] lstrlenW (lpString=".dbf") returned 4
	[0100.086] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0100.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0100.086] lstrlenW (lpString=".1cd") returned 4
	[0100.086] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0100.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0100.086] lstrlenW (lpString=".jpg") returned 4
	[0100.086] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0100.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0100.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0100.086] lstrlenW (lpString=".doc") returned 4
	[0100.086] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0100.086] lstrlenW (lpString=".docx") returned 5
	[0100.086] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0100.086] lstrlenW (lpString=".pdf") returned 4
	[0100.086] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0100.086] lstrlenW (lpString=".xls") returned 4
	[0100.086] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0100.086] lstrlenW (lpString=".xlsx") returned 5
	[0100.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0100.087] lstrlenW (lpString=".ppt") returned 4
	[0100.087] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0100.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0100.087] lstrlenW (lpString=".zip") returned 4
	[0100.087] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0100.087] lstrlenW (lpString=".rar") returned 4
	[0100.087] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0100.087] lstrlenW (lpString=".bz2") returned 4
	[0100.087] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0100.087] lstrlenW (lpString=".7z") returned 3
	[0100.087] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0100.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0100.087] lstrlenW (lpString=".dbf") returned 4
	[0100.087] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0100.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0100.087] lstrlenW (lpString=".1cd") returned 4
	[0100.087] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0100.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0100.087] lstrlenW (lpString=".jpg") returned 4
	[0100.087] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0100.087] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.088] lstrlenW (lpString="BD19827_.WMF") returned 12
	[0100.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0100.088] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=9710) returned 1
	[0100.088] CloseHandle (hObject=0x170) returned 1
	[0100.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20
	[0100.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0100.089] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.089] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.090] GetLastError () returned 0x0
	[0100.090] ReadFile (in: hFile=0x170, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x25ee, lpOverlapped=0x0) returned 1
	[0100.100] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x25f0, lpOverlapped=0x0) returned 1
	[0100.101] ReadFile (in: hFile=0x170, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.101] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.101] SetEndOfFile (hFile=0x184) returned 1
	[0100.102] CloseHandle (hObject=0x184) returned 1
	[0100.102] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.102] SetEndOfFile (hFile=0x170) returned 1
	[0100.103] CloseHandle (hObject=0x170) returned 1
	[0100.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1
	[0100.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0100.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0100.103] lstrlenW (lpString=".doc") returned 4
	[0100.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.103] lstrlenW (lpString=".docx") returned 5
	[0100.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.103] lstrlenW (lpString=".pdf") returned 4
	[0100.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.103] lstrlenW (lpString=".xls") returned 4
	[0100.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.103] lstrlenW (lpString=".xlsx") returned 5
	[0100.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.103] lstrlenW (lpString=".ppt") returned 4
	[0100.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0100.104] lstrlenW (lpString=".zip") returned 4
	[0100.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.104] lstrlenW (lpString=".rar") returned 4
	[0100.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.104] lstrlenW (lpString=".bz2") returned 4
	[0100.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.104] lstrlenW (lpString=".7z") returned 3
	[0100.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0100.104] lstrlenW (lpString=".dbf") returned 4
	[0100.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0100.104] lstrlenW (lpString=".1cd") returned 4
	[0100.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0100.104] lstrlenW (lpString=".jpg") returned 4
	[0100.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0100.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0100.104] lstrlenW (lpString=".doc") returned 4
	[0100.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.104] lstrlenW (lpString=".docx") returned 5
	[0100.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.104] lstrlenW (lpString=".pdf") returned 4
	[0100.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.104] lstrlenW (lpString=".xls") returned 4
	[0100.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.104] lstrlenW (lpString=".xlsx") returned 5
	[0100.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.104] lstrlenW (lpString=".ppt") returned 4
	[0100.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0100.105] lstrlenW (lpString=".zip") returned 4
	[0100.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.105] lstrlenW (lpString=".rar") returned 4
	[0100.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.105] lstrlenW (lpString=".bz2") returned 4
	[0100.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.105] lstrlenW (lpString=".7z") returned 3
	[0100.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0100.105] lstrlenW (lpString=".dbf") returned 4
	[0100.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0100.105] lstrlenW (lpString=".1cd") returned 4
	[0100.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0100.105] lstrlenW (lpString=".jpg") returned 4
	[0100.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.105] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.105] lstrlenW (lpString="BD19986_.WMF") returned 12
	[0100.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0100.106] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=14486) returned 1
	[0100.106] CloseHandle (hObject=0x170) returned 1
	[0100.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20
	[0100.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0100.107] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.107] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.108] GetLastError () returned 0x0
	[0100.108] ReadFile (in: hFile=0x170, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x3896, lpOverlapped=0x0) returned 1
	[0100.153] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x38a0, lpOverlapped=0x0) returned 1
	[0100.154] ReadFile (in: hFile=0x170, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.154] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.154] SetEndOfFile (hFile=0x184) returned 1
	[0100.154] CloseHandle (hObject=0x184) returned 1
	[0100.155] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.155] SetEndOfFile (hFile=0x170) returned 1
	[0100.155] CloseHandle (hObject=0x170) returned 1
	[0100.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1
	[0100.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0100.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0100.156] lstrlenW (lpString=".doc") returned 4
	[0100.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.156] lstrlenW (lpString=".docx") returned 5
	[0100.156] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.157] lstrlenW (lpString=".pdf") returned 4
	[0100.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.157] lstrlenW (lpString=".xls") returned 4
	[0100.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.157] lstrlenW (lpString=".xlsx") returned 5
	[0100.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.157] lstrlenW (lpString=".ppt") returned 4
	[0100.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0100.157] lstrlenW (lpString=".zip") returned 4
	[0100.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.157] lstrlenW (lpString=".rar") returned 4
	[0100.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.157] lstrlenW (lpString=".bz2") returned 4
	[0100.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.157] lstrlenW (lpString=".7z") returned 3
	[0100.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0100.157] lstrlenW (lpString=".dbf") returned 4
	[0100.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0100.157] lstrlenW (lpString=".1cd") returned 4
	[0100.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0100.157] lstrlenW (lpString=".jpg") returned 4
	[0100.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0100.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0100.157] lstrlenW (lpString=".doc") returned 4
	[0100.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.158] lstrlenW (lpString=".docx") returned 5
	[0100.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.158] lstrlenW (lpString=".pdf") returned 4
	[0100.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.158] lstrlenW (lpString=".xls") returned 4
	[0100.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.158] lstrlenW (lpString=".xlsx") returned 5
	[0100.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.158] lstrlenW (lpString=".ppt") returned 4
	[0100.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0100.158] lstrlenW (lpString=".zip") returned 4
	[0100.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.158] lstrlenW (lpString=".rar") returned 4
	[0100.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.158] lstrlenW (lpString=".bz2") returned 4
	[0100.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.158] lstrlenW (lpString=".7z") returned 3
	[0100.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0100.158] lstrlenW (lpString=".dbf") returned 4
	[0100.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0100.158] lstrlenW (lpString=".1cd") returned 4
	[0100.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0100.158] lstrlenW (lpString=".jpg") returned 4
	[0100.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.159] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.159] lstrlenW (lpString="BL00008_.WMF") returned 12
	[0100.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0100.178] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=12520) returned 1
	[0100.178] CloseHandle (hObject=0x188) returned 1
	[0100.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20
	[0100.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.194] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.194] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.198] GetLastError () returned 0x0
	[0100.198] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x30e8, lpOverlapped=0x0) returned 1
	[0100.202] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x30f0, lpOverlapped=0x0) returned 1
	[0100.204] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.204] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.204] SetEndOfFile (hFile=0x164) returned 1
	[0100.204] CloseHandle (hObject=0x164) returned 1
	[0100.204] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.204] SetEndOfFile (hFile=0x174) returned 1
	[0100.205] CloseHandle (hObject=0x174) returned 1
	[0100.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1
	[0100.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0100.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0100.206] lstrlenW (lpString=".doc") returned 4
	[0100.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.206] lstrlenW (lpString=".docx") returned 5
	[0100.206] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.206] lstrlenW (lpString=".pdf") returned 4
	[0100.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.206] lstrlenW (lpString=".xls") returned 4
	[0100.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.206] lstrlenW (lpString=".xlsx") returned 5
	[0100.206] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.206] lstrlenW (lpString=".ppt") returned 4
	[0100.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0100.206] lstrlenW (lpString=".zip") returned 4
	[0100.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.206] lstrlenW (lpString=".rar") returned 4
	[0100.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.206] lstrlenW (lpString=".bz2") returned 4
	[0100.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.206] lstrlenW (lpString=".7z") returned 3
	[0100.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0100.206] lstrlenW (lpString=".dbf") returned 4
	[0100.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0100.207] lstrlenW (lpString=".1cd") returned 4
	[0100.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0100.207] lstrlenW (lpString=".jpg") returned 4
	[0100.207] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0100.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0100.207] lstrlenW (lpString=".doc") returned 4
	[0100.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.207] lstrlenW (lpString=".docx") returned 5
	[0100.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.207] lstrlenW (lpString=".pdf") returned 4
	[0100.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.207] lstrlenW (lpString=".xls") returned 4
	[0100.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.207] lstrlenW (lpString=".xlsx") returned 5
	[0100.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.207] lstrlenW (lpString=".ppt") returned 4
	[0100.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0100.208] lstrlenW (lpString=".zip") returned 4
	[0100.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.208] lstrlenW (lpString=".rar") returned 4
	[0100.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.208] lstrlenW (lpString=".bz2") returned 4
	[0100.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.208] lstrlenW (lpString=".7z") returned 3
	[0100.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0100.208] lstrlenW (lpString=".dbf") returned 4
	[0100.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0100.208] lstrlenW (lpString=".1cd") returned 4
	[0100.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0100.208] lstrlenW (lpString=".jpg") returned 4
	[0100.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.209] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.209] lstrlenW (lpString="BL00045_.WMF") returned 12
	[0100.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.210] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=7862) returned 1
	[0100.210] CloseHandle (hObject=0x174) returned 1
	[0100.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20
	[0100.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.210] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.211] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.211] GetLastError () returned 0x0
	[0100.211] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1eb6, lpOverlapped=0x0) returned 1
	[0100.228] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1ec0, lpOverlapped=0x0) returned 1
	[0100.230] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.230] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.230] SetEndOfFile (hFile=0x164) returned 1
	[0100.230] CloseHandle (hObject=0x164) returned 1
	[0100.230] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.230] SetEndOfFile (hFile=0x174) returned 1
	[0100.231] CloseHandle (hObject=0x174) returned 1
	[0100.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1
	[0100.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0100.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0100.232] lstrlenW (lpString=".doc") returned 4
	[0100.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.232] lstrlenW (lpString=".docx") returned 5
	[0100.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.232] lstrlenW (lpString=".pdf") returned 4
	[0100.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.232] lstrlenW (lpString=".xls") returned 4
	[0100.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.232] lstrlenW (lpString=".xlsx") returned 5
	[0100.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.232] lstrlenW (lpString=".ppt") returned 4
	[0100.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0100.232] lstrlenW (lpString=".zip") returned 4
	[0100.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.232] lstrlenW (lpString=".rar") returned 4
	[0100.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.233] lstrlenW (lpString=".bz2") returned 4
	[0100.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.233] lstrlenW (lpString=".7z") returned 3
	[0100.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0100.233] lstrlenW (lpString=".dbf") returned 4
	[0100.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0100.233] lstrlenW (lpString=".1cd") returned 4
	[0100.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0100.233] lstrlenW (lpString=".jpg") returned 4
	[0100.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0100.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0100.233] lstrlenW (lpString=".doc") returned 4
	[0100.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.233] lstrlenW (lpString=".docx") returned 5
	[0100.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.233] lstrlenW (lpString=".pdf") returned 4
	[0100.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.233] lstrlenW (lpString=".xls") returned 4
	[0100.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.233] lstrlenW (lpString=".xlsx") returned 5
	[0100.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.234] lstrlenW (lpString=".ppt") returned 4
	[0100.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0100.234] lstrlenW (lpString=".zip") returned 4
	[0100.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.234] lstrlenW (lpString=".rar") returned 4
	[0100.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.234] lstrlenW (lpString=".bz2") returned 4
	[0100.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.234] lstrlenW (lpString=".7z") returned 3
	[0100.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0100.234] lstrlenW (lpString=".dbf") returned 4
	[0100.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0100.234] lstrlenW (lpString=".1cd") returned 4
	[0100.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0100.234] lstrlenW (lpString=".jpg") returned 4
	[0100.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.235] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.235] lstrlenW (lpString="BL00105_.WMF") returned 12
	[0100.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.246] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=880) returned 1
	[0100.246] CloseHandle (hObject=0x190) returned 1
	[0100.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20
	[0100.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.253] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.253] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.256] GetLastError () returned 0x0
	[0100.256] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x370, lpOverlapped=0x0) returned 1
	[0100.292] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x380, lpOverlapped=0x0) returned 1
	[0100.294] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.295] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.295] SetEndOfFile (hFile=0x174) returned 1
	[0100.295] CloseHandle (hObject=0x174) returned 1
	[0100.295] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.295] SetEndOfFile (hFile=0x190) returned 1
	[0100.296] CloseHandle (hObject=0x190) returned 1
	[0100.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1
	[0100.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0100.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0100.297] lstrlenW (lpString=".doc") returned 4
	[0100.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.297] lstrlenW (lpString=".docx") returned 5
	[0100.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.297] lstrlenW (lpString=".pdf") returned 4
	[0100.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.297] lstrlenW (lpString=".xls") returned 4
	[0100.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.297] lstrlenW (lpString=".xlsx") returned 5
	[0100.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.297] lstrlenW (lpString=".ppt") returned 4
	[0100.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0100.297] lstrlenW (lpString=".zip") returned 4
	[0100.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.297] lstrlenW (lpString=".rar") returned 4
	[0100.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.297] lstrlenW (lpString=".bz2") returned 4
	[0100.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.297] lstrlenW (lpString=".7z") returned 3
	[0100.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0100.298] lstrlenW (lpString=".dbf") returned 4
	[0100.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0100.298] lstrlenW (lpString=".1cd") returned 4
	[0100.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0100.298] lstrlenW (lpString=".jpg") returned 4
	[0100.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0100.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0100.298] lstrlenW (lpString=".doc") returned 4
	[0100.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.298] lstrlenW (lpString=".docx") returned 5
	[0100.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.298] lstrlenW (lpString=".pdf") returned 4
	[0100.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.298] lstrlenW (lpString=".xls") returned 4
	[0100.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.298] lstrlenW (lpString=".xlsx") returned 5
	[0100.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.298] lstrlenW (lpString=".ppt") returned 4
	[0100.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0100.298] lstrlenW (lpString=".zip") returned 4
	[0100.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.299] lstrlenW (lpString=".rar") returned 4
	[0100.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.299] lstrlenW (lpString=".bz2") returned 4
	[0100.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.299] lstrlenW (lpString=".7z") returned 3
	[0100.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0100.299] lstrlenW (lpString=".dbf") returned 4
	[0100.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0100.299] lstrlenW (lpString=".1cd") returned 4
	[0100.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0100.299] lstrlenW (lpString=".jpg") returned 4
	[0100.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.299] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.299] lstrlenW (lpString="BL00130_.WMF") returned 12
	[0100.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.300] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1464) returned 1
	[0100.300] CloseHandle (hObject=0x190) returned 1
	[0100.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20
	[0100.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.301] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.301] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.302] GetLastError () returned 0x0
	[0100.302] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x5b8, lpOverlapped=0x0) returned 1
	[0100.303] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0100.305] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.305] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.305] SetEndOfFile (hFile=0x174) returned 1
	[0100.305] CloseHandle (hObject=0x174) returned 1
	[0100.305] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.305] SetEndOfFile (hFile=0x190) returned 1
	[0100.306] CloseHandle (hObject=0x190) returned 1
	[0100.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1
	[0100.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0100.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0100.307] lstrlenW (lpString=".doc") returned 4
	[0100.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.307] lstrlenW (lpString=".docx") returned 5
	[0100.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.307] lstrlenW (lpString=".pdf") returned 4
	[0100.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.307] lstrlenW (lpString=".xls") returned 4
	[0100.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.307] lstrlenW (lpString=".xlsx") returned 5
	[0100.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.307] lstrlenW (lpString=".ppt") returned 4
	[0100.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0100.307] lstrlenW (lpString=".zip") returned 4
	[0100.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.307] lstrlenW (lpString=".rar") returned 4
	[0100.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.307] lstrlenW (lpString=".bz2") returned 4
	[0100.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.307] lstrlenW (lpString=".7z") returned 3
	[0100.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0100.307] lstrlenW (lpString=".dbf") returned 4
	[0100.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0100.308] lstrlenW (lpString=".1cd") returned 4
	[0100.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0100.308] lstrlenW (lpString=".jpg") returned 4
	[0100.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0100.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0100.308] lstrlenW (lpString=".doc") returned 4
	[0100.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.308] lstrlenW (lpString=".docx") returned 5
	[0100.308] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.308] lstrlenW (lpString=".pdf") returned 4
	[0100.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.308] lstrlenW (lpString=".xls") returned 4
	[0100.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.308] lstrlenW (lpString=".xlsx") returned 5
	[0100.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.308] lstrlenW (lpString=".ppt") returned 4
	[0100.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0100.308] lstrlenW (lpString=".zip") returned 4
	[0100.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.308] lstrlenW (lpString=".rar") returned 4
	[0100.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.309] lstrlenW (lpString=".bz2") returned 4
	[0100.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.309] lstrlenW (lpString=".7z") returned 3
	[0100.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0100.309] lstrlenW (lpString=".dbf") returned 4
	[0100.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0100.309] lstrlenW (lpString=".1cd") returned 4
	[0100.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0100.309] lstrlenW (lpString=".jpg") returned 4
	[0100.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.309] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.309] lstrlenW (lpString="BL00148_.WMF") returned 12
	[0100.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.310] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1696) returned 1
	[0100.310] CloseHandle (hObject=0x190) returned 1
	[0100.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20
	[0100.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.311] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.311] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.312] GetLastError () returned 0x0
	[0100.312] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x6a0, lpOverlapped=0x0) returned 1
	[0100.314] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x6b0, lpOverlapped=0x0) returned 1
	[0100.315] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.315] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.315] SetEndOfFile (hFile=0x174) returned 1
	[0100.315] CloseHandle (hObject=0x174) returned 1
	[0100.315] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.315] SetEndOfFile (hFile=0x190) returned 1
	[0100.316] CloseHandle (hObject=0x190) returned 1
	[0100.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1
	[0100.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0100.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0100.317] lstrlenW (lpString=".doc") returned 4
	[0100.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.317] lstrlenW (lpString=".docx") returned 5
	[0100.317] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.317] lstrlenW (lpString=".pdf") returned 4
	[0100.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.317] lstrlenW (lpString=".xls") returned 4
	[0100.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.317] lstrlenW (lpString=".xlsx") returned 5
	[0100.317] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.317] lstrlenW (lpString=".ppt") returned 4
	[0100.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0100.317] lstrlenW (lpString=".zip") returned 4
	[0100.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.318] lstrlenW (lpString=".rar") returned 4
	[0100.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.318] lstrlenW (lpString=".bz2") returned 4
	[0100.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.318] lstrlenW (lpString=".7z") returned 3
	[0100.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0100.318] lstrlenW (lpString=".dbf") returned 4
	[0100.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0100.318] lstrlenW (lpString=".1cd") returned 4
	[0100.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0100.318] lstrlenW (lpString=".jpg") returned 4
	[0100.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0100.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0100.318] lstrlenW (lpString=".doc") returned 4
	[0100.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.318] lstrlenW (lpString=".docx") returned 5
	[0100.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.318] lstrlenW (lpString=".pdf") returned 4
	[0100.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.319] lstrlenW (lpString=".xls") returned 4
	[0100.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.319] lstrlenW (lpString=".xlsx") returned 5
	[0100.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.319] lstrlenW (lpString=".ppt") returned 4
	[0100.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0100.319] lstrlenW (lpString=".zip") returned 4
	[0100.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.319] lstrlenW (lpString=".rar") returned 4
	[0100.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.319] lstrlenW (lpString=".bz2") returned 4
	[0100.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.319] lstrlenW (lpString=".7z") returned 3
	[0100.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0100.319] lstrlenW (lpString=".dbf") returned 4
	[0100.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0100.319] lstrlenW (lpString=".1cd") returned 4
	[0100.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0100.319] lstrlenW (lpString=".jpg") returned 4
	[0100.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.320] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.320] lstrlenW (lpString="BL00152_.WMF") returned 12
	[0100.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.320] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1516) returned 1
	[0100.321] CloseHandle (hObject=0x190) returned 1
	[0100.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20
	[0100.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.321] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.321] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.322] GetLastError () returned 0x0
	[0100.322] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x5ec, lpOverlapped=0x0) returned 1
	[0100.324] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x5f0, lpOverlapped=0x0) returned 1
	[0100.325] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.325] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.325] SetEndOfFile (hFile=0x174) returned 1
	[0100.325] CloseHandle (hObject=0x174) returned 1
	[0100.326] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.326] SetEndOfFile (hFile=0x190) returned 1
	[0100.327] CloseHandle (hObject=0x190) returned 1
	[0100.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1
	[0100.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0100.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0100.327] lstrlenW (lpString=".doc") returned 4
	[0100.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.328] lstrlenW (lpString=".docx") returned 5
	[0100.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.328] lstrlenW (lpString=".pdf") returned 4
	[0100.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.328] lstrlenW (lpString=".xls") returned 4
	[0100.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.328] lstrlenW (lpString=".xlsx") returned 5
	[0100.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.328] lstrlenW (lpString=".ppt") returned 4
	[0100.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0100.328] lstrlenW (lpString=".zip") returned 4
	[0100.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.328] lstrlenW (lpString=".rar") returned 4
	[0100.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.328] lstrlenW (lpString=".bz2") returned 4
	[0100.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.328] lstrlenW (lpString=".7z") returned 3
	[0100.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0100.328] lstrlenW (lpString=".dbf") returned 4
	[0100.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0100.328] lstrlenW (lpString=".1cd") returned 4
	[0100.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0100.328] lstrlenW (lpString=".jpg") returned 4
	[0100.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0100.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0100.331] lstrlenW (lpString=".doc") returned 4
	[0100.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.331] lstrlenW (lpString=".docx") returned 5
	[0100.331] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.331] lstrlenW (lpString=".pdf") returned 4
	[0100.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.331] lstrlenW (lpString=".xls") returned 4
	[0100.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.331] lstrlenW (lpString=".xlsx") returned 5
	[0100.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.331] lstrlenW (lpString=".ppt") returned 4
	[0100.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0100.331] lstrlenW (lpString=".zip") returned 4
	[0100.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.332] lstrlenW (lpString=".rar") returned 4
	[0100.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.332] lstrlenW (lpString=".bz2") returned 4
	[0100.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.332] lstrlenW (lpString=".7z") returned 3
	[0100.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0100.332] lstrlenW (lpString=".dbf") returned 4
	[0100.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0100.332] lstrlenW (lpString=".1cd") returned 4
	[0100.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0100.332] lstrlenW (lpString=".jpg") returned 4
	[0100.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.332] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.332] lstrlenW (lpString="BL00194_.WMF") returned 12
	[0100.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.333] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3986) returned 1
	[0100.333] CloseHandle (hObject=0x190) returned 1
	[0100.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20
	[0100.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.334] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.334] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.335] GetLastError () returned 0x0
	[0100.335] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xf92, lpOverlapped=0x0) returned 1
	[0100.337] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xfa0, lpOverlapped=0x0) returned 1
	[0100.338] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.338] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.338] SetEndOfFile (hFile=0x174) returned 1
	[0100.338] CloseHandle (hObject=0x174) returned 1
	[0100.338] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.338] SetEndOfFile (hFile=0x190) returned 1
	[0100.339] CloseHandle (hObject=0x190) returned 1
	[0100.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1
	[0100.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0100.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0100.340] lstrlenW (lpString=".doc") returned 4
	[0100.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.340] lstrlenW (lpString=".docx") returned 5
	[0100.340] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.340] lstrlenW (lpString=".pdf") returned 4
	[0100.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.340] lstrlenW (lpString=".xls") returned 4
	[0100.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.340] lstrlenW (lpString=".xlsx") returned 5
	[0100.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.340] lstrlenW (lpString=".ppt") returned 4
	[0100.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0100.341] lstrlenW (lpString=".zip") returned 4
	[0100.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.341] lstrlenW (lpString=".rar") returned 4
	[0100.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.341] lstrlenW (lpString=".bz2") returned 4
	[0100.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.341] lstrlenW (lpString=".7z") returned 3
	[0100.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0100.341] lstrlenW (lpString=".dbf") returned 4
	[0100.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0100.341] lstrlenW (lpString=".1cd") returned 4
	[0100.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0100.341] lstrlenW (lpString=".jpg") returned 4
	[0100.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0100.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0100.341] lstrlenW (lpString=".doc") returned 4
	[0100.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.341] lstrlenW (lpString=".docx") returned 5
	[0100.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.341] lstrlenW (lpString=".pdf") returned 4
	[0100.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.342] lstrlenW (lpString=".xls") returned 4
	[0100.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.342] lstrlenW (lpString=".xlsx") returned 5
	[0100.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.342] lstrlenW (lpString=".ppt") returned 4
	[0100.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0100.342] lstrlenW (lpString=".zip") returned 4
	[0100.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.342] lstrlenW (lpString=".rar") returned 4
	[0100.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.342] lstrlenW (lpString=".bz2") returned 4
	[0100.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.342] lstrlenW (lpString=".7z") returned 3
	[0100.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0100.342] lstrlenW (lpString=".dbf") returned 4
	[0100.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0100.342] lstrlenW (lpString=".1cd") returned 4
	[0100.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0100.342] lstrlenW (lpString=".jpg") returned 4
	[0100.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.343] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.343] lstrlenW (lpString="BL00195_.WMF") returned 12
	[0100.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.344] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=8070) returned 1
	[0100.344] CloseHandle (hObject=0x190) returned 1
	[0100.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20
	[0100.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.345] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.345] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.346] GetLastError () returned 0x0
	[0100.346] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1f86, lpOverlapped=0x0) returned 1
	[0100.348] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1f90, lpOverlapped=0x0) returned 1
	[0100.349] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.349] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.349] SetEndOfFile (hFile=0x174) returned 1
	[0100.349] CloseHandle (hObject=0x174) returned 1
	[0100.349] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.349] SetEndOfFile (hFile=0x190) returned 1
	[0100.350] CloseHandle (hObject=0x190) returned 1
	[0100.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1
	[0100.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0100.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0100.351] lstrlenW (lpString=".doc") returned 4
	[0100.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.351] lstrlenW (lpString=".docx") returned 5
	[0100.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.351] lstrlenW (lpString=".pdf") returned 4
	[0100.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.351] lstrlenW (lpString=".xls") returned 4
	[0100.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.351] lstrlenW (lpString=".xlsx") returned 5
	[0100.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.351] lstrlenW (lpString=".ppt") returned 4
	[0100.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0100.351] lstrlenW (lpString=".zip") returned 4
	[0100.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.352] lstrlenW (lpString=".rar") returned 4
	[0100.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.352] lstrlenW (lpString=".bz2") returned 4
	[0100.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.352] lstrlenW (lpString=".7z") returned 3
	[0100.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0100.352] lstrlenW (lpString=".dbf") returned 4
	[0100.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0100.352] lstrlenW (lpString=".1cd") returned 4
	[0100.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0100.352] lstrlenW (lpString=".jpg") returned 4
	[0100.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0100.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0100.352] lstrlenW (lpString=".doc") returned 4
	[0100.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.352] lstrlenW (lpString=".docx") returned 5
	[0100.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.352] lstrlenW (lpString=".pdf") returned 4
	[0100.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.355] lstrlenW (lpString=".xls") returned 4
	[0100.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.356] lstrlenW (lpString=".xlsx") returned 5
	[0100.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.356] lstrlenW (lpString=".ppt") returned 4
	[0100.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0100.356] lstrlenW (lpString=".zip") returned 4
	[0100.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.356] lstrlenW (lpString=".rar") returned 4
	[0100.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.356] lstrlenW (lpString=".bz2") returned 4
	[0100.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.356] lstrlenW (lpString=".7z") returned 3
	[0100.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0100.356] lstrlenW (lpString=".dbf") returned 4
	[0100.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0100.356] lstrlenW (lpString=".1cd") returned 4
	[0100.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0100.356] lstrlenW (lpString=".jpg") returned 4
	[0100.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.357] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.357] lstrlenW (lpString="BL00234_.WMF") returned 12
	[0100.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.357] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=9304) returned 1
	[0100.358] CloseHandle (hObject=0x190) returned 1
	[0100.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20
	[0100.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.358] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.358] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.359] GetLastError () returned 0x0
	[0100.359] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x2458, lpOverlapped=0x0) returned 1
	[0100.361] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2460, lpOverlapped=0x0) returned 1
	[0100.363] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.363] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.363] SetEndOfFile (hFile=0x174) returned 1
	[0100.363] CloseHandle (hObject=0x174) returned 1
	[0100.363] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.363] SetEndOfFile (hFile=0x190) returned 1
	[0100.364] CloseHandle (hObject=0x190) returned 1
	[0100.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1
	[0100.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0100.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0100.365] lstrlenW (lpString=".doc") returned 4
	[0100.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.365] lstrlenW (lpString=".docx") returned 5
	[0100.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.365] lstrlenW (lpString=".pdf") returned 4
	[0100.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.365] lstrlenW (lpString=".xls") returned 4
	[0100.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.365] lstrlenW (lpString=".xlsx") returned 5
	[0100.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.365] lstrlenW (lpString=".ppt") returned 4
	[0100.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0100.365] lstrlenW (lpString=".zip") returned 4
	[0100.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.366] lstrlenW (lpString=".rar") returned 4
	[0100.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.366] lstrlenW (lpString=".bz2") returned 4
	[0100.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.366] lstrlenW (lpString=".7z") returned 3
	[0100.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0100.366] lstrlenW (lpString=".dbf") returned 4
	[0100.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0100.366] lstrlenW (lpString=".1cd") returned 4
	[0100.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0100.366] lstrlenW (lpString=".jpg") returned 4
	[0100.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0100.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0100.366] lstrlenW (lpString=".doc") returned 4
	[0100.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.366] lstrlenW (lpString=".docx") returned 5
	[0100.366] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.366] lstrlenW (lpString=".pdf") returned 4
	[0100.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.366] lstrlenW (lpString=".xls") returned 4
	[0100.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.366] lstrlenW (lpString=".xlsx") returned 5
	[0100.367] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.367] lstrlenW (lpString=".ppt") returned 4
	[0100.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0100.367] lstrlenW (lpString=".zip") returned 4
	[0100.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.367] lstrlenW (lpString=".rar") returned 4
	[0100.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.367] lstrlenW (lpString=".bz2") returned 4
	[0100.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.367] lstrlenW (lpString=".7z") returned 3
	[0100.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0100.367] lstrlenW (lpString=".dbf") returned 4
	[0100.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0100.367] lstrlenW (lpString=".1cd") returned 4
	[0100.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0100.367] lstrlenW (lpString=".jpg") returned 4
	[0100.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.367] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.368] lstrlenW (lpString="BL00242_.WMF") returned 12
	[0100.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.368] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=4024) returned 1
	[0100.368] CloseHandle (hObject=0x190) returned 1
	[0100.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20
	[0100.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.369] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.369] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.370] GetLastError () returned 0x0
	[0100.370] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xfb8, lpOverlapped=0x0) returned 1
	[0100.372] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xfc0, lpOverlapped=0x0) returned 1
	[0100.373] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.373] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.373] SetEndOfFile (hFile=0x174) returned 1
	[0100.373] CloseHandle (hObject=0x174) returned 1
	[0100.373] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.374] SetEndOfFile (hFile=0x190) returned 1
	[0100.374] CloseHandle (hObject=0x190) returned 1
	[0100.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1
	[0100.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0100.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0100.375] lstrlenW (lpString=".doc") returned 4
	[0100.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.423] lstrlenW (lpString=".docx") returned 5
	[0100.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.423] lstrlenW (lpString=".pdf") returned 4
	[0100.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.423] lstrlenW (lpString=".xls") returned 4
	[0100.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.423] lstrlenW (lpString=".xlsx") returned 5
	[0100.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.423] lstrlenW (lpString=".ppt") returned 4
	[0100.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0100.423] lstrlenW (lpString=".zip") returned 4
	[0100.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.423] lstrlenW (lpString=".rar") returned 4
	[0100.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.423] lstrlenW (lpString=".bz2") returned 4
	[0100.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.423] lstrlenW (lpString=".7z") returned 3
	[0100.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0100.423] lstrlenW (lpString=".dbf") returned 4
	[0100.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0100.423] lstrlenW (lpString=".1cd") returned 4
	[0100.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0100.424] lstrlenW (lpString=".jpg") returned 4
	[0100.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0100.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0100.424] lstrlenW (lpString=".doc") returned 4
	[0100.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.424] lstrlenW (lpString=".docx") returned 5
	[0100.424] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.424] lstrlenW (lpString=".pdf") returned 4
	[0100.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.424] lstrlenW (lpString=".xls") returned 4
	[0100.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.424] lstrlenW (lpString=".xlsx") returned 5
	[0100.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.424] lstrlenW (lpString=".ppt") returned 4
	[0100.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0100.424] lstrlenW (lpString=".zip") returned 4
	[0100.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.424] lstrlenW (lpString=".rar") returned 4
	[0100.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.424] lstrlenW (lpString=".bz2") returned 4
	[0100.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.424] lstrlenW (lpString=".7z") returned 3
	[0100.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0100.425] lstrlenW (lpString=".dbf") returned 4
	[0100.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0100.425] lstrlenW (lpString=".1cd") returned 4
	[0100.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0100.425] lstrlenW (lpString=".jpg") returned 4
	[0100.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.425] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.425] lstrlenW (lpString="BL00261_.WMF") returned 12
	[0100.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.426] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=12482) returned 1
	[0100.426] CloseHandle (hObject=0x1c0) returned 1
	[0100.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20
	[0100.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.427] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.427] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.427] GetLastError () returned 0x0
	[0100.427] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x30c2, lpOverlapped=0x0) returned 1
	[0100.471] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x30d0, lpOverlapped=0x0) returned 1
	[0100.472] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.472] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.472] SetEndOfFile (hFile=0x164) returned 1
	[0100.472] CloseHandle (hObject=0x164) returned 1
	[0100.472] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.473] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.473] CloseHandle (hObject=0x1c0) returned 1
	[0100.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1
	[0100.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0100.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0100.474] lstrlenW (lpString=".doc") returned 4
	[0100.474] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.474] lstrlenW (lpString=".docx") returned 5
	[0100.474] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.474] lstrlenW (lpString=".pdf") returned 4
	[0100.474] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.474] lstrlenW (lpString=".xls") returned 4
	[0100.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.474] lstrlenW (lpString=".xlsx") returned 5
	[0100.474] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.474] lstrlenW (lpString=".ppt") returned 4
	[0100.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0100.475] lstrlenW (lpString=".zip") returned 4
	[0100.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.475] lstrlenW (lpString=".rar") returned 4
	[0100.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.475] lstrlenW (lpString=".bz2") returned 4
	[0100.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.475] lstrlenW (lpString=".7z") returned 3
	[0100.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0100.475] lstrlenW (lpString=".dbf") returned 4
	[0100.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0100.475] lstrlenW (lpString=".1cd") returned 4
	[0100.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0100.475] lstrlenW (lpString=".jpg") returned 4
	[0100.475] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0100.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0100.475] lstrlenW (lpString=".doc") returned 4
	[0100.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.475] lstrlenW (lpString=".docx") returned 5
	[0100.475] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.475] lstrlenW (lpString=".pdf") returned 4
	[0100.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.475] lstrlenW (lpString=".xls") returned 4
	[0100.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.476] lstrlenW (lpString=".xlsx") returned 5
	[0100.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.476] lstrlenW (lpString=".ppt") returned 4
	[0100.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0100.476] lstrlenW (lpString=".zip") returned 4
	[0100.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.476] lstrlenW (lpString=".rar") returned 4
	[0100.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.476] lstrlenW (lpString=".bz2") returned 4
	[0100.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.476] lstrlenW (lpString=".7z") returned 3
	[0100.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0100.476] lstrlenW (lpString=".dbf") returned 4
	[0100.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0100.476] lstrlenW (lpString=".1cd") returned 4
	[0100.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0100.476] lstrlenW (lpString=".jpg") returned 4
	[0100.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.476] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.476] lstrlenW (lpString="BL00270_.WMF") returned 12
	[0100.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.478] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3016) returned 1
	[0100.478] CloseHandle (hObject=0x1c0) returned 1
	[0100.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20
	[0100.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.479] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.479] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.480] GetLastError () returned 0x0
	[0100.480] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xbc8, lpOverlapped=0x0) returned 1
	[0100.488] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xbd0, lpOverlapped=0x0) returned 1
	[0100.489] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.490] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.490] SetEndOfFile (hFile=0x164) returned 1
	[0100.490] CloseHandle (hObject=0x164) returned 1
	[0100.490] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.490] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.491] CloseHandle (hObject=0x1c0) returned 1
	[0100.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 1
	[0100.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0100.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0100.492] lstrlenW (lpString=".doc") returned 4
	[0100.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.492] lstrlenW (lpString=".docx") returned 5
	[0100.492] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.492] lstrlenW (lpString=".pdf") returned 4
	[0100.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.492] lstrlenW (lpString=".xls") returned 4
	[0100.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.492] lstrlenW (lpString=".xlsx") returned 5
	[0100.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.492] lstrlenW (lpString=".ppt") returned 4
	[0100.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0100.492] lstrlenW (lpString=".zip") returned 4
	[0100.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.492] lstrlenW (lpString=".rar") returned 4
	[0100.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.492] lstrlenW (lpString=".bz2") returned 4
	[0100.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.492] lstrlenW (lpString=".7z") returned 3
	[0100.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0100.492] lstrlenW (lpString=".dbf") returned 4
	[0100.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0100.493] lstrlenW (lpString=".1cd") returned 4
	[0100.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0100.493] lstrlenW (lpString=".jpg") returned 4
	[0100.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0100.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0100.493] lstrlenW (lpString=".doc") returned 4
	[0100.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.493] lstrlenW (lpString=".docx") returned 5
	[0100.493] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.493] lstrlenW (lpString=".pdf") returned 4
	[0100.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.493] lstrlenW (lpString=".xls") returned 4
	[0100.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.493] lstrlenW (lpString=".xlsx") returned 5
	[0100.493] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.493] lstrlenW (lpString=".ppt") returned 4
	[0100.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0100.494] lstrlenW (lpString=".zip") returned 4
	[0100.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.494] lstrlenW (lpString=".rar") returned 4
	[0100.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.494] lstrlenW (lpString=".bz2") returned 4
	[0100.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.494] lstrlenW (lpString=".7z") returned 3
	[0100.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0100.494] lstrlenW (lpString=".dbf") returned 4
	[0100.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0100.494] lstrlenW (lpString=".1cd") returned 4
	[0100.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0100.494] lstrlenW (lpString=".jpg") returned 4
	[0100.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.495] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.495] lstrlenW (lpString="BL00273_.WMF") returned 12
	[0100.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.496] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3780) returned 1
	[0100.496] CloseHandle (hObject=0x1c0) returned 1
	[0100.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20
	[0100.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.497] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.497] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.497] GetLastError () returned 0x0
	[0100.497] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xec4, lpOverlapped=0x0) returned 1
	[0100.532] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xed0, lpOverlapped=0x0) returned 1
	[0100.533] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.534] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.534] SetEndOfFile (hFile=0x164) returned 1
	[0100.534] CloseHandle (hObject=0x164) returned 1
	[0100.534] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.534] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.535] CloseHandle (hObject=0x1c0) returned 1
	[0100.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1
	[0100.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0100.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0100.536] lstrlenW (lpString=".doc") returned 4
	[0100.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.536] lstrlenW (lpString=".docx") returned 5
	[0100.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.536] lstrlenW (lpString=".pdf") returned 4
	[0100.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.536] lstrlenW (lpString=".xls") returned 4
	[0100.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.536] lstrlenW (lpString=".xlsx") returned 5
	[0100.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.536] lstrlenW (lpString=".ppt") returned 4
	[0100.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0100.536] lstrlenW (lpString=".zip") returned 4
	[0100.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.536] lstrlenW (lpString=".rar") returned 4
	[0100.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.537] lstrlenW (lpString=".bz2") returned 4
	[0100.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.537] lstrlenW (lpString=".7z") returned 3
	[0100.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0100.537] lstrlenW (lpString=".dbf") returned 4
	[0100.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0100.537] lstrlenW (lpString=".1cd") returned 4
	[0100.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0100.537] lstrlenW (lpString=".jpg") returned 4
	[0100.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0100.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0100.537] lstrlenW (lpString=".doc") returned 4
	[0100.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.538] lstrlenW (lpString=".docx") returned 5
	[0100.538] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.538] lstrlenW (lpString=".pdf") returned 4
	[0100.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.538] lstrlenW (lpString=".xls") returned 4
	[0100.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.538] lstrlenW (lpString=".xlsx") returned 5
	[0100.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.538] lstrlenW (lpString=".ppt") returned 4
	[0100.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0100.538] lstrlenW (lpString=".zip") returned 4
	[0100.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.538] lstrlenW (lpString=".rar") returned 4
	[0100.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.539] lstrlenW (lpString=".bz2") returned 4
	[0100.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.539] lstrlenW (lpString=".7z") returned 3
	[0100.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0100.539] lstrlenW (lpString=".dbf") returned 4
	[0100.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0100.539] lstrlenW (lpString=".1cd") returned 4
	[0100.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0100.539] lstrlenW (lpString=".jpg") returned 4
	[0100.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.539] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.539] lstrlenW (lpString="BL00390_.WMF") returned 12
	[0100.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.541] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=13102) returned 1
	[0100.541] CloseHandle (hObject=0x1c0) returned 1
	[0100.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20
	[0100.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.542] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.542] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.543] GetLastError () returned 0x0
	[0100.543] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x332e, lpOverlapped=0x0) returned 1
	[0100.545] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x3330, lpOverlapped=0x0) returned 1
	[0100.546] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.546] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.546] SetEndOfFile (hFile=0x164) returned 1
	[0100.547] CloseHandle (hObject=0x164) returned 1
	[0100.547] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.547] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.551] CloseHandle (hObject=0x1c0) returned 1
	[0100.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1
	[0100.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0100.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0100.552] lstrlenW (lpString=".doc") returned 4
	[0100.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.552] lstrlenW (lpString=".docx") returned 5
	[0100.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.552] lstrlenW (lpString=".pdf") returned 4
	[0100.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.552] lstrlenW (lpString=".xls") returned 4
	[0100.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.552] lstrlenW (lpString=".xlsx") returned 5
	[0100.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.552] lstrlenW (lpString=".ppt") returned 4
	[0100.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0100.552] lstrlenW (lpString=".zip") returned 4
	[0100.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.553] lstrlenW (lpString=".rar") returned 4
	[0100.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.553] lstrlenW (lpString=".bz2") returned 4
	[0100.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.553] lstrlenW (lpString=".7z") returned 3
	[0100.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0100.553] lstrlenW (lpString=".dbf") returned 4
	[0100.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0100.553] lstrlenW (lpString=".1cd") returned 4
	[0100.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0100.553] lstrlenW (lpString=".jpg") returned 4
	[0100.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0100.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0100.553] lstrlenW (lpString=".doc") returned 4
	[0100.554] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.554] lstrlenW (lpString=".docx") returned 5
	[0100.554] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.554] lstrlenW (lpString=".pdf") returned 4
	[0100.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.554] lstrlenW (lpString=".xls") returned 4
	[0100.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.554] lstrlenW (lpString=".xlsx") returned 5
	[0100.554] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.554] lstrlenW (lpString=".ppt") returned 4
	[0100.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0100.554] lstrlenW (lpString=".zip") returned 4
	[0100.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.554] lstrlenW (lpString=".rar") returned 4
	[0100.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.554] lstrlenW (lpString=".bz2") returned 4
	[0100.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.554] lstrlenW (lpString=".7z") returned 3
	[0100.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0100.555] lstrlenW (lpString=".dbf") returned 4
	[0100.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0100.555] lstrlenW (lpString=".1cd") returned 4
	[0100.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0100.555] lstrlenW (lpString=".jpg") returned 4
	[0100.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.555] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.555] lstrlenW (lpString="BL00392_.WMF") returned 12
	[0100.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.556] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=27050) returned 1
	[0100.556] CloseHandle (hObject=0x1c0) returned 1
	[0100.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20
	[0100.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.557] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.557] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.558] GetLastError () returned 0x0
	[0100.558] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x69aa, lpOverlapped=0x0) returned 1
	[0100.561] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x69b0, lpOverlapped=0x0) returned 1
	[0100.562] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.562] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.562] SetEndOfFile (hFile=0x164) returned 1
	[0100.563] CloseHandle (hObject=0x164) returned 1
	[0100.563] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.563] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.564] CloseHandle (hObject=0x1c0) returned 1
	[0100.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1
	[0100.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0100.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0100.565] lstrlenW (lpString=".doc") returned 4
	[0100.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.565] lstrlenW (lpString=".docx") returned 5
	[0100.565] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.565] lstrlenW (lpString=".pdf") returned 4
	[0100.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.565] lstrlenW (lpString=".xls") returned 4
	[0100.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.565] lstrlenW (lpString=".xlsx") returned 5
	[0100.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.565] lstrlenW (lpString=".ppt") returned 4
	[0100.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0100.565] lstrlenW (lpString=".zip") returned 4
	[0100.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.566] lstrlenW (lpString=".rar") returned 4
	[0100.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.566] lstrlenW (lpString=".bz2") returned 4
	[0100.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.566] lstrlenW (lpString=".7z") returned 3
	[0100.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0100.566] lstrlenW (lpString=".dbf") returned 4
	[0100.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0100.566] lstrlenW (lpString=".1cd") returned 4
	[0100.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0100.566] lstrlenW (lpString=".jpg") returned 4
	[0100.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0100.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0100.567] lstrlenW (lpString=".doc") returned 4
	[0100.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.567] lstrlenW (lpString=".docx") returned 5
	[0100.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.567] lstrlenW (lpString=".pdf") returned 4
	[0100.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.567] lstrlenW (lpString=".xls") returned 4
	[0100.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.567] lstrlenW (lpString=".xlsx") returned 5
	[0100.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.567] lstrlenW (lpString=".ppt") returned 4
	[0100.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0100.567] lstrlenW (lpString=".zip") returned 4
	[0100.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.567] lstrlenW (lpString=".rar") returned 4
	[0100.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.567] lstrlenW (lpString=".bz2") returned 4
	[0100.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.568] lstrlenW (lpString=".7z") returned 3
	[0100.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0100.568] lstrlenW (lpString=".dbf") returned 4
	[0100.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0100.568] lstrlenW (lpString=".1cd") returned 4
	[0100.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0100.568] lstrlenW (lpString=".jpg") returned 4
	[0100.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.568] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.568] lstrlenW (lpString="BL00524_.WMF") returned 12
	[0100.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.569] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=6996) returned 1
	[0100.569] CloseHandle (hObject=0x1c0) returned 1
	[0100.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20
	[0100.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.570] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.570] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.571] GetLastError () returned 0x0
	[0100.571] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1b54, lpOverlapped=0x0) returned 1
	[0100.573] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1b60, lpOverlapped=0x0) returned 1
	[0100.574] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.574] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.574] SetEndOfFile (hFile=0x164) returned 1
	[0100.574] CloseHandle (hObject=0x164) returned 1
	[0100.575] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.575] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.576] CloseHandle (hObject=0x1c0) returned 1
	[0100.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 1
	[0100.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0100.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0100.576] lstrlenW (lpString=".doc") returned 4
	[0100.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.576] lstrlenW (lpString=".docx") returned 5
	[0100.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.577] lstrlenW (lpString=".pdf") returned 4
	[0100.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.577] lstrlenW (lpString=".xls") returned 4
	[0100.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.577] lstrlenW (lpString=".xlsx") returned 5
	[0100.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.577] lstrlenW (lpString=".ppt") returned 4
	[0100.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0100.577] lstrlenW (lpString=".zip") returned 4
	[0100.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.577] lstrlenW (lpString=".rar") returned 4
	[0100.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.577] lstrlenW (lpString=".bz2") returned 4
	[0100.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.577] lstrlenW (lpString=".7z") returned 3
	[0100.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0100.577] lstrlenW (lpString=".dbf") returned 4
	[0100.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0100.578] lstrlenW (lpString=".1cd") returned 4
	[0100.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0100.578] lstrlenW (lpString=".jpg") returned 4
	[0100.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0100.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0100.578] lstrlenW (lpString=".doc") returned 4
	[0100.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.590] lstrlenW (lpString=".docx") returned 5
	[0100.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.590] lstrlenW (lpString=".pdf") returned 4
	[0100.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.591] lstrlenW (lpString=".xls") returned 4
	[0100.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.591] lstrlenW (lpString=".xlsx") returned 5
	[0100.591] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.591] lstrlenW (lpString=".ppt") returned 4
	[0100.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0100.591] lstrlenW (lpString=".zip") returned 4
	[0100.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.591] lstrlenW (lpString=".rar") returned 4
	[0100.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.591] lstrlenW (lpString=".bz2") returned 4
	[0100.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.591] lstrlenW (lpString=".7z") returned 3
	[0100.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0100.591] lstrlenW (lpString=".dbf") returned 4
	[0100.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0100.591] lstrlenW (lpString=".1cd") returned 4
	[0100.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0100.591] lstrlenW (lpString=".jpg") returned 4
	[0100.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.592] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.592] lstrlenW (lpString="BL00526_.WMF") returned 12
	[0100.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.593] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=27552) returned 1
	[0100.593] CloseHandle (hObject=0x190) returned 1
	[0100.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20
	[0100.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.594] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.594] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.595] GetLastError () returned 0x0
	[0100.595] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x6ba0, lpOverlapped=0x0) returned 1
	[0100.656] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x6bb0, lpOverlapped=0x0) returned 1
	[0100.658] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.658] WriteFile (in: hFile=0x174, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.658] SetEndOfFile (hFile=0x174) returned 1
	[0100.659] CloseHandle (hObject=0x174) returned 1
	[0100.659] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.659] SetEndOfFile (hFile=0x190) returned 1
	[0100.660] CloseHandle (hObject=0x190) returned 1
	[0100.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1
	[0100.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0100.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0100.661] lstrlenW (lpString=".doc") returned 4
	[0100.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.661] lstrlenW (lpString=".docx") returned 5
	[0100.661] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.661] lstrlenW (lpString=".pdf") returned 4
	[0100.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.661] lstrlenW (lpString=".xls") returned 4
	[0100.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.661] lstrlenW (lpString=".xlsx") returned 5
	[0100.661] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.661] lstrlenW (lpString=".ppt") returned 4
	[0100.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0100.662] lstrlenW (lpString=".zip") returned 4
	[0100.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.662] lstrlenW (lpString=".rar") returned 4
	[0100.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.662] lstrlenW (lpString=".bz2") returned 4
	[0100.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.662] lstrlenW (lpString=".7z") returned 3
	[0100.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0100.662] lstrlenW (lpString=".dbf") returned 4
	[0100.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0100.662] lstrlenW (lpString=".1cd") returned 4
	[0100.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0100.662] lstrlenW (lpString=".jpg") returned 4
	[0100.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0100.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0100.662] lstrlenW (lpString=".doc") returned 4
	[0100.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.662] lstrlenW (lpString=".docx") returned 5
	[0100.662] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.662] lstrlenW (lpString=".pdf") returned 4
	[0100.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.663] lstrlenW (lpString=".xls") returned 4
	[0100.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.663] lstrlenW (lpString=".xlsx") returned 5
	[0100.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.663] lstrlenW (lpString=".ppt") returned 4
	[0100.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0100.663] lstrlenW (lpString=".zip") returned 4
	[0100.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.663] lstrlenW (lpString=".rar") returned 4
	[0100.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.663] lstrlenW (lpString=".bz2") returned 4
	[0100.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.663] lstrlenW (lpString=".7z") returned 3
	[0100.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0100.663] lstrlenW (lpString=".dbf") returned 4
	[0100.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0100.663] lstrlenW (lpString=".1cd") returned 4
	[0100.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0100.663] lstrlenW (lpString=".jpg") returned 4
	[0100.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.664] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.664] lstrlenW (lpString="BL00921_.WMF") returned 12
	[0100.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.703] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=4408) returned 1
	[0100.703] CloseHandle (hObject=0x190) returned 1
	[0100.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20
	[0100.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.739] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.739] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0100.763] GetLastError () returned 0x0
	[0100.763] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1138, lpOverlapped=0x0) returned 1
	[0100.766] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1140, lpOverlapped=0x0) returned 1
	[0100.767] ReadFile (in: hFile=0x174, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.768] WriteFile (in: hFile=0x188, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.768] SetEndOfFile (hFile=0x188) returned 1
	[0100.768] CloseHandle (hObject=0x188) returned 1
	[0100.768] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.768] SetEndOfFile (hFile=0x174) returned 1
	[0100.769] CloseHandle (hObject=0x174) returned 1
	[0100.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1
	[0100.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0100.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0100.788] lstrlenW (lpString=".doc") returned 4
	[0100.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.789] lstrlenW (lpString=".docx") returned 5
	[0100.789] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.789] lstrlenW (lpString=".pdf") returned 4
	[0100.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.789] lstrlenW (lpString=".xls") returned 4
	[0100.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.789] lstrlenW (lpString=".xlsx") returned 5
	[0100.789] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.789] lstrlenW (lpString=".ppt") returned 4
	[0100.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0100.789] lstrlenW (lpString=".zip") returned 4
	[0100.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.789] lstrlenW (lpString=".rar") returned 4
	[0100.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.790] lstrlenW (lpString=".bz2") returned 4
	[0100.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.790] lstrlenW (lpString=".7z") returned 3
	[0100.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0100.790] lstrlenW (lpString=".dbf") returned 4
	[0100.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0100.790] lstrlenW (lpString=".1cd") returned 4
	[0100.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0100.790] lstrlenW (lpString=".jpg") returned 4
	[0100.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0100.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0100.790] lstrlenW (lpString=".doc") returned 4
	[0100.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.790] lstrlenW (lpString=".docx") returned 5
	[0100.790] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.790] lstrlenW (lpString=".pdf") returned 4
	[0100.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.790] lstrlenW (lpString=".xls") returned 4
	[0100.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.790] lstrlenW (lpString=".xlsx") returned 5
	[0100.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.791] lstrlenW (lpString=".ppt") returned 4
	[0100.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0100.791] lstrlenW (lpString=".zip") returned 4
	[0100.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.791] lstrlenW (lpString=".rar") returned 4
	[0100.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.791] lstrlenW (lpString=".bz2") returned 4
	[0100.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.791] lstrlenW (lpString=".7z") returned 3
	[0100.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0100.791] lstrlenW (lpString=".dbf") returned 4
	[0100.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0100.791] lstrlenW (lpString=".1cd") returned 4
	[0100.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0100.791] lstrlenW (lpString=".jpg") returned 4
	[0100.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.791] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.791] lstrlenW (lpString="BL00932_.WMF") returned 12
	[0100.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.804] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=19476) returned 1
	[0100.804] CloseHandle (hObject=0x164) returned 1
	[0100.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20
	[0100.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0100.818] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.818] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.819] GetLastError () returned 0x0
	[0100.819] ReadFile (in: hFile=0x1a0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x4c14, lpOverlapped=0x0) returned 1
	[0100.845] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x4c20, lpOverlapped=0x0) returned 1
	[0100.846] ReadFile (in: hFile=0x1a0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.846] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.846] SetEndOfFile (hFile=0x164) returned 1
	[0100.847] CloseHandle (hObject=0x164) returned 1
	[0100.847] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.847] SetEndOfFile (hFile=0x1a0) returned 1
	[0100.848] CloseHandle (hObject=0x1a0) returned 1
	[0100.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1
	[0100.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0100.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0100.849] lstrlenW (lpString=".doc") returned 4
	[0100.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.849] lstrlenW (lpString=".docx") returned 5
	[0100.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.849] lstrlenW (lpString=".pdf") returned 4
	[0100.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.849] lstrlenW (lpString=".xls") returned 4
	[0100.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.849] lstrlenW (lpString=".xlsx") returned 5
	[0100.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.849] lstrlenW (lpString=".ppt") returned 4
	[0100.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0100.849] lstrlenW (lpString=".zip") returned 4
	[0100.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.849] lstrlenW (lpString=".rar") returned 4
	[0100.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.849] lstrlenW (lpString=".bz2") returned 4
	[0100.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.849] lstrlenW (lpString=".7z") returned 3
	[0100.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0100.849] lstrlenW (lpString=".dbf") returned 4
	[0100.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0100.849] lstrlenW (lpString=".1cd") returned 4
	[0100.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0100.850] lstrlenW (lpString=".jpg") returned 4
	[0100.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0100.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0100.850] lstrlenW (lpString=".doc") returned 4
	[0100.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.850] lstrlenW (lpString=".docx") returned 5
	[0100.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.850] lstrlenW (lpString=".pdf") returned 4
	[0100.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.850] lstrlenW (lpString=".xls") returned 4
	[0100.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.850] lstrlenW (lpString=".xlsx") returned 5
	[0100.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.850] lstrlenW (lpString=".ppt") returned 4
	[0100.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0100.850] lstrlenW (lpString=".zip") returned 4
	[0100.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.850] lstrlenW (lpString=".rar") returned 4
	[0100.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.850] lstrlenW (lpString=".bz2") returned 4
	[0100.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.851] lstrlenW (lpString=".7z") returned 3
	[0100.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0100.851] lstrlenW (lpString=".dbf") returned 4
	[0100.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0100.851] lstrlenW (lpString=".1cd") returned 4
	[0100.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0100.851] lstrlenW (lpString=".jpg") returned 4
	[0100.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.851] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.851] lstrlenW (lpString="BOATINST.WMF") returned 12
	[0100.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0100.852] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=29004) returned 1
	[0100.852] CloseHandle (hObject=0x1a0) returned 1
	[0100.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20
	[0100.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0100.853] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.853] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.854] GetLastError () returned 0x0
	[0100.854] ReadFile (in: hFile=0x1a0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x714c, lpOverlapped=0x0) returned 1
	[0100.866] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x7150, lpOverlapped=0x0) returned 1
	[0100.867] ReadFile (in: hFile=0x1a0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.868] WriteFile (in: hFile=0x164, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.868] SetEndOfFile (hFile=0x164) returned 1
	[0100.868] CloseHandle (hObject=0x164) returned 1
	[0100.868] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.868] SetEndOfFile (hFile=0x1a0) returned 1
	[0100.869] CloseHandle (hObject=0x1a0) returned 1
	[0100.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1
	[0100.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0100.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0100.870] lstrlenW (lpString=".doc") returned 4
	[0100.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.870] lstrlenW (lpString=".docx") returned 5
	[0100.870] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0100.870] lstrlenW (lpString=".pdf") returned 4
	[0100.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.870] lstrlenW (lpString=".xls") returned 4
	[0100.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.870] lstrlenW (lpString=".xlsx") returned 5
	[0100.870] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0100.870] lstrlenW (lpString=".ppt") returned 4
	[0100.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0100.870] lstrlenW (lpString=".zip") returned 4
	[0100.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.870] lstrlenW (lpString=".rar") returned 4
	[0100.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.870] lstrlenW (lpString=".bz2") returned 4
	[0100.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.870] lstrlenW (lpString=".7z") returned 3
	[0100.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0100.870] lstrlenW (lpString=".dbf") returned 4
	[0100.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0100.871] lstrlenW (lpString=".1cd") returned 4
	[0100.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0100.871] lstrlenW (lpString=".jpg") returned 4
	[0100.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0100.871] lstrlenW (lpString=".doc") returned 4
	[0100.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.871] lstrlenW (lpString=".docx") returned 5
	[0100.871] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0100.871] lstrlenW (lpString=".pdf") returned 4
	[0100.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.871] lstrlenW (lpString=".xls") returned 4
	[0100.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.871] lstrlenW (lpString=".xlsx") returned 5
	[0100.871] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0100.871] lstrlenW (lpString=".ppt") returned 4
	[0100.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0100.871] lstrlenW (lpString=".zip") returned 4
	[0100.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.871] lstrlenW (lpString=".rar") returned 4
	[0100.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.872] lstrlenW (lpString=".bz2") returned 4
	[0100.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.872] lstrlenW (lpString=".7z") returned 3
	[0100.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0100.872] lstrlenW (lpString=".dbf") returned 4
	[0100.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0100.872] lstrlenW (lpString=".1cd") returned 4
	[0100.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0100.872] lstrlenW (lpString=".jpg") returned 4
	[0100.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.872] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.872] lstrlenW (lpString="BS00078_.WMF") returned 12
	[0100.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0100.887] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1444) returned 1
	[0100.887] CloseHandle (hObject=0x170) returned 1
	[0100.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20
	[0100.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.894] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.894] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0100.899] GetLastError () returned 0x0
	[0100.899] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x5a4, lpOverlapped=0x0) returned 1
	[0100.923] WriteFile (in: hFile=0x1c8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0100.924] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.924] WriteFile (in: hFile=0x1c8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.925] SetEndOfFile (hFile=0x1c8) returned 1
	[0100.925] CloseHandle (hObject=0x1c8) returned 1
	[0100.925] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.925] SetEndOfFile (hFile=0x184) returned 1
	[0100.926] CloseHandle (hObject=0x184) returned 1
	[0100.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 1
	[0100.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0100.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0100.927] lstrlenW (lpString=".doc") returned 4
	[0100.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.927] lstrlenW (lpString=".docx") returned 5
	[0100.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.927] lstrlenW (lpString=".pdf") returned 4
	[0100.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.927] lstrlenW (lpString=".xls") returned 4
	[0100.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.927] lstrlenW (lpString=".xlsx") returned 5
	[0100.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.927] lstrlenW (lpString=".ppt") returned 4
	[0100.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0100.927] lstrlenW (lpString=".zip") returned 4
	[0100.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.927] lstrlenW (lpString=".rar") returned 4
	[0100.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.928] lstrlenW (lpString=".bz2") returned 4
	[0100.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.928] lstrlenW (lpString=".7z") returned 3
	[0100.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0100.928] lstrlenW (lpString=".dbf") returned 4
	[0100.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0100.928] lstrlenW (lpString=".1cd") returned 4
	[0100.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0100.928] lstrlenW (lpString=".jpg") returned 4
	[0100.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0100.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0100.928] lstrlenW (lpString=".doc") returned 4
	[0100.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.928] lstrlenW (lpString=".docx") returned 5
	[0100.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.929] lstrlenW (lpString=".pdf") returned 4
	[0100.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.929] lstrlenW (lpString=".xls") returned 4
	[0100.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.929] lstrlenW (lpString=".xlsx") returned 5
	[0100.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.929] lstrlenW (lpString=".ppt") returned 4
	[0100.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0100.929] lstrlenW (lpString=".zip") returned 4
	[0100.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.929] lstrlenW (lpString=".rar") returned 4
	[0100.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.929] lstrlenW (lpString=".bz2") returned 4
	[0100.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.929] lstrlenW (lpString=".7z") returned 3
	[0100.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0100.930] lstrlenW (lpString=".dbf") returned 4
	[0100.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0100.930] lstrlenW (lpString=".1cd") returned 4
	[0100.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0100.930] lstrlenW (lpString=".jpg") returned 4
	[0100.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.930] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.930] lstrlenW (lpString="BS00100_.WMF") returned 12
	[0100.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.931] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2378) returned 1
	[0100.931] CloseHandle (hObject=0x184) returned 1
	[0100.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20
	[0100.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.932] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.932] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0100.934] GetLastError () returned 0x0
	[0100.934] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x94a, lpOverlapped=0x0) returned 1
	[0100.936] WriteFile (in: hFile=0x1c8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x950, lpOverlapped=0x0) returned 1
	[0100.938] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.938] WriteFile (in: hFile=0x1c8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.938] SetEndOfFile (hFile=0x1c8) returned 1
	[0100.939] CloseHandle (hObject=0x1c8) returned 1
	[0100.939] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.939] SetEndOfFile (hFile=0x184) returned 1
	[0100.940] CloseHandle (hObject=0x184) returned 1
	[0100.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 1
	[0100.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0100.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0100.941] lstrlenW (lpString=".doc") returned 4
	[0100.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.941] lstrlenW (lpString=".docx") returned 5
	[0100.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.941] lstrlenW (lpString=".pdf") returned 4
	[0100.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.941] lstrlenW (lpString=".xls") returned 4
	[0100.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.941] lstrlenW (lpString=".xlsx") returned 5
	[0100.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.941] lstrlenW (lpString=".ppt") returned 4
	[0100.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0100.941] lstrlenW (lpString=".zip") returned 4
	[0100.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.942] lstrlenW (lpString=".rar") returned 4
	[0100.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.942] lstrlenW (lpString=".bz2") returned 4
	[0100.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.942] lstrlenW (lpString=".7z") returned 3
	[0100.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0100.942] lstrlenW (lpString=".dbf") returned 4
	[0100.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0100.942] lstrlenW (lpString=".1cd") returned 4
	[0100.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0100.942] lstrlenW (lpString=".jpg") returned 4
	[0100.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0100.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0100.942] lstrlenW (lpString=".doc") returned 4
	[0100.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.943] lstrlenW (lpString=".docx") returned 5
	[0100.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.943] lstrlenW (lpString=".pdf") returned 4
	[0100.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.943] lstrlenW (lpString=".xls") returned 4
	[0100.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.943] lstrlenW (lpString=".xlsx") returned 5
	[0100.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.943] lstrlenW (lpString=".ppt") returned 4
	[0100.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0100.943] lstrlenW (lpString=".zip") returned 4
	[0100.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.943] lstrlenW (lpString=".rar") returned 4
	[0100.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.943] lstrlenW (lpString=".bz2") returned 4
	[0100.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.943] lstrlenW (lpString=".7z") returned 3
	[0100.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0100.944] lstrlenW (lpString=".dbf") returned 4
	[0100.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0100.944] lstrlenW (lpString=".1cd") returned 4
	[0100.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0100.944] lstrlenW (lpString=".jpg") returned 4
	[0100.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.944] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.944] lstrlenW (lpString="BS00135_.WMF") returned 12
	[0100.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.945] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1044) returned 1
	[0100.945] CloseHandle (hObject=0x184) returned 1
	[0100.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20
	[0100.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.946] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.946] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0100.947] GetLastError () returned 0x0
	[0100.947] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x414, lpOverlapped=0x0) returned 1
	[0100.961] WriteFile (in: hFile=0x1c8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x420, lpOverlapped=0x0) returned 1
	[0100.963] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.963] WriteFile (in: hFile=0x1c8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.963] SetEndOfFile (hFile=0x1c8) returned 1
	[0100.963] CloseHandle (hObject=0x1c8) returned 1
	[0100.963] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.963] SetEndOfFile (hFile=0x184) returned 1
	[0100.964] CloseHandle (hObject=0x184) returned 1
	[0100.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 1
	[0100.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0100.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0100.965] lstrlenW (lpString=".doc") returned 4
	[0100.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.965] lstrlenW (lpString=".docx") returned 5
	[0100.965] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.965] lstrlenW (lpString=".pdf") returned 4
	[0100.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.965] lstrlenW (lpString=".xls") returned 4
	[0100.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.966] lstrlenW (lpString=".xlsx") returned 5
	[0100.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.966] lstrlenW (lpString=".ppt") returned 4
	[0100.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0100.966] lstrlenW (lpString=".zip") returned 4
	[0100.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.966] lstrlenW (lpString=".rar") returned 4
	[0100.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.966] lstrlenW (lpString=".bz2") returned 4
	[0100.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.966] lstrlenW (lpString=".7z") returned 3
	[0100.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0100.966] lstrlenW (lpString=".dbf") returned 4
	[0100.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0100.966] lstrlenW (lpString=".1cd") returned 4
	[0100.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0100.967] lstrlenW (lpString=".jpg") returned 4
	[0100.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0100.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0100.967] lstrlenW (lpString=".doc") returned 4
	[0100.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.967] lstrlenW (lpString=".docx") returned 5
	[0100.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.967] lstrlenW (lpString=".pdf") returned 4
	[0100.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.967] lstrlenW (lpString=".xls") returned 4
	[0100.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.967] lstrlenW (lpString=".xlsx") returned 5
	[0100.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.967] lstrlenW (lpString=".ppt") returned 4
	[0100.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0100.968] lstrlenW (lpString=".zip") returned 4
	[0100.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.968] lstrlenW (lpString=".rar") returned 4
	[0100.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.968] lstrlenW (lpString=".bz2") returned 4
	[0100.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.968] lstrlenW (lpString=".7z") returned 3
	[0100.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0100.968] lstrlenW (lpString=".dbf") returned 4
	[0100.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0100.968] lstrlenW (lpString=".1cd") returned 4
	[0100.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0100.969] lstrlenW (lpString=".jpg") returned 4
	[0100.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.969] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.969] lstrlenW (lpString="BS00145_.WMF") returned 12
	[0100.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.971] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1712) returned 1
	[0100.971] CloseHandle (hObject=0x184) returned 1
	[0100.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20
	[0100.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.971] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.972] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0100.972] GetLastError () returned 0x0
	[0100.972] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x6b0, lpOverlapped=0x0) returned 1
	[0100.974] WriteFile (in: hFile=0x1c8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x6c0, lpOverlapped=0x0) returned 1
	[0100.975] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.975] WriteFile (in: hFile=0x1c8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.976] SetEndOfFile (hFile=0x1c8) returned 1
	[0100.976] CloseHandle (hObject=0x1c8) returned 1
	[0100.976] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.976] SetEndOfFile (hFile=0x184) returned 1
	[0100.977] CloseHandle (hObject=0x184) returned 1
	[0100.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 1
	[0100.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0100.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0100.978] lstrlenW (lpString=".doc") returned 4
	[0100.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.978] lstrlenW (lpString=".docx") returned 5
	[0100.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.978] lstrlenW (lpString=".pdf") returned 4
	[0100.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.978] lstrlenW (lpString=".xls") returned 4
	[0100.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.978] lstrlenW (lpString=".xlsx") returned 5
	[0100.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.978] lstrlenW (lpString=".ppt") returned 4
	[0100.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0100.979] lstrlenW (lpString=".zip") returned 4
	[0100.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.979] lstrlenW (lpString=".rar") returned 4
	[0100.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.979] lstrlenW (lpString=".bz2") returned 4
	[0100.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.979] lstrlenW (lpString=".7z") returned 3
	[0100.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0100.979] lstrlenW (lpString=".dbf") returned 4
	[0100.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0100.979] lstrlenW (lpString=".1cd") returned 4
	[0100.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0100.979] lstrlenW (lpString=".jpg") returned 4
	[0100.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0100.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0100.980] lstrlenW (lpString=".doc") returned 4
	[0100.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.980] lstrlenW (lpString=".docx") returned 5
	[0100.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.980] lstrlenW (lpString=".pdf") returned 4
	[0100.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.980] lstrlenW (lpString=".xls") returned 4
	[0100.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.980] lstrlenW (lpString=".xlsx") returned 5
	[0100.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.980] lstrlenW (lpString=".ppt") returned 4
	[0100.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0100.980] lstrlenW (lpString=".zip") returned 4
	[0100.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.981] lstrlenW (lpString=".rar") returned 4
	[0100.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.981] lstrlenW (lpString=".bz2") returned 4
	[0100.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.981] lstrlenW (lpString=".7z") returned 3
	[0100.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0100.981] lstrlenW (lpString=".dbf") returned 4
	[0100.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0100.981] lstrlenW (lpString=".1cd") returned 4
	[0100.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0100.981] lstrlenW (lpString=".jpg") returned 4
	[0100.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.982] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.982] lstrlenW (lpString="BS00174_.WMF") returned 12
	[0100.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.983] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=8366) returned 1
	[0100.983] CloseHandle (hObject=0x184) returned 1
	[0100.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20
	[0100.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.984] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.984] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0100.985] GetLastError () returned 0x0
	[0100.985] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x20ae, lpOverlapped=0x0) returned 1
	[0100.987] WriteFile (in: hFile=0x1c8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x20b0, lpOverlapped=0x0) returned 1
	[0100.988] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.988] WriteFile (in: hFile=0x1c8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.989] SetEndOfFile (hFile=0x1c8) returned 1
	[0100.989] CloseHandle (hObject=0x1c8) returned 1
	[0100.989] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.998] SetEndOfFile (hFile=0x184) returned 1
	[0101.001] CloseHandle (hObject=0x184) returned 1
	[0101.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 1
	[0101.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0101.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0101.002] lstrlenW (lpString=".doc") returned 4
	[0101.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.002] lstrlenW (lpString=".docx") returned 5
	[0101.002] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.002] lstrlenW (lpString=".pdf") returned 4
	[0101.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.002] lstrlenW (lpString=".xls") returned 4
	[0101.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.002] lstrlenW (lpString=".xlsx") returned 5
	[0101.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.002] lstrlenW (lpString=".ppt") returned 4
	[0101.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0101.002] lstrlenW (lpString=".zip") returned 4
	[0101.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.002] lstrlenW (lpString=".rar") returned 4
	[0101.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.002] lstrlenW (lpString=".bz2") returned 4
	[0101.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.006] lstrlenW (lpString=".7z") returned 3
	[0101.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0101.009] lstrlenW (lpString=".dbf") returned 4
	[0101.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0101.010] lstrlenW (lpString=".1cd") returned 4
	[0101.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0101.010] lstrlenW (lpString=".jpg") returned 4
	[0101.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0101.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0101.010] lstrlenW (lpString=".doc") returned 4
	[0101.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.010] lstrlenW (lpString=".docx") returned 5
	[0101.010] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.010] lstrlenW (lpString=".pdf") returned 4
	[0101.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.010] lstrlenW (lpString=".xls") returned 4
	[0101.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.010] lstrlenW (lpString=".xlsx") returned 5
	[0101.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.010] lstrlenW (lpString=".ppt") returned 4
	[0101.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0101.010] lstrlenW (lpString=".zip") returned 4
	[0101.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.010] lstrlenW (lpString=".rar") returned 4
	[0101.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.011] lstrlenW (lpString=".bz2") returned 4
	[0101.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.011] lstrlenW (lpString=".7z") returned 3
	[0101.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0101.011] lstrlenW (lpString=".dbf") returned 4
	[0101.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0101.011] lstrlenW (lpString=".1cd") returned 4
	[0101.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0101.011] lstrlenW (lpString=".jpg") returned 4
	[0101.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.011] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.011] lstrlenW (lpString="BS00184_.WMF") returned 12
	[0101.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0101.012] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=4976) returned 1
	[0101.012] CloseHandle (hObject=0x184) returned 1
	[0101.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20
	[0101.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0101.013] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.013] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0101.014] GetLastError () returned 0x0
	[0101.014] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1370, lpOverlapped=0x0) returned 1
	[0101.016] WriteFile (in: hFile=0x1c4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1380, lpOverlapped=0x0) returned 1
	[0101.018] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.018] WriteFile (in: hFile=0x1c4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.018] SetEndOfFile (hFile=0x1c4) returned 1
	[0101.018] CloseHandle (hObject=0x1c4) returned 1
	[0101.018] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.018] SetEndOfFile (hFile=0x184) returned 1
	[0101.019] CloseHandle (hObject=0x184) returned 1
	[0101.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 1
	[0101.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0101.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0101.020] lstrlenW (lpString=".doc") returned 4
	[0101.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.020] lstrlenW (lpString=".docx") returned 5
	[0101.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.020] lstrlenW (lpString=".pdf") returned 4
	[0101.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.020] lstrlenW (lpString=".xls") returned 4
	[0101.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.021] lstrlenW (lpString=".xlsx") returned 5
	[0101.021] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.021] lstrlenW (lpString=".ppt") returned 4
	[0101.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0101.021] lstrlenW (lpString=".zip") returned 4
	[0101.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.021] lstrlenW (lpString=".rar") returned 4
	[0101.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.021] lstrlenW (lpString=".bz2") returned 4
	[0101.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.021] lstrlenW (lpString=".7z") returned 3
	[0101.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0101.021] lstrlenW (lpString=".dbf") returned 4
	[0101.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0101.021] lstrlenW (lpString=".1cd") returned 4
	[0101.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0101.021] lstrlenW (lpString=".jpg") returned 4
	[0101.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0101.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0101.022] lstrlenW (lpString=".doc") returned 4
	[0101.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.022] lstrlenW (lpString=".docx") returned 5
	[0101.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.022] lstrlenW (lpString=".pdf") returned 4
	[0101.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.022] lstrlenW (lpString=".xls") returned 4
	[0101.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.022] lstrlenW (lpString=".xlsx") returned 5
	[0101.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.022] lstrlenW (lpString=".ppt") returned 4
	[0101.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0101.022] lstrlenW (lpString=".zip") returned 4
	[0101.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.022] lstrlenW (lpString=".rar") returned 4
	[0101.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.022] lstrlenW (lpString=".bz2") returned 4
	[0101.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.022] lstrlenW (lpString=".7z") returned 3
	[0101.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0101.022] lstrlenW (lpString=".dbf") returned 4
	[0101.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0101.023] lstrlenW (lpString=".1cd") returned 4
	[0101.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0101.023] lstrlenW (lpString=".jpg") returned 4
	[0101.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.023] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.023] lstrlenW (lpString="BS00186_.WMF") returned 12
	[0101.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0101.054] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=12788) returned 1
	[0101.054] CloseHandle (hObject=0x188) returned 1
	[0101.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20
	[0101.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0101.063] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.063] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0101.068] GetLastError () returned 0x0
	[0101.068] ReadFile (in: hFile=0x164, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x31f4, lpOverlapped=0x0) returned 1
	[0101.076] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x3200, lpOverlapped=0x0) returned 1
	[0101.078] ReadFile (in: hFile=0x164, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.078] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.078] SetEndOfFile (hFile=0x160) returned 1
	[0101.078] CloseHandle (hObject=0x160) returned 1
	[0101.081] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.081] SetEndOfFile (hFile=0x164) returned 1
	[0101.082] CloseHandle (hObject=0x164) returned 1
	[0101.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 1
	[0101.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0101.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0101.083] lstrlenW (lpString=".doc") returned 4
	[0101.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.083] lstrlenW (lpString=".docx") returned 5
	[0101.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.083] lstrlenW (lpString=".pdf") returned 4
	[0101.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.083] lstrlenW (lpString=".xls") returned 4
	[0101.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.083] lstrlenW (lpString=".xlsx") returned 5
	[0101.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.083] lstrlenW (lpString=".ppt") returned 4
	[0101.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0101.083] lstrlenW (lpString=".zip") returned 4
	[0101.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.083] lstrlenW (lpString=".rar") returned 4
	[0101.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.083] lstrlenW (lpString=".bz2") returned 4
	[0101.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.083] lstrlenW (lpString=".7z") returned 3
	[0101.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0101.083] lstrlenW (lpString=".dbf") returned 4
	[0101.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0101.083] lstrlenW (lpString=".1cd") returned 4
	[0101.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0101.084] lstrlenW (lpString=".jpg") returned 4
	[0101.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0101.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0101.084] lstrlenW (lpString=".doc") returned 4
	[0101.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.084] lstrlenW (lpString=".docx") returned 5
	[0101.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.084] lstrlenW (lpString=".pdf") returned 4
	[0101.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.084] lstrlenW (lpString=".xls") returned 4
	[0101.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.084] lstrlenW (lpString=".xlsx") returned 5
	[0101.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.084] lstrlenW (lpString=".ppt") returned 4
	[0101.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0101.084] lstrlenW (lpString=".zip") returned 4
	[0101.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.084] lstrlenW (lpString=".rar") returned 4
	[0101.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.084] lstrlenW (lpString=".bz2") returned 4
	[0101.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.085] lstrlenW (lpString=".7z") returned 3
	[0101.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0101.085] lstrlenW (lpString=".dbf") returned 4
	[0101.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0101.085] lstrlenW (lpString=".1cd") returned 4
	[0101.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0101.085] lstrlenW (lpString=".jpg") returned 4
	[0101.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.085] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.085] lstrlenW (lpString="BS00224_.WMF") returned 12
	[0101.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0101.086] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1588) returned 1
	[0101.086] CloseHandle (hObject=0x164) returned 1
	[0101.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20
	[0101.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0101.087] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.087] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0101.088] GetLastError () returned 0x0
	[0101.088] ReadFile (in: hFile=0x164, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x634, lpOverlapped=0x0) returned 1
	[0101.123] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x640, lpOverlapped=0x0) returned 1
	[0101.124] ReadFile (in: hFile=0x164, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.124] WriteFile (in: hFile=0x160, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.125] SetEndOfFile (hFile=0x160) returned 1
	[0101.125] CloseHandle (hObject=0x160) returned 1
	[0101.125] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.125] SetEndOfFile (hFile=0x164) returned 1
	[0101.126] CloseHandle (hObject=0x164) returned 1
	[0101.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 1
	[0101.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0101.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0101.126] lstrlenW (lpString=".doc") returned 4
	[0101.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.126] lstrlenW (lpString=".docx") returned 5
	[0101.126] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.126] lstrlenW (lpString=".pdf") returned 4
	[0101.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.126] lstrlenW (lpString=".xls") returned 4
	[0101.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.126] lstrlenW (lpString=".xlsx") returned 5
	[0101.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.127] lstrlenW (lpString=".ppt") returned 4
	[0101.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0101.127] lstrlenW (lpString=".zip") returned 4
	[0101.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.127] lstrlenW (lpString=".rar") returned 4
	[0101.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.127] lstrlenW (lpString=".bz2") returned 4
	[0101.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.127] lstrlenW (lpString=".7z") returned 3
	[0101.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0101.127] lstrlenW (lpString=".dbf") returned 4
	[0101.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0101.127] lstrlenW (lpString=".1cd") returned 4
	[0101.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0101.127] lstrlenW (lpString=".jpg") returned 4
	[0101.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0101.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0101.127] lstrlenW (lpString=".doc") returned 4
	[0101.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.127] lstrlenW (lpString=".docx") returned 5
	[0101.127] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.128] lstrlenW (lpString=".pdf") returned 4
	[0101.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.128] lstrlenW (lpString=".xls") returned 4
	[0101.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.128] lstrlenW (lpString=".xlsx") returned 5
	[0101.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.128] lstrlenW (lpString=".ppt") returned 4
	[0101.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0101.128] lstrlenW (lpString=".zip") returned 4
	[0101.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.128] lstrlenW (lpString=".rar") returned 4
	[0101.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.128] lstrlenW (lpString=".bz2") returned 4
	[0101.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.128] lstrlenW (lpString=".7z") returned 3
	[0101.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0101.128] lstrlenW (lpString=".dbf") returned 4
	[0101.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0101.128] lstrlenW (lpString=".1cd") returned 4
	[0101.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0101.128] lstrlenW (lpString=".jpg") returned 4
	[0101.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.129] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.129] lstrlenW (lpString="BS00439_.WMF") returned 12
	[0101.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0101.138] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2052) returned 1
	[0101.138] CloseHandle (hObject=0x170) returned 1
	[0101.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20
	[0101.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0101.148] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.148] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0101.170] GetLastError () returned 0x0
	[0101.170] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x804, lpOverlapped=0x0) returned 1
	[0101.185] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x810, lpOverlapped=0x0) returned 1
	[0101.186] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.187] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.187] SetEndOfFile (hFile=0x1c0) returned 1
	[0101.187] CloseHandle (hObject=0x1c0) returned 1
	[0101.187] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.187] SetEndOfFile (hFile=0x1b0) returned 1
	[0101.188] CloseHandle (hObject=0x1b0) returned 1
	[0101.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 1
	[0101.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0101.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0101.188] lstrlenW (lpString=".doc") returned 4
	[0101.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.189] lstrlenW (lpString=".docx") returned 5
	[0101.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.189] lstrlenW (lpString=".pdf") returned 4
	[0101.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.189] lstrlenW (lpString=".xls") returned 4
	[0101.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.189] lstrlenW (lpString=".xlsx") returned 5
	[0101.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.189] lstrlenW (lpString=".ppt") returned 4
	[0101.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0101.189] lstrlenW (lpString=".zip") returned 4
	[0101.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.189] lstrlenW (lpString=".rar") returned 4
	[0101.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.189] lstrlenW (lpString=".bz2") returned 4
	[0101.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.189] lstrlenW (lpString=".7z") returned 3
	[0101.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0101.189] lstrlenW (lpString=".dbf") returned 4
	[0101.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0101.189] lstrlenW (lpString=".1cd") returned 4
	[0101.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0101.189] lstrlenW (lpString=".jpg") returned 4
	[0101.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0101.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0101.190] lstrlenW (lpString=".doc") returned 4
	[0101.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.190] lstrlenW (lpString=".docx") returned 5
	[0101.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.190] lstrlenW (lpString=".pdf") returned 4
	[0101.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.190] lstrlenW (lpString=".xls") returned 4
	[0101.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.190] lstrlenW (lpString=".xlsx") returned 5
	[0101.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.190] lstrlenW (lpString=".ppt") returned 4
	[0101.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0101.190] lstrlenW (lpString=".zip") returned 4
	[0101.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.190] lstrlenW (lpString=".rar") returned 4
	[0101.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.190] lstrlenW (lpString=".bz2") returned 4
	[0101.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.190] lstrlenW (lpString=".7z") returned 3
	[0101.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0101.190] lstrlenW (lpString=".dbf") returned 4
	[0101.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0101.190] lstrlenW (lpString=".1cd") returned 4
	[0101.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0101.191] lstrlenW (lpString=".jpg") returned 4
	[0101.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.191] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.191] lstrlenW (lpString="BS00441_.WMF") returned 12
	[0101.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0101.192] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3524) returned 1
	[0101.192] CloseHandle (hObject=0x1b0) returned 1
	[0101.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20
	[0101.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0101.192] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.192] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0101.193] GetLastError () returned 0x0
	[0101.193] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xdc4, lpOverlapped=0x0) returned 1
	[0101.215] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xdd0, lpOverlapped=0x0) returned 1
	[0101.216] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.216] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.216] SetEndOfFile (hFile=0x1c0) returned 1
	[0101.216] CloseHandle (hObject=0x1c0) returned 1
	[0101.216] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.216] SetEndOfFile (hFile=0x1b0) returned 1
	[0101.217] CloseHandle (hObject=0x1b0) returned 1
	[0101.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 1
	[0101.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0101.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0101.218] lstrlenW (lpString=".doc") returned 4
	[0101.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.218] lstrlenW (lpString=".docx") returned 5
	[0101.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.218] lstrlenW (lpString=".pdf") returned 4
	[0101.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.218] lstrlenW (lpString=".xls") returned 4
	[0101.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.218] lstrlenW (lpString=".xlsx") returned 5
	[0101.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.218] lstrlenW (lpString=".ppt") returned 4
	[0101.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0101.218] lstrlenW (lpString=".zip") returned 4
	[0101.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.218] lstrlenW (lpString=".rar") returned 4
	[0101.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.218] lstrlenW (lpString=".bz2") returned 4
	[0101.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.218] lstrlenW (lpString=".7z") returned 3
	[0101.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0101.218] lstrlenW (lpString=".dbf") returned 4
	[0101.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0101.219] lstrlenW (lpString=".1cd") returned 4
	[0101.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0101.219] lstrlenW (lpString=".jpg") returned 4
	[0101.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0101.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0101.219] lstrlenW (lpString=".doc") returned 4
	[0101.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.219] lstrlenW (lpString=".docx") returned 5
	[0101.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.219] lstrlenW (lpString=".pdf") returned 4
	[0101.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.219] lstrlenW (lpString=".xls") returned 4
	[0101.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.219] lstrlenW (lpString=".xlsx") returned 5
	[0101.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.219] lstrlenW (lpString=".ppt") returned 4
	[0101.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0101.219] lstrlenW (lpString=".zip") returned 4
	[0101.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.219] lstrlenW (lpString=".rar") returned 4
	[0101.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.219] lstrlenW (lpString=".bz2") returned 4
	[0101.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.219] lstrlenW (lpString=".7z") returned 3
	[0101.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0101.219] lstrlenW (lpString=".dbf") returned 4
	[0101.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0101.220] lstrlenW (lpString=".1cd") returned 4
	[0101.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0101.220] lstrlenW (lpString=".jpg") returned 4
	[0101.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.220] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.220] lstrlenW (lpString="BS00443_.WMF") returned 12
	[0101.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0101.220] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1676) returned 1
	[0101.221] CloseHandle (hObject=0x1b0) returned 1
	[0101.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20
	[0101.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0101.221] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.221] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0101.222] GetLastError () returned 0x0
	[0101.222] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x68c, lpOverlapped=0x0) returned 1
	[0101.312] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x690, lpOverlapped=0x0) returned 1
	[0101.313] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.313] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.313] SetEndOfFile (hFile=0x1c0) returned 1
	[0101.313] CloseHandle (hObject=0x1c0) returned 1
	[0101.313] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.313] SetEndOfFile (hFile=0x1b0) returned 1
	[0101.314] CloseHandle (hObject=0x1b0) returned 1
	[0101.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 1
	[0101.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0101.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0101.365] lstrlenW (lpString=".doc") returned 4
	[0101.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.365] lstrlenW (lpString=".docx") returned 5
	[0101.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.365] lstrlenW (lpString=".pdf") returned 4
	[0101.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.365] lstrlenW (lpString=".xls") returned 4
	[0101.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.365] lstrlenW (lpString=".xlsx") returned 5
	[0101.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.365] lstrlenW (lpString=".ppt") returned 4
	[0101.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0101.365] lstrlenW (lpString=".zip") returned 4
	[0101.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.365] lstrlenW (lpString=".rar") returned 4
	[0101.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.365] lstrlenW (lpString=".bz2") returned 4
	[0101.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.365] lstrlenW (lpString=".7z") returned 3
	[0101.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0101.365] lstrlenW (lpString=".dbf") returned 4
	[0101.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0101.365] lstrlenW (lpString=".1cd") returned 4
	[0101.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0101.365] lstrlenW (lpString=".jpg") returned 4
	[0101.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0101.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0101.366] lstrlenW (lpString=".doc") returned 4
	[0101.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.366] lstrlenW (lpString=".docx") returned 5
	[0101.366] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.366] lstrlenW (lpString=".pdf") returned 4
	[0101.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.366] lstrlenW (lpString=".xls") returned 4
	[0101.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.366] lstrlenW (lpString=".xlsx") returned 5
	[0101.366] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.366] lstrlenW (lpString=".ppt") returned 4
	[0101.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0101.366] lstrlenW (lpString=".zip") returned 4
	[0101.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.366] lstrlenW (lpString=".rar") returned 4
	[0101.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.366] lstrlenW (lpString=".bz2") returned 4
	[0101.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.366] lstrlenW (lpString=".7z") returned 3
	[0101.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0101.366] lstrlenW (lpString=".dbf") returned 4
	[0101.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0101.366] lstrlenW (lpString=".1cd") returned 4
	[0101.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0101.366] lstrlenW (lpString=".jpg") returned 4
	[0101.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.367] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.367] lstrlenW (lpString="BS00445_.WMF") returned 12
	[0101.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0101.377] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3796) returned 1
	[0101.377] CloseHandle (hObject=0x170) returned 1
	[0101.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20
	[0101.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0101.385] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.385] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0101.387] GetLastError () returned 0x0
	[0101.387] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xed4, lpOverlapped=0x0) returned 1
	[0101.400] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xee0, lpOverlapped=0x0) returned 1
	[0101.401] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.401] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.402] SetEndOfFile (hFile=0x1cc) returned 1
	[0101.402] CloseHandle (hObject=0x1cc) returned 1
	[0101.402] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.402] SetEndOfFile (hFile=0x1c0) returned 1
	[0101.403] CloseHandle (hObject=0x1c0) returned 1
	[0101.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 1
	[0101.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0101.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0101.403] lstrlenW (lpString=".doc") returned 4
	[0101.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.403] lstrlenW (lpString=".docx") returned 5
	[0101.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.403] lstrlenW (lpString=".pdf") returned 4
	[0101.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.403] lstrlenW (lpString=".xls") returned 4
	[0101.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.404] lstrlenW (lpString=".xlsx") returned 5
	[0101.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.404] lstrlenW (lpString=".ppt") returned 4
	[0101.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0101.404] lstrlenW (lpString=".zip") returned 4
	[0101.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.404] lstrlenW (lpString=".rar") returned 4
	[0101.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.404] lstrlenW (lpString=".bz2") returned 4
	[0101.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.404] lstrlenW (lpString=".7z") returned 3
	[0101.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0101.404] lstrlenW (lpString=".dbf") returned 4
	[0101.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0101.404] lstrlenW (lpString=".1cd") returned 4
	[0101.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0101.404] lstrlenW (lpString=".jpg") returned 4
	[0101.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0101.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0101.404] lstrlenW (lpString=".doc") returned 4
	[0101.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.404] lstrlenW (lpString=".docx") returned 5
	[0101.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.404] lstrlenW (lpString=".pdf") returned 4
	[0101.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.404] lstrlenW (lpString=".xls") returned 4
	[0101.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.405] lstrlenW (lpString=".xlsx") returned 5
	[0101.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.405] lstrlenW (lpString=".ppt") returned 4
	[0101.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0101.405] lstrlenW (lpString=".zip") returned 4
	[0101.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.405] lstrlenW (lpString=".rar") returned 4
	[0101.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.405] lstrlenW (lpString=".bz2") returned 4
	[0101.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.405] lstrlenW (lpString=".7z") returned 3
	[0101.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0101.405] lstrlenW (lpString=".dbf") returned 4
	[0101.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0101.405] lstrlenW (lpString=".1cd") returned 4
	[0101.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0101.405] lstrlenW (lpString=".jpg") returned 4
	[0101.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.406] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.406] lstrlenW (lpString="BS01080_.WMF") returned 12
	[0101.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0101.407] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2732) returned 1
	[0101.407] CloseHandle (hObject=0x1c0) returned 1
	[0101.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20
	[0101.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0101.407] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.407] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0101.409] GetLastError () returned 0x0
	[0101.409] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xaac, lpOverlapped=0x0) returned 1
	[0101.468] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xab0, lpOverlapped=0x0) returned 1
	[0101.469] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.469] WriteFile (in: hFile=0x1cc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.469] SetEndOfFile (hFile=0x1cc) returned 1
	[0101.470] CloseHandle (hObject=0x1cc) returned 1
	[0101.470] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.470] SetEndOfFile (hFile=0x1c0) returned 1
	[0101.471] CloseHandle (hObject=0x1c0) returned 1
	[0101.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 1
	[0101.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0101.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0101.501] lstrlenW (lpString=".doc") returned 4
	[0101.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.501] lstrlenW (lpString=".docx") returned 5
	[0101.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.501] lstrlenW (lpString=".pdf") returned 4
	[0101.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.501] lstrlenW (lpString=".xls") returned 4
	[0101.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.501] lstrlenW (lpString=".xlsx") returned 5
	[0101.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.501] lstrlenW (lpString=".ppt") returned 4
	[0101.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0101.501] lstrlenW (lpString=".zip") returned 4
	[0101.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.501] lstrlenW (lpString=".rar") returned 4
	[0101.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.501] lstrlenW (lpString=".bz2") returned 4
	[0101.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.501] lstrlenW (lpString=".7z") returned 3
	[0101.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0101.501] lstrlenW (lpString=".dbf") returned 4
	[0101.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0101.501] lstrlenW (lpString=".1cd") returned 4
	[0101.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0101.501] lstrlenW (lpString=".jpg") returned 4
	[0101.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0101.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0101.502] lstrlenW (lpString=".doc") returned 4
	[0101.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.502] lstrlenW (lpString=".docx") returned 5
	[0101.502] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.502] lstrlenW (lpString=".pdf") returned 4
	[0101.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.502] lstrlenW (lpString=".xls") returned 4
	[0101.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.502] lstrlenW (lpString=".xlsx") returned 5
	[0101.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.502] lstrlenW (lpString=".ppt") returned 4
	[0101.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0101.502] lstrlenW (lpString=".zip") returned 4
	[0101.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.502] lstrlenW (lpString=".rar") returned 4
	[0101.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.502] lstrlenW (lpString=".bz2") returned 4
	[0101.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.502] lstrlenW (lpString=".7z") returned 3
	[0101.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0101.503] lstrlenW (lpString=".dbf") returned 4
	[0101.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0101.503] lstrlenW (lpString=".1cd") returned 4
	[0101.503] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0101.503] lstrlenW (lpString=".jpg") returned 4
	[0101.503] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.503] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.503] lstrlenW (lpString="BS01634_.WMF") returned 12
	[0101.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0101.592] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3494) returned 1
	[0101.592] CloseHandle (hObject=0x170) returned 1
	[0101.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20
	[0101.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0101.610] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.610] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0101.621] GetLastError () returned 0x0
	[0101.621] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xda6, lpOverlapped=0x0) returned 1
	[0101.623] WriteFile (in: hFile=0x170, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xdb0, lpOverlapped=0x0) returned 1
	[0101.624] ReadFile (in: hFile=0x160, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.624] WriteFile (in: hFile=0x170, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.624] SetEndOfFile (hFile=0x170) returned 1
	[0101.630] CloseHandle (hObject=0x170) returned 1
	[0101.639] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.639] SetEndOfFile (hFile=0x160) returned 1
	[0101.644] CloseHandle (hObject=0x160) returned 1
	[0101.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 1
	[0101.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0101.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0101.648] lstrlenW (lpString=".doc") returned 4
	[0101.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.648] lstrlenW (lpString=".docx") returned 5
	[0101.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.648] lstrlenW (lpString=".pdf") returned 4
	[0101.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.648] lstrlenW (lpString=".xls") returned 4
	[0101.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.648] lstrlenW (lpString=".xlsx") returned 5
	[0101.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.648] lstrlenW (lpString=".ppt") returned 4
	[0101.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0101.649] lstrlenW (lpString=".zip") returned 4
	[0101.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.649] lstrlenW (lpString=".rar") returned 4
	[0101.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.649] lstrlenW (lpString=".bz2") returned 4
	[0101.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.649] lstrlenW (lpString=".7z") returned 3
	[0101.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0101.649] lstrlenW (lpString=".dbf") returned 4
	[0101.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0101.649] lstrlenW (lpString=".1cd") returned 4
	[0101.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0101.649] lstrlenW (lpString=".jpg") returned 4
	[0101.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0101.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0101.649] lstrlenW (lpString=".doc") returned 4
	[0101.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.649] lstrlenW (lpString=".docx") returned 5
	[0101.649] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.649] lstrlenW (lpString=".pdf") returned 4
	[0101.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.650] lstrlenW (lpString=".xls") returned 4
	[0101.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.650] lstrlenW (lpString=".xlsx") returned 5
	[0101.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.650] lstrlenW (lpString=".ppt") returned 4
	[0101.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0101.650] lstrlenW (lpString=".zip") returned 4
	[0101.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.650] lstrlenW (lpString=".rar") returned 4
	[0101.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.650] lstrlenW (lpString=".bz2") returned 4
	[0101.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.650] lstrlenW (lpString=".7z") returned 3
	[0101.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0101.650] lstrlenW (lpString=".dbf") returned 4
	[0101.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0101.650] lstrlenW (lpString=".1cd") returned 4
	[0101.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0101.650] lstrlenW (lpString=".jpg") returned 4
	[0101.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.651] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.651] lstrlenW (lpString="BS01636_.WMF") returned 12
	[0101.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0101.675] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1874) returned 1
	[0101.675] CloseHandle (hObject=0x19c) returned 1
	[0101.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20
	[0101.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0101.692] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.692] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0101.709] GetLastError () returned 0x0
	[0101.709] ReadFile (in: hFile=0x1cc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x752, lpOverlapped=0x0) returned 1
	[0101.711] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x760, lpOverlapped=0x0) returned 1
	[0101.713] ReadFile (in: hFile=0x1cc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.713] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.713] SetEndOfFile (hFile=0x1b4) returned 1
	[0101.718] CloseHandle (hObject=0x1b4) returned 1
	[0101.718] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.718] SetEndOfFile (hFile=0x1cc) returned 1
	[0101.721] CloseHandle (hObject=0x1cc) returned 1
	[0101.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 1
	[0101.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0101.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0101.725] lstrlenW (lpString=".doc") returned 4
	[0101.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.726] lstrlenW (lpString=".docx") returned 5
	[0101.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.726] lstrlenW (lpString=".pdf") returned 4
	[0101.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.726] lstrlenW (lpString=".xls") returned 4
	[0101.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.726] lstrlenW (lpString=".xlsx") returned 5
	[0101.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.726] lstrlenW (lpString=".ppt") returned 4
	[0101.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0101.726] lstrlenW (lpString=".zip") returned 4
	[0101.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.726] lstrlenW (lpString=".rar") returned 4
	[0101.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.726] lstrlenW (lpString=".bz2") returned 4
	[0101.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.726] lstrlenW (lpString=".7z") returned 3
	[0101.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0101.726] lstrlenW (lpString=".dbf") returned 4
	[0101.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0101.726] lstrlenW (lpString=".1cd") returned 4
	[0101.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0101.727] lstrlenW (lpString=".jpg") returned 4
	[0101.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0101.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0101.727] lstrlenW (lpString=".doc") returned 4
	[0101.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.727] lstrlenW (lpString=".docx") returned 5
	[0101.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.727] lstrlenW (lpString=".pdf") returned 4
	[0101.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.727] lstrlenW (lpString=".xls") returned 4
	[0101.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.727] lstrlenW (lpString=".xlsx") returned 5
	[0101.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.727] lstrlenW (lpString=".ppt") returned 4
	[0101.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0101.727] lstrlenW (lpString=".zip") returned 4
	[0101.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.727] lstrlenW (lpString=".rar") returned 4
	[0101.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.727] lstrlenW (lpString=".bz2") returned 4
	[0101.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.727] lstrlenW (lpString=".7z") returned 3
	[0101.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0101.728] lstrlenW (lpString=".dbf") returned 4
	[0101.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0101.728] lstrlenW (lpString=".1cd") returned 4
	[0101.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0101.728] lstrlenW (lpString=".jpg") returned 4
	[0101.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.728] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.728] lstrlenW (lpString="BS01638_.WMF") returned 12
	[0101.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0101.742] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=10538) returned 1
	[0101.742] CloseHandle (hObject=0x174) returned 1
	[0101.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20
	[0101.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0101.765] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.765] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0101.779] GetLastError () returned 0x0
	[0101.779] ReadFile (in: hFile=0x178, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x292a, lpOverlapped=0x0) returned 1
	[0101.781] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2930, lpOverlapped=0x0) returned 1
	[0101.783] ReadFile (in: hFile=0x178, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.783] WriteFile (in: hFile=0x1c0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.783] SetEndOfFile (hFile=0x1c0) returned 1
	[0101.787] CloseHandle (hObject=0x1c0) returned 1
	[0101.788] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.788] SetEndOfFile (hFile=0x178) returned 1
	[0101.790] CloseHandle (hObject=0x178) returned 1
	[0101.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 1
	[0101.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0101.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0101.797] lstrlenW (lpString=".doc") returned 4
	[0101.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.797] lstrlenW (lpString=".docx") returned 5
	[0101.797] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.797] lstrlenW (lpString=".pdf") returned 4
	[0101.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.797] lstrlenW (lpString=".xls") returned 4
	[0101.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.797] lstrlenW (lpString=".xlsx") returned 5
	[0101.797] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.797] lstrlenW (lpString=".ppt") returned 4
	[0101.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0101.797] lstrlenW (lpString=".zip") returned 4
	[0101.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.798] lstrlenW (lpString=".rar") returned 4
	[0101.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.798] lstrlenW (lpString=".bz2") returned 4
	[0101.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.798] lstrlenW (lpString=".7z") returned 3
	[0101.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0101.798] lstrlenW (lpString=".dbf") returned 4
	[0101.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0101.798] lstrlenW (lpString=".1cd") returned 4
	[0101.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0101.798] lstrlenW (lpString=".jpg") returned 4
	[0101.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0101.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0101.798] lstrlenW (lpString=".doc") returned 4
	[0101.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.798] lstrlenW (lpString=".docx") returned 5
	[0101.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.798] lstrlenW (lpString=".pdf") returned 4
	[0101.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.798] lstrlenW (lpString=".xls") returned 4
	[0101.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.798] lstrlenW (lpString=".xlsx") returned 5
	[0101.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.798] lstrlenW (lpString=".ppt") returned 4
	[0101.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0101.798] lstrlenW (lpString=".zip") returned 4
	[0101.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.799] lstrlenW (lpString=".rar") returned 4
	[0101.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.799] lstrlenW (lpString=".bz2") returned 4
	[0101.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.799] lstrlenW (lpString=".7z") returned 3
	[0101.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0101.799] lstrlenW (lpString=".dbf") returned 4
	[0101.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0101.799] lstrlenW (lpString=".1cd") returned 4
	[0101.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0101.799] lstrlenW (lpString=".jpg") returned 4
	[0101.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.799] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.799] lstrlenW (lpString="CG1606.WMF") returned 10
	[0101.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0101.813] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3564) returned 1
	[0101.813] CloseHandle (hObject=0x174) returned 1
	[0101.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20
	[0101.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154
	[0101.835] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.836] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0101.849] GetLastError () returned 0x0
	[0101.849] ReadFile (in: hFile=0x154, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xdec, lpOverlapped=0x0) returned 1
	[0101.851] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xdf0, lpOverlapped=0x0) returned 1
	[0101.852] ReadFile (in: hFile=0x154, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.852] WriteFile (in: hFile=0x1b4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0101.852] SetEndOfFile (hFile=0x1b4) returned 1
	[0101.857] CloseHandle (hObject=0x1b4) returned 1
	[0101.857] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.857] SetEndOfFile (hFile=0x154) returned 1
	[0101.862] CloseHandle (hObject=0x154) returned 1
	[0101.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 1
	[0101.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0101.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0101.873] lstrlenW (lpString=".doc") returned 4
	[0101.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.873] lstrlenW (lpString=".docx") returned 5
	[0101.874] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0101.874] lstrlenW (lpString=".pdf") returned 4
	[0101.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.874] lstrlenW (lpString=".xls") returned 4
	[0101.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.874] lstrlenW (lpString=".xlsx") returned 5
	[0101.874] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0101.874] lstrlenW (lpString=".ppt") returned 4
	[0101.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0101.874] lstrlenW (lpString=".zip") returned 4
	[0101.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.874] lstrlenW (lpString=".rar") returned 4
	[0101.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.874] lstrlenW (lpString=".bz2") returned 4
	[0101.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.874] lstrlenW (lpString=".7z") returned 3
	[0101.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0101.874] lstrlenW (lpString=".dbf") returned 4
	[0101.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0101.874] lstrlenW (lpString=".1cd") returned 4
	[0101.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0101.874] lstrlenW (lpString=".jpg") returned 4
	[0101.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0101.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0101.874] lstrlenW (lpString=".doc") returned 4
	[0101.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.875] lstrlenW (lpString=".docx") returned 5
	[0101.875] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0101.875] lstrlenW (lpString=".pdf") returned 4
	[0101.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.875] lstrlenW (lpString=".xls") returned 4
	[0101.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.875] lstrlenW (lpString=".xlsx") returned 5
	[0101.875] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0101.875] lstrlenW (lpString=".ppt") returned 4
	[0101.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0101.875] lstrlenW (lpString=".zip") returned 4
	[0101.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.875] lstrlenW (lpString=".rar") returned 4
	[0101.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.875] lstrlenW (lpString=".bz2") returned 4
	[0101.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.875] lstrlenW (lpString=".7z") returned 3
	[0101.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0101.875] lstrlenW (lpString=".dbf") returned 4
	[0101.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0101.875] lstrlenW (lpString=".1cd") returned 4
	[0101.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0101.875] lstrlenW (lpString=".jpg") returned 4
	[0101.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.876] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.876] lstrlenW (lpString="CLASSIC2.WMF") returned 12
	[0101.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0101.896] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2262) returned 1
	[0101.896] CloseHandle (hObject=0x198) returned 1
	[0101.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20
	[0101.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0101.951] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.951] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0101.969] GetLastError () returned 0x0
	[0101.969] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x8d6, lpOverlapped=0x0) returned 1
	[0101.971] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x8e0, lpOverlapped=0x0) returned 1
	[0101.972] ReadFile (in: hFile=0x190, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.972] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.972] SetEndOfFile (hFile=0x184) returned 1
	[0101.974] CloseHandle (hObject=0x184) returned 1
	[0101.976] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.976] SetEndOfFile (hFile=0x190) returned 1
	[0101.985] CloseHandle (hObject=0x190) returned 1
	[0101.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 1
	[0101.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0101.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0101.997] lstrlenW (lpString=".doc") returned 4
	[0101.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.997] lstrlenW (lpString=".docx") returned 5
	[0101.997] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0101.997] lstrlenW (lpString=".pdf") returned 4
	[0101.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.997] lstrlenW (lpString=".xls") returned 4
	[0101.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.998] lstrlenW (lpString=".xlsx") returned 5
	[0101.998] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0101.998] lstrlenW (lpString=".ppt") returned 4
	[0101.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0101.998] lstrlenW (lpString=".zip") returned 4
	[0101.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.998] lstrlenW (lpString=".rar") returned 4
	[0101.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.998] lstrlenW (lpString=".bz2") returned 4
	[0101.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.998] lstrlenW (lpString=".7z") returned 3
	[0101.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0101.998] lstrlenW (lpString=".dbf") returned 4
	[0101.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0101.998] lstrlenW (lpString=".1cd") returned 4
	[0101.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0101.998] lstrlenW (lpString=".jpg") returned 4
	[0101.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0101.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0101.998] lstrlenW (lpString=".doc") returned 4
	[0101.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.998] lstrlenW (lpString=".docx") returned 5
	[0101.998] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0101.999] lstrlenW (lpString=".pdf") returned 4
	[0101.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.999] lstrlenW (lpString=".xls") returned 4
	[0101.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.999] lstrlenW (lpString=".xlsx") returned 5
	[0101.999] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0101.999] lstrlenW (lpString=".ppt") returned 4
	[0101.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0101.999] lstrlenW (lpString=".zip") returned 4
	[0101.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.999] lstrlenW (lpString=".rar") returned 4
	[0101.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.999] lstrlenW (lpString=".bz2") returned 4
	[0101.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.999] lstrlenW (lpString=".7z") returned 3
	[0101.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0101.999] lstrlenW (lpString=".dbf") returned 4
	[0101.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0101.999] lstrlenW (lpString=".1cd") returned 4
	[0101.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0101.999] lstrlenW (lpString=".jpg") returned 4
	[0101.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.999] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.000] lstrlenW (lpString="CRANE.WMF") returned 9
	[0102.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.030] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=5270) returned 1
	[0102.030] CloseHandle (hObject=0x1d0) returned 1
	[0102.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20
	[0102.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.044] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.044] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0102.059] GetLastError () returned 0x0
	[0102.059] ReadFile (in: hFile=0x1d0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1496, lpOverlapped=0x0) returned 1
	[0102.064] WriteFile (in: hFile=0x1e0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x14a0, lpOverlapped=0x0) returned 1
	[0102.065] ReadFile (in: hFile=0x1d0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.065] WriteFile (in: hFile=0x1e0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0102.065] SetEndOfFile (hFile=0x1e0) returned 1
	[0102.066] CloseHandle (hObject=0x1e0) returned 1
	[0102.071] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.071] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.078] CloseHandle (hObject=0x1d0) returned 1
	[0102.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 1
	[0102.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0102.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0102.083] lstrlenW (lpString=".doc") returned 4
	[0102.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.083] lstrlenW (lpString=".docx") returned 5
	[0102.083] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1
	[0102.083] lstrlenW (lpString=".pdf") returned 4
	[0102.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.083] lstrlenW (lpString=".xls") returned 4
	[0102.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.083] lstrlenW (lpString=".xlsx") returned 5
	[0102.083] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1
	[0102.083] lstrlenW (lpString=".ppt") returned 4
	[0102.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0102.083] lstrlenW (lpString=".zip") returned 4
	[0102.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.083] lstrlenW (lpString=".rar") returned 4
	[0102.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.083] lstrlenW (lpString=".bz2") returned 4
	[0102.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.084] lstrlenW (lpString=".7z") returned 3
	[0102.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0102.084] lstrlenW (lpString=".dbf") returned 4
	[0102.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0102.084] lstrlenW (lpString=".1cd") returned 4
	[0102.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0102.084] lstrlenW (lpString=".jpg") returned 4
	[0102.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0102.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0102.084] lstrlenW (lpString=".doc") returned 4
	[0102.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.084] lstrlenW (lpString=".docx") returned 5
	[0102.084] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1
	[0102.084] lstrlenW (lpString=".pdf") returned 4
	[0102.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.084] lstrlenW (lpString=".xls") returned 4
	[0102.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.084] lstrlenW (lpString=".xlsx") returned 5
	[0102.084] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1
	[0102.084] lstrlenW (lpString=".ppt") returned 4
	[0102.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0102.084] lstrlenW (lpString=".zip") returned 4
	[0102.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.084] lstrlenW (lpString=".rar") returned 4
	[0102.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.085] lstrlenW (lpString=".bz2") returned 4
	[0102.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.085] lstrlenW (lpString=".7z") returned 3
	[0102.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0102.085] lstrlenW (lpString=".dbf") returned 4
	[0102.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0102.085] lstrlenW (lpString=".1cd") returned 4
	[0102.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0102.085] lstrlenW (lpString=".jpg") returned 4
	[0102.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.085] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.085] lstrlenW (lpString="CUP.WMF") returned 7
	[0102.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.099] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2966) returned 1
	[0102.099] CloseHandle (hObject=0x1d4) returned 1
	[0102.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20
	[0102.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.111] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.111] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.127] GetLastError () returned 0x0
	[0102.127] ReadFile (in: hFile=0x1d4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xb96, lpOverlapped=0x0) returned 1
	[0102.129] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xba0, lpOverlapped=0x0) returned 1
	[0102.130] ReadFile (in: hFile=0x1d4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.130] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0102.130] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.131] CloseHandle (hObject=0x1a8) returned 1
	[0102.134] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.134] SetEndOfFile (hFile=0x1d4) returned 1
	[0102.141] CloseHandle (hObject=0x1d4) returned 1
	[0102.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 1
	[0102.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0102.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0102.146] lstrlenW (lpString=".doc") returned 4
	[0102.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.146] lstrlenW (lpString=".docx") returned 5
	[0102.146] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0102.146] lstrlenW (lpString=".pdf") returned 4
	[0102.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.146] lstrlenW (lpString=".xls") returned 4
	[0102.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.146] lstrlenW (lpString=".xlsx") returned 5
	[0102.146] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0102.146] lstrlenW (lpString=".ppt") returned 4
	[0102.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0102.146] lstrlenW (lpString=".zip") returned 4
	[0102.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.146] lstrlenW (lpString=".rar") returned 4
	[0102.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.146] lstrlenW (lpString=".bz2") returned 4
	[0102.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.147] lstrlenW (lpString=".7z") returned 3
	[0102.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0102.147] lstrlenW (lpString=".dbf") returned 4
	[0102.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0102.147] lstrlenW (lpString=".1cd") returned 4
	[0102.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0102.147] lstrlenW (lpString=".jpg") returned 4
	[0102.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0102.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0102.147] lstrlenW (lpString=".doc") returned 4
	[0102.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.147] lstrlenW (lpString=".docx") returned 5
	[0102.147] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0102.147] lstrlenW (lpString=".pdf") returned 4
	[0102.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.147] lstrlenW (lpString=".xls") returned 4
	[0102.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.147] lstrlenW (lpString=".xlsx") returned 5
	[0102.147] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0102.147] lstrlenW (lpString=".ppt") returned 4
	[0102.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0102.148] lstrlenW (lpString=".zip") returned 4
	[0102.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.148] lstrlenW (lpString=".rar") returned 4
	[0102.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.148] lstrlenW (lpString=".bz2") returned 4
	[0102.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.148] lstrlenW (lpString=".7z") returned 3
	[0102.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0102.148] lstrlenW (lpString=".dbf") returned 4
	[0102.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0102.148] lstrlenW (lpString=".1cd") returned 4
	[0102.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0102.148] lstrlenW (lpString=".jpg") returned 4
	[0102.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.148] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.148] lstrlenW (lpString="DD00117_.WMF") returned 12
	[0102.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.165] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=31122) returned 1
	[0102.165] CloseHandle (hObject=0x1d0) returned 1
	[0102.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20
	[0102.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.181] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.181] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0102.192] GetLastError () returned 0x0
	[0102.192] ReadFile (in: hFile=0x1d0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x7992, lpOverlapped=0x0) returned 1
	[0102.195] WriteFile (in: hFile=0x1e0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x79a0, lpOverlapped=0x0) returned 1
	[0102.197] ReadFile (in: hFile=0x1d0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.197] WriteFile (in: hFile=0x1e0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.197] SetEndOfFile (hFile=0x1e0) returned 1
	[0102.201] CloseHandle (hObject=0x1e0) returned 1
	[0102.207] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.207] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.211] CloseHandle (hObject=0x1d0) returned 1
	[0102.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 1
	[0102.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0102.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0102.213] lstrlenW (lpString=".doc") returned 4
	[0102.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.213] lstrlenW (lpString=".docx") returned 5
	[0102.213] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.213] lstrlenW (lpString=".pdf") returned 4
	[0102.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.214] lstrlenW (lpString=".xls") returned 4
	[0102.214] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.214] lstrlenW (lpString=".xlsx") returned 5
	[0102.214] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.214] lstrlenW (lpString=".ppt") returned 4
	[0102.214] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0102.214] lstrlenW (lpString=".zip") returned 4
	[0102.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.214] lstrlenW (lpString=".rar") returned 4
	[0102.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.214] lstrlenW (lpString=".bz2") returned 4
	[0102.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.214] lstrlenW (lpString=".7z") returned 3
	[0102.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0102.214] lstrlenW (lpString=".dbf") returned 4
	[0102.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0102.214] lstrlenW (lpString=".1cd") returned 4
	[0102.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0102.214] lstrlenW (lpString=".jpg") returned 4
	[0102.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0102.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0102.214] lstrlenW (lpString=".doc") returned 4
	[0102.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.215] lstrlenW (lpString=".docx") returned 5
	[0102.215] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.215] lstrlenW (lpString=".pdf") returned 4
	[0102.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.215] lstrlenW (lpString=".xls") returned 4
	[0102.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.215] lstrlenW (lpString=".xlsx") returned 5
	[0102.215] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.215] lstrlenW (lpString=".ppt") returned 4
	[0102.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0102.215] lstrlenW (lpString=".zip") returned 4
	[0102.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.215] lstrlenW (lpString=".rar") returned 4
	[0102.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.215] lstrlenW (lpString=".bz2") returned 4
	[0102.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.215] lstrlenW (lpString=".7z") returned 3
	[0102.215] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0102.215] lstrlenW (lpString=".dbf") returned 4
	[0102.215] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0102.215] lstrlenW (lpString=".1cd") returned 4
	[0102.215] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0102.216] lstrlenW (lpString=".jpg") returned 4
	[0102.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.216] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.216] lstrlenW (lpString="DD00234_.WMF") returned 12
	[0102.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.230] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=29628) returned 1
	[0102.230] CloseHandle (hObject=0x1d0) returned 1
	[0102.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20
	[0102.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.245] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.245] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.264] GetLastError () returned 0x0
	[0102.264] ReadFile (in: hFile=0x1d4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x73bc, lpOverlapped=0x0) returned 1
	[0102.267] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x73c0, lpOverlapped=0x0) returned 1
	[0102.269] ReadFile (in: hFile=0x1d4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.269] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.269] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.270] CloseHandle (hObject=0x1d8) returned 1
	[0102.273] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.273] SetEndOfFile (hFile=0x1d4) returned 1
	[0102.279] CloseHandle (hObject=0x1d4) returned 1
	[0102.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 1
	[0102.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0102.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0102.285] lstrlenW (lpString=".doc") returned 4
	[0102.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.285] lstrlenW (lpString=".docx") returned 5
	[0102.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.285] lstrlenW (lpString=".pdf") returned 4
	[0102.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.285] lstrlenW (lpString=".xls") returned 4
	[0102.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.285] lstrlenW (lpString=".xlsx") returned 5
	[0102.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.285] lstrlenW (lpString=".ppt") returned 4
	[0102.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0102.285] lstrlenW (lpString=".zip") returned 4
	[0102.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.285] lstrlenW (lpString=".rar") returned 4
	[0102.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.285] lstrlenW (lpString=".bz2") returned 4
	[0102.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.285] lstrlenW (lpString=".7z") returned 3
	[0102.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0102.285] lstrlenW (lpString=".dbf") returned 4
	[0102.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0102.285] lstrlenW (lpString=".1cd") returned 4
	[0102.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0102.286] lstrlenW (lpString=".jpg") returned 4
	[0102.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0102.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0102.286] lstrlenW (lpString=".doc") returned 4
	[0102.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.286] lstrlenW (lpString=".docx") returned 5
	[0102.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.286] lstrlenW (lpString=".pdf") returned 4
	[0102.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.286] lstrlenW (lpString=".xls") returned 4
	[0102.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.286] lstrlenW (lpString=".xlsx") returned 5
	[0102.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.286] lstrlenW (lpString=".ppt") returned 4
	[0102.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0102.286] lstrlenW (lpString=".zip") returned 4
	[0102.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.286] lstrlenW (lpString=".rar") returned 4
	[0102.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.286] lstrlenW (lpString=".bz2") returned 4
	[0102.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.287] lstrlenW (lpString=".7z") returned 3
	[0102.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0102.287] lstrlenW (lpString=".dbf") returned 4
	[0102.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0102.287] lstrlenW (lpString=".1cd") returned 4
	[0102.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0102.287] lstrlenW (lpString=".jpg") returned 4
	[0102.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.287] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.287] lstrlenW (lpString="DD00256_.WMF") returned 12
	[0102.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.301] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2832) returned 1
	[0102.301] CloseHandle (hObject=0x1d4) returned 1
	[0102.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x20
	[0102.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.318] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.318] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.328] GetLastError () returned 0x0
	[0102.328] ReadFile (in: hFile=0x1d0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xb10, lpOverlapped=0x0) returned 1
	[0102.330] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xb20, lpOverlapped=0x0) returned 1
	[0102.331] ReadFile (in: hFile=0x1d0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.332] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.332] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.334] CloseHandle (hObject=0x1a8) returned 1
	[0102.336] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.336] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.343] CloseHandle (hObject=0x1d0) returned 1
	[0102.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 1
	[0102.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0102.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0102.346] lstrlenW (lpString=".doc") returned 4
	[0102.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.347] lstrlenW (lpString=".docx") returned 5
	[0102.347] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.347] lstrlenW (lpString=".pdf") returned 4
	[0102.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.347] lstrlenW (lpString=".xls") returned 4
	[0102.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.347] lstrlenW (lpString=".xlsx") returned 5
	[0102.347] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.347] lstrlenW (lpString=".ppt") returned 4
	[0102.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0102.347] lstrlenW (lpString=".zip") returned 4
	[0102.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.347] lstrlenW (lpString=".rar") returned 4
	[0102.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.347] lstrlenW (lpString=".bz2") returned 4
	[0102.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.347] lstrlenW (lpString=".7z") returned 3
	[0102.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0102.347] lstrlenW (lpString=".dbf") returned 4
	[0102.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0102.347] lstrlenW (lpString=".1cd") returned 4
	[0102.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0102.347] lstrlenW (lpString=".jpg") returned 4
	[0102.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0102.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0102.348] lstrlenW (lpString=".doc") returned 4
	[0102.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.348] lstrlenW (lpString=".docx") returned 5
	[0102.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.348] lstrlenW (lpString=".pdf") returned 4
	[0102.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.348] lstrlenW (lpString=".xls") returned 4
	[0102.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.348] lstrlenW (lpString=".xlsx") returned 5
	[0102.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.348] lstrlenW (lpString=".ppt") returned 4
	[0102.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0102.348] lstrlenW (lpString=".zip") returned 4
	[0102.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.348] lstrlenW (lpString=".rar") returned 4
	[0102.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.348] lstrlenW (lpString=".bz2") returned 4
	[0102.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.348] lstrlenW (lpString=".7z") returned 3
	[0102.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0102.349] lstrlenW (lpString=".dbf") returned 4
	[0102.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0102.349] lstrlenW (lpString=".1cd") returned 4
	[0102.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0102.349] lstrlenW (lpString=".jpg") returned 4
	[0102.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.349] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.349] lstrlenW (lpString="DD00297_.WMF") returned 12
	[0102.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.363] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=40030) returned 1
	[0102.363] CloseHandle (hObject=0x1d4) returned 1
	[0102.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x20
	[0102.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.379] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.379] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.390] GetLastError () returned 0x0
	[0102.390] ReadFile (in: hFile=0x1d4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x9c5e, lpOverlapped=0x0) returned 1
	[0102.393] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x9c60, lpOverlapped=0x0) returned 1
	[0102.395] ReadFile (in: hFile=0x1d4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.395] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.395] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.397] CloseHandle (hObject=0x1d8) returned 1
	[0102.399] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.399] SetEndOfFile (hFile=0x1d4) returned 1
	[0102.406] CloseHandle (hObject=0x1d4) returned 1
	[0102.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 1
	[0102.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0102.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0102.411] lstrlenW (lpString=".doc") returned 4
	[0102.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.411] lstrlenW (lpString=".docx") returned 5
	[0102.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.411] lstrlenW (lpString=".pdf") returned 4
	[0102.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.411] lstrlenW (lpString=".xls") returned 4
	[0102.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.412] lstrlenW (lpString=".xlsx") returned 5
	[0102.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.412] lstrlenW (lpString=".ppt") returned 4
	[0102.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0102.412] lstrlenW (lpString=".zip") returned 4
	[0102.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.412] lstrlenW (lpString=".rar") returned 4
	[0102.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.412] lstrlenW (lpString=".bz2") returned 4
	[0102.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.412] lstrlenW (lpString=".7z") returned 3
	[0102.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0102.412] lstrlenW (lpString=".dbf") returned 4
	[0102.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0102.412] lstrlenW (lpString=".1cd") returned 4
	[0102.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0102.412] lstrlenW (lpString=".jpg") returned 4
	[0102.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0102.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0102.412] lstrlenW (lpString=".doc") returned 4
	[0102.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.413] lstrlenW (lpString=".docx") returned 5
	[0102.413] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.413] lstrlenW (lpString=".pdf") returned 4
	[0102.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.413] lstrlenW (lpString=".xls") returned 4
	[0102.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.413] lstrlenW (lpString=".xlsx") returned 5
	[0102.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.413] lstrlenW (lpString=".ppt") returned 4
	[0102.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0102.413] lstrlenW (lpString=".zip") returned 4
	[0102.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.413] lstrlenW (lpString=".rar") returned 4
	[0102.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.413] lstrlenW (lpString=".bz2") returned 4
	[0102.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.413] lstrlenW (lpString=".7z") returned 3
	[0102.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0102.413] lstrlenW (lpString=".dbf") returned 4
	[0102.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0102.413] lstrlenW (lpString=".1cd") returned 4
	[0102.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0102.413] lstrlenW (lpString=".jpg") returned 4
	[0102.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.414] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.414] lstrlenW (lpString="DD00405_.WMF") returned 12
	[0102.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.428] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=17584) returned 1
	[0102.428] CloseHandle (hObject=0x1d8) returned 1
	[0102.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x20
	[0102.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.452] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.452] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.462] GetLastError () returned 0x0
	[0102.463] ReadFile (in: hFile=0x1d0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x44b0, lpOverlapped=0x0) returned 1
	[0102.465] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x44c0, lpOverlapped=0x0) returned 1
	[0102.467] ReadFile (in: hFile=0x1d0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.467] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.467] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.471] CloseHandle (hObject=0x1a8) returned 1
	[0102.474] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.474] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.480] CloseHandle (hObject=0x1d0) returned 1
	[0102.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 1
	[0102.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0102.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0102.483] lstrlenW (lpString=".doc") returned 4
	[0102.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.483] lstrlenW (lpString=".docx") returned 5
	[0102.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.483] lstrlenW (lpString=".pdf") returned 4
	[0102.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.484] lstrlenW (lpString=".xls") returned 4
	[0102.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.484] lstrlenW (lpString=".xlsx") returned 5
	[0102.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.484] lstrlenW (lpString=".ppt") returned 4
	[0102.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0102.484] lstrlenW (lpString=".zip") returned 4
	[0102.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.484] lstrlenW (lpString=".rar") returned 4
	[0102.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.484] lstrlenW (lpString=".bz2") returned 4
	[0102.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.484] lstrlenW (lpString=".7z") returned 3
	[0102.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0102.484] lstrlenW (lpString=".dbf") returned 4
	[0102.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0102.484] lstrlenW (lpString=".1cd") returned 4
	[0102.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0102.484] lstrlenW (lpString=".jpg") returned 4
	[0102.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0102.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0102.485] lstrlenW (lpString=".doc") returned 4
	[0102.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.485] lstrlenW (lpString=".docx") returned 5
	[0102.485] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.485] lstrlenW (lpString=".pdf") returned 4
	[0102.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.485] lstrlenW (lpString=".xls") returned 4
	[0102.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.485] lstrlenW (lpString=".xlsx") returned 5
	[0102.485] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.485] lstrlenW (lpString=".ppt") returned 4
	[0102.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0102.485] lstrlenW (lpString=".zip") returned 4
	[0102.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.485] lstrlenW (lpString=".rar") returned 4
	[0102.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.485] lstrlenW (lpString=".bz2") returned 4
	[0102.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.485] lstrlenW (lpString=".7z") returned 3
	[0102.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0102.485] lstrlenW (lpString=".dbf") returned 4
	[0102.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0102.486] lstrlenW (lpString=".1cd") returned 4
	[0102.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0102.486] lstrlenW (lpString=".jpg") returned 4
	[0102.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.486] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.486] lstrlenW (lpString="DD00413_.WMF") returned 12
	[0102.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.502] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=42992) returned 1
	[0102.502] CloseHandle (hObject=0x1a8) returned 1
	[0102.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x20
	[0102.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.518] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.518] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.533] GetLastError () returned 0x0
	[0102.533] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xa7f0, lpOverlapped=0x0) returned 1
	[0102.536] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xa800, lpOverlapped=0x0) returned 1
	[0102.538] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.538] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.538] SetEndOfFile (hFile=0x184) returned 1
	[0102.539] CloseHandle (hObject=0x184) returned 1
	[0102.540] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.540] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.548] CloseHandle (hObject=0x1a8) returned 1
	[0102.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 1
	[0102.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0102.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0102.558] lstrlenW (lpString=".doc") returned 4
	[0102.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.558] lstrlenW (lpString=".docx") returned 5
	[0102.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.558] lstrlenW (lpString=".pdf") returned 4
	[0102.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.558] lstrlenW (lpString=".xls") returned 4
	[0102.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.558] lstrlenW (lpString=".xlsx") returned 5
	[0102.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.558] lstrlenW (lpString=".ppt") returned 4
	[0102.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0102.559] lstrlenW (lpString=".zip") returned 4
	[0102.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.559] lstrlenW (lpString=".rar") returned 4
	[0102.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.559] lstrlenW (lpString=".bz2") returned 4
	[0102.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.559] lstrlenW (lpString=".7z") returned 3
	[0102.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0102.559] lstrlenW (lpString=".dbf") returned 4
	[0102.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0102.559] lstrlenW (lpString=".1cd") returned 4
	[0102.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0102.559] lstrlenW (lpString=".jpg") returned 4
	[0102.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0102.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0102.559] lstrlenW (lpString=".doc") returned 4
	[0102.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.559] lstrlenW (lpString=".docx") returned 5
	[0102.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.560] lstrlenW (lpString=".pdf") returned 4
	[0102.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.560] lstrlenW (lpString=".xls") returned 4
	[0102.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.560] lstrlenW (lpString=".xlsx") returned 5
	[0102.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.560] lstrlenW (lpString=".ppt") returned 4
	[0102.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0102.560] lstrlenW (lpString=".zip") returned 4
	[0102.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.560] lstrlenW (lpString=".rar") returned 4
	[0102.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.560] lstrlenW (lpString=".bz2") returned 4
	[0102.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.560] lstrlenW (lpString=".7z") returned 3
	[0102.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0102.560] lstrlenW (lpString=".dbf") returned 4
	[0102.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0102.560] lstrlenW (lpString=".1cd") returned 4
	[0102.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0102.560] lstrlenW (lpString=".jpg") returned 4
	[0102.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.561] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.561] lstrlenW (lpString="DD00419_.WMF") returned 12
	[0102.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.593] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=712) returned 1
	[0102.593] CloseHandle (hObject=0x1d0) returned 1
	[0102.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x20
	[0102.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.609] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.609] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.622] GetLastError () returned 0x0
	[0102.622] ReadFile (in: hFile=0x1d0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x2c8, lpOverlapped=0x0) returned 1
	[0102.623] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2d0, lpOverlapped=0x0) returned 1
	[0102.624] ReadFile (in: hFile=0x1d0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.624] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.624] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.625] CloseHandle (hObject=0x1a8) returned 1
	[0102.627] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.627] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.631] CloseHandle (hObject=0x1d0) returned 1
	[0102.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 1
	[0102.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0102.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0102.640] lstrlenW (lpString=".doc") returned 4
	[0102.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.641] lstrlenW (lpString=".docx") returned 5
	[0102.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.641] lstrlenW (lpString=".pdf") returned 4
	[0102.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.641] lstrlenW (lpString=".xls") returned 4
	[0102.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.641] lstrlenW (lpString=".xlsx") returned 5
	[0102.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.641] lstrlenW (lpString=".ppt") returned 4
	[0102.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0102.641] lstrlenW (lpString=".zip") returned 4
	[0102.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.641] lstrlenW (lpString=".rar") returned 4
	[0102.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.641] lstrlenW (lpString=".bz2") returned 4
	[0102.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.641] lstrlenW (lpString=".7z") returned 3
	[0102.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0102.641] lstrlenW (lpString=".dbf") returned 4
	[0102.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0102.641] lstrlenW (lpString=".1cd") returned 4
	[0102.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0102.641] lstrlenW (lpString=".jpg") returned 4
	[0102.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0102.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0102.642] lstrlenW (lpString=".doc") returned 4
	[0102.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.642] lstrlenW (lpString=".docx") returned 5
	[0102.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.642] lstrlenW (lpString=".pdf") returned 4
	[0102.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.642] lstrlenW (lpString=".xls") returned 4
	[0102.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.642] lstrlenW (lpString=".xlsx") returned 5
	[0102.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.642] lstrlenW (lpString=".ppt") returned 4
	[0102.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0102.642] lstrlenW (lpString=".zip") returned 4
	[0102.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.642] lstrlenW (lpString=".rar") returned 4
	[0102.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.642] lstrlenW (lpString=".bz2") returned 4
	[0102.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.643] lstrlenW (lpString=".7z") returned 3
	[0102.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0102.643] lstrlenW (lpString=".dbf") returned 4
	[0102.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0102.643] lstrlenW (lpString=".1cd") returned 4
	[0102.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0102.643] lstrlenW (lpString=".jpg") returned 4
	[0102.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.643] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.643] lstrlenW (lpString="DD00448_.WMF") returned 12
	[0102.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.658] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2952) returned 1
	[0102.658] CloseHandle (hObject=0x1d0) returned 1
	[0102.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x20
	[0102.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0102.676] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.676] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.686] GetLastError () returned 0x0
	[0102.686] ReadFile (in: hFile=0x1bc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xb88, lpOverlapped=0x0) returned 1
	[0102.695] WriteFile (in: hFile=0x1d0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xb90, lpOverlapped=0x0) returned 1
	[0102.696] ReadFile (in: hFile=0x1bc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.696] WriteFile (in: hFile=0x1d0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.697] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.700] CloseHandle (hObject=0x1d0) returned 1
	[0102.702] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.702] SetEndOfFile (hFile=0x1bc) returned 1
	[0102.704] CloseHandle (hObject=0x1bc) returned 1
	[0102.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 1
	[0102.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0102.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0102.715] lstrlenW (lpString=".doc") returned 4
	[0102.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.715] lstrlenW (lpString=".docx") returned 5
	[0102.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.715] lstrlenW (lpString=".pdf") returned 4
	[0102.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.715] lstrlenW (lpString=".xls") returned 4
	[0102.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.715] lstrlenW (lpString=".xlsx") returned 5
	[0102.715] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.715] lstrlenW (lpString=".ppt") returned 4
	[0102.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0102.715] lstrlenW (lpString=".zip") returned 4
	[0102.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.716] lstrlenW (lpString=".rar") returned 4
	[0102.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.716] lstrlenW (lpString=".bz2") returned 4
	[0102.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.716] lstrlenW (lpString=".7z") returned 3
	[0102.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0102.716] lstrlenW (lpString=".dbf") returned 4
	[0102.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0102.716] lstrlenW (lpString=".1cd") returned 4
	[0102.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0102.716] lstrlenW (lpString=".jpg") returned 4
	[0102.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0102.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0102.716] lstrlenW (lpString=".doc") returned 4
	[0102.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.716] lstrlenW (lpString=".docx") returned 5
	[0102.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.716] lstrlenW (lpString=".pdf") returned 4
	[0102.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.716] lstrlenW (lpString=".xls") returned 4
	[0102.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.717] lstrlenW (lpString=".xlsx") returned 5
	[0102.717] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.717] lstrlenW (lpString=".ppt") returned 4
	[0102.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0102.717] lstrlenW (lpString=".zip") returned 4
	[0102.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.717] lstrlenW (lpString=".rar") returned 4
	[0102.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.717] lstrlenW (lpString=".bz2") returned 4
	[0102.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.717] lstrlenW (lpString=".7z") returned 3
	[0102.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0102.717] lstrlenW (lpString=".dbf") returned 4
	[0102.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0102.717] lstrlenW (lpString=".1cd") returned 4
	[0102.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0102.717] lstrlenW (lpString=".jpg") returned 4
	[0102.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.718] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.718] lstrlenW (lpString="DD00687_.WMF") returned 12
	[0102.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.729] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=20784) returned 1
	[0102.729] CloseHandle (hObject=0x1d8) returned 1
	[0102.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x20
	[0102.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0102.747] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.747] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.762] GetLastError () returned 0x0
	[0102.762] ReadFile (in: hFile=0x1bc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x5130, lpOverlapped=0x0) returned 1
	[0102.765] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x5140, lpOverlapped=0x0) returned 1
	[0102.766] ReadFile (in: hFile=0x1bc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.766] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.767] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.768] CloseHandle (hObject=0x1a8) returned 1
	[0102.768] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.768] SetEndOfFile (hFile=0x1bc) returned 1
	[0102.774] CloseHandle (hObject=0x1bc) returned 1
	[0102.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 1
	[0102.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0102.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0102.781] lstrlenW (lpString=".doc") returned 4
	[0102.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.781] lstrlenW (lpString=".docx") returned 5
	[0102.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.781] lstrlenW (lpString=".pdf") returned 4
	[0102.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.781] lstrlenW (lpString=".xls") returned 4
	[0102.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.781] lstrlenW (lpString=".xlsx") returned 5
	[0102.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.781] lstrlenW (lpString=".ppt") returned 4
	[0102.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0102.781] lstrlenW (lpString=".zip") returned 4
	[0102.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.781] lstrlenW (lpString=".rar") returned 4
	[0102.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.781] lstrlenW (lpString=".bz2") returned 4
	[0102.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.781] lstrlenW (lpString=".7z") returned 3
	[0102.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0102.781] lstrlenW (lpString=".dbf") returned 4
	[0102.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0102.782] lstrlenW (lpString=".1cd") returned 4
	[0102.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0102.782] lstrlenW (lpString=".jpg") returned 4
	[0102.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0102.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0102.782] lstrlenW (lpString=".doc") returned 4
	[0102.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.782] lstrlenW (lpString=".docx") returned 5
	[0102.782] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.782] lstrlenW (lpString=".pdf") returned 4
	[0102.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.782] lstrlenW (lpString=".xls") returned 4
	[0102.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.782] lstrlenW (lpString=".xlsx") returned 5
	[0102.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.782] lstrlenW (lpString=".ppt") returned 4
	[0102.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0102.782] lstrlenW (lpString=".zip") returned 4
	[0102.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.782] lstrlenW (lpString=".rar") returned 4
	[0102.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.782] lstrlenW (lpString=".bz2") returned 4
	[0102.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.783] lstrlenW (lpString=".7z") returned 3
	[0102.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0102.783] lstrlenW (lpString=".dbf") returned 4
	[0102.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0102.783] lstrlenW (lpString=".1cd") returned 4
	[0102.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0102.783] lstrlenW (lpString=".jpg") returned 4
	[0102.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.783] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.783] lstrlenW (lpString="DD01015_.WMF") returned 12
	[0102.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0102.794] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2226) returned 1
	[0102.794] CloseHandle (hObject=0x1bc) returned 1
	[0102.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x20
	[0102.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.816] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.816] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.827] GetLastError () returned 0x0
	[0102.828] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x8b2, lpOverlapped=0x0) returned 1
	[0102.829] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x8c0, lpOverlapped=0x0) returned 1
	[0102.830] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.831] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.831] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.832] CloseHandle (hObject=0x1d8) returned 1
	[0102.832] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.832] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.836] CloseHandle (hObject=0x1a8) returned 1
	[0102.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 1
	[0102.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0102.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0102.841] lstrlenW (lpString=".doc") returned 4
	[0102.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.841] lstrlenW (lpString=".docx") returned 5
	[0102.841] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.841] lstrlenW (lpString=".pdf") returned 4
	[0102.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.842] lstrlenW (lpString=".xls") returned 4
	[0102.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.842] lstrlenW (lpString=".xlsx") returned 5
	[0102.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.842] lstrlenW (lpString=".ppt") returned 4
	[0102.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0102.842] lstrlenW (lpString=".zip") returned 4
	[0102.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.842] lstrlenW (lpString=".rar") returned 4
	[0102.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.842] lstrlenW (lpString=".bz2") returned 4
	[0102.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.842] lstrlenW (lpString=".7z") returned 3
	[0102.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0102.842] lstrlenW (lpString=".dbf") returned 4
	[0102.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0102.842] lstrlenW (lpString=".1cd") returned 4
	[0102.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0102.842] lstrlenW (lpString=".jpg") returned 4
	[0102.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0102.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0102.842] lstrlenW (lpString=".doc") returned 4
	[0102.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.842] lstrlenW (lpString=".docx") returned 5
	[0102.843] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.843] lstrlenW (lpString=".pdf") returned 4
	[0102.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.843] lstrlenW (lpString=".xls") returned 4
	[0102.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.843] lstrlenW (lpString=".xlsx") returned 5
	[0102.843] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.843] lstrlenW (lpString=".ppt") returned 4
	[0102.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0102.843] lstrlenW (lpString=".zip") returned 4
	[0102.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.843] lstrlenW (lpString=".rar") returned 4
	[0102.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.843] lstrlenW (lpString=".bz2") returned 4
	[0102.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.843] lstrlenW (lpString=".7z") returned 3
	[0102.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0102.843] lstrlenW (lpString=".dbf") returned 4
	[0102.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0102.843] lstrlenW (lpString=".1cd") returned 4
	[0102.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0102.843] lstrlenW (lpString=".jpg") returned 4
	[0102.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.843] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.844] lstrlenW (lpString="DD01138_.WMF") returned 12
	[0102.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.852] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3692) returned 1
	[0102.852] CloseHandle (hObject=0x184) returned 1
	[0102.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x20
	[0102.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.864] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.864] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.882] GetLastError () returned 0x0
	[0102.882] ReadFile (in: hFile=0x1d4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xe6c, lpOverlapped=0x0) returned 1
	[0102.883] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe70, lpOverlapped=0x0) returned 1
	[0102.884] ReadFile (in: hFile=0x1d4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.884] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.885] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.886] CloseHandle (hObject=0x1a8) returned 1
	[0102.886] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.886] SetEndOfFile (hFile=0x1d4) returned 1
	[0102.891] CloseHandle (hObject=0x1d4) returned 1
	[0102.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 1
	[0102.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0102.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0102.897] lstrlenW (lpString=".doc") returned 4
	[0102.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.897] lstrlenW (lpString=".docx") returned 5
	[0102.897] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.897] lstrlenW (lpString=".pdf") returned 4
	[0102.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.897] lstrlenW (lpString=".xls") returned 4
	[0102.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.897] lstrlenW (lpString=".xlsx") returned 5
	[0102.897] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.897] lstrlenW (lpString=".ppt") returned 4
	[0102.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0102.898] lstrlenW (lpString=".zip") returned 4
	[0102.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.898] lstrlenW (lpString=".rar") returned 4
	[0102.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.898] lstrlenW (lpString=".bz2") returned 4
	[0102.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.898] lstrlenW (lpString=".7z") returned 3
	[0102.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0102.898] lstrlenW (lpString=".dbf") returned 4
	[0102.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0102.898] lstrlenW (lpString=".1cd") returned 4
	[0102.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0102.898] lstrlenW (lpString=".jpg") returned 4
	[0102.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0102.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0102.898] lstrlenW (lpString=".doc") returned 4
	[0102.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.898] lstrlenW (lpString=".docx") returned 5
	[0102.898] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.898] lstrlenW (lpString=".pdf") returned 4
	[0102.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.898] lstrlenW (lpString=".xls") returned 4
	[0102.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.898] lstrlenW (lpString=".xlsx") returned 5
	[0102.898] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.898] lstrlenW (lpString=".ppt") returned 4
	[0102.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0102.899] lstrlenW (lpString=".zip") returned 4
	[0102.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.899] lstrlenW (lpString=".rar") returned 4
	[0102.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.899] lstrlenW (lpString=".bz2") returned 4
	[0102.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.899] lstrlenW (lpString=".7z") returned 3
	[0102.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0102.899] lstrlenW (lpString=".dbf") returned 4
	[0102.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0102.899] lstrlenW (lpString=".1cd") returned 4
	[0102.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0102.899] lstrlenW (lpString=".jpg") returned 4
	[0102.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.899] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.899] lstrlenW (lpString="DD01140_.WMF") returned 12
	[0102.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.925] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3616) returned 1
	[0102.925] CloseHandle (hObject=0x184) returned 1
	[0102.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x20
	[0102.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.940] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.940] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.955] GetLastError () returned 0x0
	[0102.955] ReadFile (in: hFile=0x1d4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xe20, lpOverlapped=0x0) returned 1
	[0102.957] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe30, lpOverlapped=0x0) returned 1
	[0102.958] ReadFile (in: hFile=0x1d4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.959] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.959] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.962] CloseHandle (hObject=0x1a8) returned 1
	[0102.963] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.963] SetEndOfFile (hFile=0x1d4) returned 1
	[0102.974] CloseHandle (hObject=0x1d4) returned 1
	[0102.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 1
	[0102.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0102.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0102.979] lstrlenW (lpString=".doc") returned 4
	[0102.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.979] lstrlenW (lpString=".docx") returned 5
	[0102.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.979] lstrlenW (lpString=".pdf") returned 4
	[0102.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.979] lstrlenW (lpString=".xls") returned 4
	[0102.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.980] lstrlenW (lpString=".xlsx") returned 5
	[0102.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.980] lstrlenW (lpString=".ppt") returned 4
	[0102.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0102.980] lstrlenW (lpString=".zip") returned 4
	[0102.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.980] lstrlenW (lpString=".rar") returned 4
	[0102.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.980] lstrlenW (lpString=".bz2") returned 4
	[0102.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.980] lstrlenW (lpString=".7z") returned 3
	[0102.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0102.980] lstrlenW (lpString=".dbf") returned 4
	[0102.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0102.980] lstrlenW (lpString=".1cd") returned 4
	[0102.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0102.980] lstrlenW (lpString=".jpg") returned 4
	[0102.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0102.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0102.980] lstrlenW (lpString=".doc") returned 4
	[0102.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.981] lstrlenW (lpString=".docx") returned 5
	[0102.981] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.981] lstrlenW (lpString=".pdf") returned 4
	[0102.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.981] lstrlenW (lpString=".xls") returned 4
	[0102.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.981] lstrlenW (lpString=".xlsx") returned 5
	[0102.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.981] lstrlenW (lpString=".ppt") returned 4
	[0102.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0102.981] lstrlenW (lpString=".zip") returned 4
	[0102.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.981] lstrlenW (lpString=".rar") returned 4
	[0102.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.981] lstrlenW (lpString=".bz2") returned 4
	[0102.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.981] lstrlenW (lpString=".7z") returned 3
	[0102.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0102.981] lstrlenW (lpString=".dbf") returned 4
	[0102.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0102.981] lstrlenW (lpString=".1cd") returned 4
	[0102.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0102.982] lstrlenW (lpString=".jpg") returned 4
	[0102.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.982] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.982] lstrlenW (lpString="DD01145_.WMF") returned 12
	[0102.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.991] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2780) returned 1
	[0102.991] CloseHandle (hObject=0x1d8) returned 1
	[0102.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x20
	[0102.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.010] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.010] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0103.049] GetLastError () returned 0x0
	[0103.049] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xadc, lpOverlapped=0x0) returned 1
	[0103.062] WriteFile (in: hFile=0x1bc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xae0, lpOverlapped=0x0) returned 1
	[0103.063] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.063] WriteFile (in: hFile=0x1bc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.063] SetEndOfFile (hFile=0x1bc) returned 1
	[0103.104] CloseHandle (hObject=0x1bc) returned 1
	[0103.113] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.113] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.184] CloseHandle (hObject=0x1a8) returned 1
	[0103.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 1
	[0103.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0103.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0103.219] lstrlenW (lpString=".doc") returned 4
	[0103.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.219] lstrlenW (lpString=".docx") returned 5
	[0103.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.219] lstrlenW (lpString=".pdf") returned 4
	[0103.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.219] lstrlenW (lpString=".xls") returned 4
	[0103.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.219] lstrlenW (lpString=".xlsx") returned 5
	[0103.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.219] lstrlenW (lpString=".ppt") returned 4
	[0103.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0103.220] lstrlenW (lpString=".zip") returned 4
	[0103.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.220] lstrlenW (lpString=".rar") returned 4
	[0103.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.220] lstrlenW (lpString=".bz2") returned 4
	[0103.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.220] lstrlenW (lpString=".7z") returned 3
	[0103.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0103.220] lstrlenW (lpString=".dbf") returned 4
	[0103.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0103.220] lstrlenW (lpString=".1cd") returned 4
	[0103.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0103.220] lstrlenW (lpString=".jpg") returned 4
	[0103.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0103.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0103.220] lstrlenW (lpString=".doc") returned 4
	[0103.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.220] lstrlenW (lpString=".docx") returned 5
	[0103.220] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.220] lstrlenW (lpString=".pdf") returned 4
	[0103.220] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.220] lstrlenW (lpString=".xls") returned 4
	[0103.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.220] lstrlenW (lpString=".xlsx") returned 5
	[0103.221] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.221] lstrlenW (lpString=".ppt") returned 4
	[0103.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0103.221] lstrlenW (lpString=".zip") returned 4
	[0103.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.221] lstrlenW (lpString=".rar") returned 4
	[0103.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.221] lstrlenW (lpString=".bz2") returned 4
	[0103.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.221] lstrlenW (lpString=".7z") returned 3
	[0103.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0103.221] lstrlenW (lpString=".dbf") returned 4
	[0103.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0103.221] lstrlenW (lpString=".1cd") returned 4
	[0103.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0103.221] lstrlenW (lpString=".jpg") returned 4
	[0103.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.221] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.221] lstrlenW (lpString="DD01151_.WMF") returned 12
	[0103.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.342] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2960) returned 1
	[0103.342] CloseHandle (hObject=0x1d8) returned 1
	[0103.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x20
	[0103.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.343] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.343] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.344] GetLastError () returned 0x0
	[0103.344] ReadFile (in: hFile=0x1d8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xb90, lpOverlapped=0x0) returned 1
	[0103.361] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xba0, lpOverlapped=0x0) returned 1
	[0103.362] ReadFile (in: hFile=0x1d8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.362] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.362] SetEndOfFile (hFile=0x184) returned 1
	[0103.362] CloseHandle (hObject=0x184) returned 1
	[0103.362] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.362] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.363] CloseHandle (hObject=0x1d8) returned 1
	[0103.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 1
	[0103.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0103.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0103.364] lstrlenW (lpString=".doc") returned 4
	[0103.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.364] lstrlenW (lpString=".docx") returned 5
	[0103.364] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.364] lstrlenW (lpString=".pdf") returned 4
	[0103.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.364] lstrlenW (lpString=".xls") returned 4
	[0103.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.364] lstrlenW (lpString=".xlsx") returned 5
	[0103.364] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.364] lstrlenW (lpString=".ppt") returned 4
	[0103.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0103.364] lstrlenW (lpString=".zip") returned 4
	[0103.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.364] lstrlenW (lpString=".rar") returned 4
	[0103.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.364] lstrlenW (lpString=".bz2") returned 4
	[0103.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.364] lstrlenW (lpString=".7z") returned 3
	[0103.364] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0103.364] lstrlenW (lpString=".dbf") returned 4
	[0103.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0103.364] lstrlenW (lpString=".1cd") returned 4
	[0103.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0103.365] lstrlenW (lpString=".jpg") returned 4
	[0103.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0103.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0103.365] lstrlenW (lpString=".doc") returned 4
	[0103.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.365] lstrlenW (lpString=".docx") returned 5
	[0103.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.365] lstrlenW (lpString=".pdf") returned 4
	[0103.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.365] lstrlenW (lpString=".xls") returned 4
	[0103.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.365] lstrlenW (lpString=".xlsx") returned 5
	[0103.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.365] lstrlenW (lpString=".ppt") returned 4
	[0103.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0103.365] lstrlenW (lpString=".zip") returned 4
	[0103.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.365] lstrlenW (lpString=".rar") returned 4
	[0103.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.365] lstrlenW (lpString=".bz2") returned 4
	[0103.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.365] lstrlenW (lpString=".7z") returned 3
	[0103.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0103.365] lstrlenW (lpString=".dbf") returned 4
	[0103.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0103.366] lstrlenW (lpString=".1cd") returned 4
	[0103.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0103.366] lstrlenW (lpString=".jpg") returned 4
	[0103.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.366] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.366] lstrlenW (lpString="DD01157_.WMF") returned 12
	[0103.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.456] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3588) returned 1
	[0103.456] CloseHandle (hObject=0x1e4) returned 1
	[0103.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x20
	[0103.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.465] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.465] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0103.469] GetLastError () returned 0x0
	[0103.469] ReadFile (in: hFile=0x1e4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xe04, lpOverlapped=0x0) returned 1
	[0103.473] WriteFile (in: hFile=0x1dc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xe10, lpOverlapped=0x0) returned 1
	[0103.475] ReadFile (in: hFile=0x1e4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.475] WriteFile (in: hFile=0x1dc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.475] SetEndOfFile (hFile=0x1dc) returned 1
	[0103.475] CloseHandle (hObject=0x1dc) returned 1
	[0103.475] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.475] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.476] CloseHandle (hObject=0x1e4) returned 1
	[0103.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 1
	[0103.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0103.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0103.477] lstrlenW (lpString=".doc") returned 4
	[0103.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.477] lstrlenW (lpString=".docx") returned 5
	[0103.477] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.477] lstrlenW (lpString=".pdf") returned 4
	[0103.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.477] lstrlenW (lpString=".xls") returned 4
	[0103.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.477] lstrlenW (lpString=".xlsx") returned 5
	[0103.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.477] lstrlenW (lpString=".ppt") returned 4
	[0103.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0103.477] lstrlenW (lpString=".zip") returned 4
	[0103.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.477] lstrlenW (lpString=".rar") returned 4
	[0103.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.477] lstrlenW (lpString=".bz2") returned 4
	[0103.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.477] lstrlenW (lpString=".7z") returned 3
	[0103.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0103.477] lstrlenW (lpString=".dbf") returned 4
	[0103.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0103.477] lstrlenW (lpString=".1cd") returned 4
	[0103.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0103.478] lstrlenW (lpString=".jpg") returned 4
	[0103.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0103.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0103.478] lstrlenW (lpString=".doc") returned 4
	[0103.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.478] lstrlenW (lpString=".docx") returned 5
	[0103.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.478] lstrlenW (lpString=".pdf") returned 4
	[0103.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.478] lstrlenW (lpString=".xls") returned 4
	[0103.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.478] lstrlenW (lpString=".xlsx") returned 5
	[0103.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.478] lstrlenW (lpString=".ppt") returned 4
	[0103.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0103.478] lstrlenW (lpString=".zip") returned 4
	[0103.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.478] lstrlenW (lpString=".rar") returned 4
	[0103.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.478] lstrlenW (lpString=".bz2") returned 4
	[0103.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.478] lstrlenW (lpString=".7z") returned 3
	[0103.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0103.478] lstrlenW (lpString=".dbf") returned 4
	[0103.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0103.478] lstrlenW (lpString=".1cd") returned 4
	[0103.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0103.479] lstrlenW (lpString=".jpg") returned 4
	[0103.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.479] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.479] lstrlenW (lpString="DD01162_.WMF") returned 12
	[0103.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.480] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2300) returned 1
	[0103.480] CloseHandle (hObject=0x1e4) returned 1
	[0103.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x20
	[0103.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.480] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.481] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0103.481] GetLastError () returned 0x0
	[0103.481] ReadFile (in: hFile=0x1e4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x8fc, lpOverlapped=0x0) returned 1
	[0103.492] WriteFile (in: hFile=0x1dc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x900, lpOverlapped=0x0) returned 1
	[0103.493] ReadFile (in: hFile=0x1e4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.493] WriteFile (in: hFile=0x1dc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.493] SetEndOfFile (hFile=0x1dc) returned 1
	[0103.493] CloseHandle (hObject=0x1dc) returned 1
	[0103.493] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.494] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.494] CloseHandle (hObject=0x1e4) returned 1
	[0103.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 1
	[0103.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0103.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0103.495] lstrlenW (lpString=".doc") returned 4
	[0103.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.495] lstrlenW (lpString=".docx") returned 5
	[0103.495] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.495] lstrlenW (lpString=".pdf") returned 4
	[0103.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.495] lstrlenW (lpString=".xls") returned 4
	[0103.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.495] lstrlenW (lpString=".xlsx") returned 5
	[0103.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.495] lstrlenW (lpString=".ppt") returned 4
	[0103.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0103.495] lstrlenW (lpString=".zip") returned 4
	[0103.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.495] lstrlenW (lpString=".rar") returned 4
	[0103.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.496] lstrlenW (lpString=".bz2") returned 4
	[0103.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.496] lstrlenW (lpString=".7z") returned 3
	[0103.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0103.496] lstrlenW (lpString=".dbf") returned 4
	[0103.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0103.496] lstrlenW (lpString=".1cd") returned 4
	[0103.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0103.496] lstrlenW (lpString=".jpg") returned 4
	[0103.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0103.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0103.496] lstrlenW (lpString=".doc") returned 4
	[0103.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.496] lstrlenW (lpString=".docx") returned 5
	[0103.496] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.496] lstrlenW (lpString=".pdf") returned 4
	[0103.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.496] lstrlenW (lpString=".xls") returned 4
	[0103.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.496] lstrlenW (lpString=".xlsx") returned 5
	[0103.496] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.496] lstrlenW (lpString=".ppt") returned 4
	[0103.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0103.496] lstrlenW (lpString=".zip") returned 4
	[0103.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.497] lstrlenW (lpString=".rar") returned 4
	[0103.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.497] lstrlenW (lpString=".bz2") returned 4
	[0103.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.497] lstrlenW (lpString=".7z") returned 3
	[0103.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0103.497] lstrlenW (lpString=".dbf") returned 4
	[0103.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0103.497] lstrlenW (lpString=".1cd") returned 4
	[0103.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0103.497] lstrlenW (lpString=".jpg") returned 4
	[0103.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.497] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.497] lstrlenW (lpString="DD01166_.WMF") returned 12
	[0103.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.525] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2080) returned 1
	[0103.525] CloseHandle (hObject=0x1a8) returned 1
	[0103.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x20
	[0103.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.532] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.532] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.536] GetLastError () returned 0x0
	[0103.536] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x820, lpOverlapped=0x0) returned 1
	[0103.539] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x830, lpOverlapped=0x0) returned 1
	[0103.540] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.541] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.541] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.582] CloseHandle (hObject=0x1d8) returned 1
	[0103.585] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.585] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.588] CloseHandle (hObject=0x1a8) returned 1
	[0103.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 1
	[0103.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0103.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0103.588] lstrlenW (lpString=".doc") returned 4
	[0103.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.588] lstrlenW (lpString=".docx") returned 5
	[0103.588] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.589] lstrlenW (lpString=".pdf") returned 4
	[0103.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.589] lstrlenW (lpString=".xls") returned 4
	[0103.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.589] lstrlenW (lpString=".xlsx") returned 5
	[0103.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.589] lstrlenW (lpString=".ppt") returned 4
	[0103.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0103.589] lstrlenW (lpString=".zip") returned 4
	[0103.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.589] lstrlenW (lpString=".rar") returned 4
	[0103.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.589] lstrlenW (lpString=".bz2") returned 4
	[0103.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.589] lstrlenW (lpString=".7z") returned 3
	[0103.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0103.589] lstrlenW (lpString=".dbf") returned 4
	[0103.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0103.589] lstrlenW (lpString=".1cd") returned 4
	[0103.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0103.589] lstrlenW (lpString=".jpg") returned 4
	[0103.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0103.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0103.590] lstrlenW (lpString=".doc") returned 4
	[0103.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.590] lstrlenW (lpString=".docx") returned 5
	[0103.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.590] lstrlenW (lpString=".pdf") returned 4
	[0103.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.590] lstrlenW (lpString=".xls") returned 4
	[0103.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.590] lstrlenW (lpString=".xlsx") returned 5
	[0103.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.590] lstrlenW (lpString=".ppt") returned 4
	[0103.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0103.590] lstrlenW (lpString=".zip") returned 4
	[0103.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.590] lstrlenW (lpString=".rar") returned 4
	[0103.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.590] lstrlenW (lpString=".bz2") returned 4
	[0103.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.590] lstrlenW (lpString=".7z") returned 3
	[0103.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0103.590] lstrlenW (lpString=".dbf") returned 4
	[0103.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0103.590] lstrlenW (lpString=".1cd") returned 4
	[0103.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0103.590] lstrlenW (lpString=".jpg") returned 4
	[0103.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.591] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.591] lstrlenW (lpString="DD01168_.WMF") returned 12
	[0103.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.592] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2004) returned 1
	[0103.592] CloseHandle (hObject=0x1a8) returned 1
	[0103.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x20
	[0103.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.592] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.592] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.593] GetLastError () returned 0x0
	[0103.593] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x7d4, lpOverlapped=0x0) returned 1
	[0103.601] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x7e0, lpOverlapped=0x0) returned 1
	[0103.602] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.602] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.602] SetEndOfFile (hFile=0x1e8) returned 1
	[0103.602] CloseHandle (hObject=0x1e8) returned 1
	[0103.602] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.602] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.603] CloseHandle (hObject=0x1a8) returned 1
	[0103.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 1
	[0103.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0103.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0103.605] lstrlenW (lpString=".doc") returned 4
	[0103.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.605] lstrlenW (lpString=".docx") returned 5
	[0103.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.605] lstrlenW (lpString=".pdf") returned 4
	[0103.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.605] lstrlenW (lpString=".xls") returned 4
	[0103.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.606] lstrlenW (lpString=".xlsx") returned 5
	[0103.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.606] lstrlenW (lpString=".ppt") returned 4
	[0103.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0103.606] lstrlenW (lpString=".zip") returned 4
	[0103.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.606] lstrlenW (lpString=".rar") returned 4
	[0103.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.606] lstrlenW (lpString=".bz2") returned 4
	[0103.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.606] lstrlenW (lpString=".7z") returned 3
	[0103.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0103.606] lstrlenW (lpString=".dbf") returned 4
	[0103.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0103.606] lstrlenW (lpString=".1cd") returned 4
	[0103.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0103.606] lstrlenW (lpString=".jpg") returned 4
	[0103.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0103.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0103.606] lstrlenW (lpString=".doc") returned 4
	[0103.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.606] lstrlenW (lpString=".docx") returned 5
	[0103.607] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.607] lstrlenW (lpString=".pdf") returned 4
	[0103.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.607] lstrlenW (lpString=".xls") returned 4
	[0103.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.607] lstrlenW (lpString=".xlsx") returned 5
	[0103.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.607] lstrlenW (lpString=".ppt") returned 4
	[0103.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0103.607] lstrlenW (lpString=".zip") returned 4
	[0103.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.607] lstrlenW (lpString=".rar") returned 4
	[0103.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.607] lstrlenW (lpString=".bz2") returned 4
	[0103.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.607] lstrlenW (lpString=".7z") returned 3
	[0103.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0103.607] lstrlenW (lpString=".dbf") returned 4
	[0103.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0103.607] lstrlenW (lpString=".1cd") returned 4
	[0103.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0103.607] lstrlenW (lpString=".jpg") returned 4
	[0103.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.607] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.608] lstrlenW (lpString="DD01170_.WMF") returned 12
	[0103.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.612] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2404) returned 1
	[0103.612] CloseHandle (hObject=0x1a8) returned 1
	[0103.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x20
	[0103.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.648] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.648] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.651] GetLastError () returned 0x0
	[0103.651] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x964, lpOverlapped=0x0) returned 1
	[0103.666] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x970, lpOverlapped=0x0) returned 1
	[0103.667] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.667] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.667] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.667] CloseHandle (hObject=0x1a8) returned 1
	[0103.668] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.669] SetEndOfFile (hFile=0x1e8) returned 1
	[0103.670] CloseHandle (hObject=0x1e8) returned 1
	[0103.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 1
	[0103.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0103.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0103.671] lstrlenW (lpString=".doc") returned 4
	[0103.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.671] lstrlenW (lpString=".docx") returned 5
	[0103.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.671] lstrlenW (lpString=".pdf") returned 4
	[0103.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.672] lstrlenW (lpString=".xls") returned 4
	[0103.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.672] lstrlenW (lpString=".xlsx") returned 5
	[0103.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.672] lstrlenW (lpString=".ppt") returned 4
	[0103.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0103.672] lstrlenW (lpString=".zip") returned 4
	[0103.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.672] lstrlenW (lpString=".rar") returned 4
	[0103.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.672] lstrlenW (lpString=".bz2") returned 4
	[0103.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.672] lstrlenW (lpString=".7z") returned 3
	[0103.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0103.672] lstrlenW (lpString=".dbf") returned 4
	[0103.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0103.672] lstrlenW (lpString=".1cd") returned 4
	[0103.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0103.672] lstrlenW (lpString=".jpg") returned 4
	[0103.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0103.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0103.673] lstrlenW (lpString=".doc") returned 4
	[0103.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.673] lstrlenW (lpString=".docx") returned 5
	[0103.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.673] lstrlenW (lpString=".pdf") returned 4
	[0103.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.673] lstrlenW (lpString=".xls") returned 4
	[0103.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.673] lstrlenW (lpString=".xlsx") returned 5
	[0103.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.673] lstrlenW (lpString=".ppt") returned 4
	[0103.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0103.673] lstrlenW (lpString=".zip") returned 4
	[0103.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.673] lstrlenW (lpString=".rar") returned 4
	[0103.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.673] lstrlenW (lpString=".bz2") returned 4
	[0103.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.673] lstrlenW (lpString=".7z") returned 3
	[0103.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0103.674] lstrlenW (lpString=".dbf") returned 4
	[0103.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0103.674] lstrlenW (lpString=".1cd") returned 4
	[0103.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0103.674] lstrlenW (lpString=".jpg") returned 4
	[0103.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.674] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.674] lstrlenW (lpString="DD01172_.WMF") returned 12
	[0103.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.675] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2232) returned 1
	[0103.675] CloseHandle (hObject=0x1e8) returned 1
	[0103.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x20
	[0103.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.676] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.676] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.677] GetLastError () returned 0x0
	[0103.677] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x8b8, lpOverlapped=0x0) returned 1
	[0103.689] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x8c0, lpOverlapped=0x0) returned 1
	[0103.690] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.690] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.691] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.691] CloseHandle (hObject=0x1a8) returned 1
	[0103.691] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.691] SetEndOfFile (hFile=0x1e8) returned 1
	[0103.692] CloseHandle (hObject=0x1e8) returned 1
	[0103.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 1
	[0103.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0103.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0103.694] lstrlenW (lpString=".doc") returned 4
	[0103.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.694] lstrlenW (lpString=".docx") returned 5
	[0103.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.694] lstrlenW (lpString=".pdf") returned 4
	[0103.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.695] lstrlenW (lpString=".xls") returned 4
	[0103.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.695] lstrlenW (lpString=".xlsx") returned 5
	[0103.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.695] lstrlenW (lpString=".ppt") returned 4
	[0103.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0103.695] lstrlenW (lpString=".zip") returned 4
	[0103.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.695] lstrlenW (lpString=".rar") returned 4
	[0103.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.695] lstrlenW (lpString=".bz2") returned 4
	[0103.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.695] lstrlenW (lpString=".7z") returned 3
	[0103.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0103.695] lstrlenW (lpString=".dbf") returned 4
	[0103.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0103.695] lstrlenW (lpString=".1cd") returned 4
	[0103.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0103.696] lstrlenW (lpString=".jpg") returned 4
	[0103.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0103.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0103.696] lstrlenW (lpString=".doc") returned 4
	[0103.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.696] lstrlenW (lpString=".docx") returned 5
	[0103.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.696] lstrlenW (lpString=".pdf") returned 4
	[0103.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.696] lstrlenW (lpString=".xls") returned 4
	[0103.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.696] lstrlenW (lpString=".xlsx") returned 5
	[0103.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.696] lstrlenW (lpString=".ppt") returned 4
	[0103.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0103.696] lstrlenW (lpString=".zip") returned 4
	[0103.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.696] lstrlenW (lpString=".rar") returned 4
	[0103.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.697] lstrlenW (lpString=".bz2") returned 4
	[0103.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.697] lstrlenW (lpString=".7z") returned 3
	[0103.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0103.697] lstrlenW (lpString=".dbf") returned 4
	[0103.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0103.697] lstrlenW (lpString=".1cd") returned 4
	[0103.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0103.697] lstrlenW (lpString=".jpg") returned 4
	[0103.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.697] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.697] lstrlenW (lpString="DD01176_.WMF") returned 12
	[0103.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.703] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1888) returned 1
	[0103.703] CloseHandle (hObject=0x1e8) returned 1
	[0103.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x20
	[0103.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.736] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.736] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.740] GetLastError () returned 0x0
	[0103.740] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x760, lpOverlapped=0x0) returned 1
	[0103.754] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x770, lpOverlapped=0x0) returned 1
	[0103.755] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.755] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.755] SetEndOfFile (hFile=0x1e8) returned 1
	[0103.756] CloseHandle (hObject=0x1e8) returned 1
	[0103.756] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.756] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.757] CloseHandle (hObject=0x1a8) returned 1
	[0103.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 1
	[0103.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0103.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0103.757] lstrlenW (lpString=".doc") returned 4
	[0103.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.757] lstrlenW (lpString=".docx") returned 5
	[0103.757] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.757] lstrlenW (lpString=".pdf") returned 4
	[0103.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.757] lstrlenW (lpString=".xls") returned 4
	[0103.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.757] lstrlenW (lpString=".xlsx") returned 5
	[0103.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.758] lstrlenW (lpString=".ppt") returned 4
	[0103.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0103.758] lstrlenW (lpString=".zip") returned 4
	[0103.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.758] lstrlenW (lpString=".rar") returned 4
	[0103.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.758] lstrlenW (lpString=".bz2") returned 4
	[0103.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.758] lstrlenW (lpString=".7z") returned 3
	[0103.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0103.758] lstrlenW (lpString=".dbf") returned 4
	[0103.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0103.758] lstrlenW (lpString=".1cd") returned 4
	[0103.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0103.758] lstrlenW (lpString=".jpg") returned 4
	[0103.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0103.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0103.758] lstrlenW (lpString=".doc") returned 4
	[0103.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.759] lstrlenW (lpString=".docx") returned 5
	[0103.759] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.759] lstrlenW (lpString=".pdf") returned 4
	[0103.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.759] lstrlenW (lpString=".xls") returned 4
	[0103.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.759] lstrlenW (lpString=".xlsx") returned 5
	[0103.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.759] lstrlenW (lpString=".ppt") returned 4
	[0103.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0103.759] lstrlenW (lpString=".zip") returned 4
	[0103.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.759] lstrlenW (lpString=".rar") returned 4
	[0103.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.759] lstrlenW (lpString=".bz2") returned 4
	[0103.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.759] lstrlenW (lpString=".7z") returned 3
	[0103.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0103.759] lstrlenW (lpString=".dbf") returned 4
	[0103.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0103.760] lstrlenW (lpString=".1cd") returned 4
	[0103.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0103.760] lstrlenW (lpString=".jpg") returned 4
	[0103.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.760] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.760] lstrlenW (lpString="DD01179_.WMF") returned 12
	[0103.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.761] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2024) returned 1
	[0103.762] CloseHandle (hObject=0x1a8) returned 1
	[0103.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x20
	[0103.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.762] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.763] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.764] GetLastError () returned 0x0
	[0103.764] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x7e8, lpOverlapped=0x0) returned 1
	[0103.777] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x7f0, lpOverlapped=0x0) returned 1
	[0103.781] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.781] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.781] SetEndOfFile (hFile=0x1e8) returned 1
	[0103.782] CloseHandle (hObject=0x1e8) returned 1
	[0103.782] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.782] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.783] CloseHandle (hObject=0x1a8) returned 1
	[0103.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 1
	[0103.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0103.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0103.784] lstrlenW (lpString=".doc") returned 4
	[0103.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.784] lstrlenW (lpString=".docx") returned 5
	[0103.784] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.784] lstrlenW (lpString=".pdf") returned 4
	[0103.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.784] lstrlenW (lpString=".xls") returned 4
	[0103.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.784] lstrlenW (lpString=".xlsx") returned 5
	[0103.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.784] lstrlenW (lpString=".ppt") returned 4
	[0103.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0103.784] lstrlenW (lpString=".zip") returned 4
	[0103.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.784] lstrlenW (lpString=".rar") returned 4
	[0103.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.784] lstrlenW (lpString=".bz2") returned 4
	[0103.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.784] lstrlenW (lpString=".7z") returned 3
	[0103.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0103.784] lstrlenW (lpString=".dbf") returned 4
	[0103.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0103.784] lstrlenW (lpString=".1cd") returned 4
	[0103.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0103.785] lstrlenW (lpString=".jpg") returned 4
	[0103.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0103.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0103.785] lstrlenW (lpString=".doc") returned 4
	[0103.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.785] lstrlenW (lpString=".docx") returned 5
	[0103.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.785] lstrlenW (lpString=".pdf") returned 4
	[0103.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.785] lstrlenW (lpString=".xls") returned 4
	[0103.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.785] lstrlenW (lpString=".xlsx") returned 5
	[0103.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.785] lstrlenW (lpString=".ppt") returned 4
	[0103.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0103.785] lstrlenW (lpString=".zip") returned 4
	[0103.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.785] lstrlenW (lpString=".rar") returned 4
	[0103.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.785] lstrlenW (lpString=".bz2") returned 4
	[0103.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.785] lstrlenW (lpString=".7z") returned 3
	[0103.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0103.786] lstrlenW (lpString=".dbf") returned 4
	[0103.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0103.786] lstrlenW (lpString=".1cd") returned 4
	[0103.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0103.786] lstrlenW (lpString=".jpg") returned 4
	[0103.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.786] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.786] lstrlenW (lpString="DD01181_.WMF") returned 12
	[0103.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.797] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1448) returned 1
	[0103.797] CloseHandle (hObject=0x1e4) returned 1
	[0103.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x20
	[0103.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.806] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.807] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.891] GetLastError () returned 0x0
	[0103.891] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x5a8, lpOverlapped=0x0) returned 1
	[0103.896] WriteFile (in: hFile=0x1e4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0103.898] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.898] WriteFile (in: hFile=0x1e4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.898] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.898] CloseHandle (hObject=0x1e4) returned 1
	[0103.898] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.898] SetEndOfFile (hFile=0x1e8) returned 1
	[0103.899] CloseHandle (hObject=0x1e8) returned 1
	[0103.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 1
	[0103.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0103.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0103.900] lstrlenW (lpString=".doc") returned 4
	[0103.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.900] lstrlenW (lpString=".docx") returned 5
	[0103.900] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.900] lstrlenW (lpString=".pdf") returned 4
	[0103.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.900] lstrlenW (lpString=".xls") returned 4
	[0103.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.901] lstrlenW (lpString=".xlsx") returned 5
	[0103.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.901] lstrlenW (lpString=".ppt") returned 4
	[0103.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0103.901] lstrlenW (lpString=".zip") returned 4
	[0103.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.918] lstrlenW (lpString=".rar") returned 4
	[0103.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.918] lstrlenW (lpString=".bz2") returned 4
	[0103.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.918] lstrlenW (lpString=".7z") returned 3
	[0103.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0103.918] lstrlenW (lpString=".dbf") returned 4
	[0103.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0103.918] lstrlenW (lpString=".1cd") returned 4
	[0103.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0103.918] lstrlenW (lpString=".jpg") returned 4
	[0103.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0103.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0103.919] lstrlenW (lpString=".doc") returned 4
	[0103.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.919] lstrlenW (lpString=".docx") returned 5
	[0103.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.919] lstrlenW (lpString=".pdf") returned 4
	[0103.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.919] lstrlenW (lpString=".xls") returned 4
	[0103.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.919] lstrlenW (lpString=".xlsx") returned 5
	[0103.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.919] lstrlenW (lpString=".ppt") returned 4
	[0103.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0103.919] lstrlenW (lpString=".zip") returned 4
	[0103.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.919] lstrlenW (lpString=".rar") returned 4
	[0103.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.919] lstrlenW (lpString=".bz2") returned 4
	[0103.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.919] lstrlenW (lpString=".7z") returned 3
	[0103.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0103.919] lstrlenW (lpString=".dbf") returned 4
	[0103.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0103.919] lstrlenW (lpString=".1cd") returned 4
	[0103.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0103.920] lstrlenW (lpString=".jpg") returned 4
	[0103.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.920] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.920] lstrlenW (lpString="DD01183_.WMF") returned 12
	[0103.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.921] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2296) returned 1
	[0103.921] CloseHandle (hObject=0x1e8) returned 1
	[0103.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x20
	[0103.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.922] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.922] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.923] GetLastError () returned 0x0
	[0103.923] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x8f8, lpOverlapped=0x0) returned 1
	[0103.937] WriteFile (in: hFile=0x1e4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x900, lpOverlapped=0x0) returned 1
	[0103.939] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.939] WriteFile (in: hFile=0x1e4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.939] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.939] CloseHandle (hObject=0x1e4) returned 1
	[0103.939] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.939] SetEndOfFile (hFile=0x1e8) returned 1
	[0103.940] CloseHandle (hObject=0x1e8) returned 1
	[0103.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 1
	[0103.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0103.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0103.941] lstrlenW (lpString=".doc") returned 4
	[0103.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.941] lstrlenW (lpString=".docx") returned 5
	[0103.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.941] lstrlenW (lpString=".pdf") returned 4
	[0103.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.941] lstrlenW (lpString=".xls") returned 4
	[0103.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.942] lstrlenW (lpString=".xlsx") returned 5
	[0103.942] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.942] lstrlenW (lpString=".ppt") returned 4
	[0103.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0103.942] lstrlenW (lpString=".zip") returned 4
	[0103.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.942] lstrlenW (lpString=".rar") returned 4
	[0103.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.942] lstrlenW (lpString=".bz2") returned 4
	[0103.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.942] lstrlenW (lpString=".7z") returned 3
	[0103.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0103.942] lstrlenW (lpString=".dbf") returned 4
	[0103.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0103.942] lstrlenW (lpString=".1cd") returned 4
	[0103.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0103.942] lstrlenW (lpString=".jpg") returned 4
	[0103.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0103.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0103.943] lstrlenW (lpString=".doc") returned 4
	[0103.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.943] lstrlenW (lpString=".docx") returned 5
	[0103.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.943] lstrlenW (lpString=".pdf") returned 4
	[0103.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.943] lstrlenW (lpString=".xls") returned 4
	[0103.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.943] lstrlenW (lpString=".xlsx") returned 5
	[0103.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.943] lstrlenW (lpString=".ppt") returned 4
	[0103.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0103.943] lstrlenW (lpString=".zip") returned 4
	[0103.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.943] lstrlenW (lpString=".rar") returned 4
	[0103.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.943] lstrlenW (lpString=".bz2") returned 4
	[0103.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.943] lstrlenW (lpString=".7z") returned 3
	[0103.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0103.943] lstrlenW (lpString=".dbf") returned 4
	[0103.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0103.944] lstrlenW (lpString=".1cd") returned 4
	[0103.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0103.944] lstrlenW (lpString=".jpg") returned 4
	[0103.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.944] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.944] lstrlenW (lpString="DD01366_.WMF") returned 12
	[0103.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.963] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=1768) returned 1
	[0103.963] CloseHandle (hObject=0x184) returned 1
	[0103.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x20
	[0103.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.975] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.975] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.015] GetLastError () returned 0x0
	[0104.015] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x6e8, lpOverlapped=0x0) returned 1
	[0104.020] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x6f0, lpOverlapped=0x0) returned 1
	[0104.021] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.021] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.021] SetEndOfFile (hFile=0x1a8) returned 1
	[0104.021] CloseHandle (hObject=0x1a8) returned 1
	[0104.021] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.021] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.022] CloseHandle (hObject=0x1e8) returned 1
	[0104.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 1
	[0104.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0104.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0104.023] lstrlenW (lpString=".doc") returned 4
	[0104.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.023] lstrlenW (lpString=".docx") returned 5
	[0104.023] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.023] lstrlenW (lpString=".pdf") returned 4
	[0104.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.023] lstrlenW (lpString=".xls") returned 4
	[0104.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.023] lstrlenW (lpString=".xlsx") returned 5
	[0104.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.024] lstrlenW (lpString=".ppt") returned 4
	[0104.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0104.024] lstrlenW (lpString=".zip") returned 4
	[0104.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.024] lstrlenW (lpString=".rar") returned 4
	[0104.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.024] lstrlenW (lpString=".bz2") returned 4
	[0104.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.024] lstrlenW (lpString=".7z") returned 3
	[0104.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0104.024] lstrlenW (lpString=".dbf") returned 4
	[0104.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0104.024] lstrlenW (lpString=".1cd") returned 4
	[0104.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0104.024] lstrlenW (lpString=".jpg") returned 4
	[0104.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0104.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0104.025] lstrlenW (lpString=".doc") returned 4
	[0104.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.025] lstrlenW (lpString=".docx") returned 5
	[0104.025] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.025] lstrlenW (lpString=".pdf") returned 4
	[0104.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.025] lstrlenW (lpString=".xls") returned 4
	[0104.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.025] lstrlenW (lpString=".xlsx") returned 5
	[0104.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.025] lstrlenW (lpString=".ppt") returned 4
	[0104.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0104.025] lstrlenW (lpString=".zip") returned 4
	[0104.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.025] lstrlenW (lpString=".rar") returned 4
	[0104.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.025] lstrlenW (lpString=".bz2") returned 4
	[0104.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.025] lstrlenW (lpString=".7z") returned 3
	[0104.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0104.025] lstrlenW (lpString=".dbf") returned 4
	[0104.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0104.026] lstrlenW (lpString=".1cd") returned 4
	[0104.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0104.026] lstrlenW (lpString=".jpg") returned 4
	[0104.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.026] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.026] lstrlenW (lpString="DD01585_.WMF") returned 12
	[0104.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.028] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2524) returned 1
	[0104.028] CloseHandle (hObject=0x1e8) returned 1
	[0104.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x20
	[0104.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.029] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.029] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.030] GetLastError () returned 0x0
	[0104.030] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x9dc, lpOverlapped=0x0) returned 1
	[0104.045] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x9e0, lpOverlapped=0x0) returned 1
	[0104.046] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.046] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.046] SetEndOfFile (hFile=0x1a8) returned 1
	[0104.046] CloseHandle (hObject=0x1a8) returned 1
	[0104.047] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.047] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.048] CloseHandle (hObject=0x1e8) returned 1
	[0104.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 1
	[0104.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0104.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0104.048] lstrlenW (lpString=".doc") returned 4
	[0104.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.049] lstrlenW (lpString=".docx") returned 5
	[0104.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.049] lstrlenW (lpString=".pdf") returned 4
	[0104.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.049] lstrlenW (lpString=".xls") returned 4
	[0104.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.049] lstrlenW (lpString=".xlsx") returned 5
	[0104.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.049] lstrlenW (lpString=".ppt") returned 4
	[0104.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0104.049] lstrlenW (lpString=".zip") returned 4
	[0104.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.049] lstrlenW (lpString=".rar") returned 4
	[0104.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.049] lstrlenW (lpString=".bz2") returned 4
	[0104.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.049] lstrlenW (lpString=".7z") returned 3
	[0104.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0104.049] lstrlenW (lpString=".dbf") returned 4
	[0104.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0104.049] lstrlenW (lpString=".1cd") returned 4
	[0104.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0104.050] lstrlenW (lpString=".jpg") returned 4
	[0104.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0104.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0104.050] lstrlenW (lpString=".doc") returned 4
	[0104.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.050] lstrlenW (lpString=".docx") returned 5
	[0104.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.050] lstrlenW (lpString=".pdf") returned 4
	[0104.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.050] lstrlenW (lpString=".xls") returned 4
	[0104.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.050] lstrlenW (lpString=".xlsx") returned 5
	[0104.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.050] lstrlenW (lpString=".ppt") returned 4
	[0104.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0104.050] lstrlenW (lpString=".zip") returned 4
	[0104.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.050] lstrlenW (lpString=".rar") returned 4
	[0104.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.050] lstrlenW (lpString=".bz2") returned 4
	[0104.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.050] lstrlenW (lpString=".7z") returned 3
	[0104.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0104.051] lstrlenW (lpString=".dbf") returned 4
	[0104.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0104.051] lstrlenW (lpString=".1cd") returned 4
	[0104.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0104.051] lstrlenW (lpString=".jpg") returned 4
	[0104.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.051] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.051] lstrlenW (lpString="DD01628_.WMF") returned 12
	[0104.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.052] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=19068) returned 1
	[0104.052] CloseHandle (hObject=0x1e8) returned 1
	[0104.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x20
	[0104.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.053] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.053] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.054] GetLastError () returned 0x0
	[0104.054] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x4a7c, lpOverlapped=0x0) returned 1
	[0104.089] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x4a80, lpOverlapped=0x0) returned 1
	[0104.090] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.090] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.091] SetEndOfFile (hFile=0x1a8) returned 1
	[0104.091] CloseHandle (hObject=0x1a8) returned 1
	[0104.091] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.091] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.092] CloseHandle (hObject=0x1e8) returned 1
	[0104.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 1
	[0104.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0104.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0104.093] lstrlenW (lpString=".doc") returned 4
	[0104.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.093] lstrlenW (lpString=".docx") returned 5
	[0104.093] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.093] lstrlenW (lpString=".pdf") returned 4
	[0104.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.093] lstrlenW (lpString=".xls") returned 4
	[0104.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.093] lstrlenW (lpString=".xlsx") returned 5
	[0104.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.093] lstrlenW (lpString=".ppt") returned 4
	[0104.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0104.093] lstrlenW (lpString=".zip") returned 4
	[0104.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.093] lstrlenW (lpString=".rar") returned 4
	[0104.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.093] lstrlenW (lpString=".bz2") returned 4
	[0104.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.094] lstrlenW (lpString=".7z") returned 3
	[0104.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0104.094] lstrlenW (lpString=".dbf") returned 4
	[0104.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0104.094] lstrlenW (lpString=".1cd") returned 4
	[0104.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0104.094] lstrlenW (lpString=".jpg") returned 4
	[0104.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0104.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0104.094] lstrlenW (lpString=".doc") returned 4
	[0104.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.094] lstrlenW (lpString=".docx") returned 5
	[0104.094] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.094] lstrlenW (lpString=".pdf") returned 4
	[0104.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.094] lstrlenW (lpString=".xls") returned 4
	[0104.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.094] lstrlenW (lpString=".xlsx") returned 5
	[0104.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.095] lstrlenW (lpString=".ppt") returned 4
	[0104.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0104.095] lstrlenW (lpString=".zip") returned 4
	[0104.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.095] lstrlenW (lpString=".rar") returned 4
	[0104.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.095] lstrlenW (lpString=".bz2") returned 4
	[0104.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.095] lstrlenW (lpString=".7z") returned 3
	[0104.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0104.095] lstrlenW (lpString=".dbf") returned 4
	[0104.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0104.095] lstrlenW (lpString=".1cd") returned 4
	[0104.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0104.095] lstrlenW (lpString=".jpg") returned 4
	[0104.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.095] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.096] lstrlenW (lpString="DD01761_.WMF") returned 12
	[0104.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.097] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=4148) returned 1
	[0104.097] CloseHandle (hObject=0x1e8) returned 1
	[0104.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x20
	[0104.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.098] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.098] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.099] GetLastError () returned 0x0
	[0104.099] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1034, lpOverlapped=0x0) returned 1
	[0104.112] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1040, lpOverlapped=0x0) returned 1
	[0104.114] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.114] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.114] SetEndOfFile (hFile=0x1a8) returned 1
	[0104.114] CloseHandle (hObject=0x1a8) returned 1
	[0104.114] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.114] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.115] CloseHandle (hObject=0x1e8) returned 1
	[0104.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 1
	[0104.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0104.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0104.118] lstrlenW (lpString=".doc") returned 4
	[0104.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.118] lstrlenW (lpString=".docx") returned 5
	[0104.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.119] lstrlenW (lpString=".pdf") returned 4
	[0104.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.119] lstrlenW (lpString=".xls") returned 4
	[0104.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.119] lstrlenW (lpString=".xlsx") returned 5
	[0104.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.119] lstrlenW (lpString=".ppt") returned 4
	[0104.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0104.119] lstrlenW (lpString=".zip") returned 4
	[0104.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.119] lstrlenW (lpString=".rar") returned 4
	[0104.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.119] lstrlenW (lpString=".bz2") returned 4
	[0104.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.119] lstrlenW (lpString=".7z") returned 3
	[0104.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0104.119] lstrlenW (lpString=".dbf") returned 4
	[0104.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0104.119] lstrlenW (lpString=".1cd") returned 4
	[0104.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0104.119] lstrlenW (lpString=".jpg") returned 4
	[0104.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0104.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0104.120] lstrlenW (lpString=".doc") returned 4
	[0104.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.120] lstrlenW (lpString=".docx") returned 5
	[0104.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.120] lstrlenW (lpString=".pdf") returned 4
	[0104.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.120] lstrlenW (lpString=".xls") returned 4
	[0104.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.120] lstrlenW (lpString=".xlsx") returned 5
	[0104.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.120] lstrlenW (lpString=".ppt") returned 4
	[0104.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0104.120] lstrlenW (lpString=".zip") returned 4
	[0104.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.120] lstrlenW (lpString=".rar") returned 4
	[0104.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.120] lstrlenW (lpString=".bz2") returned 4
	[0104.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.120] lstrlenW (lpString=".7z") returned 3
	[0104.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0104.121] lstrlenW (lpString=".dbf") returned 4
	[0104.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0104.121] lstrlenW (lpString=".1cd") returned 4
	[0104.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0104.121] lstrlenW (lpString=".jpg") returned 4
	[0104.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.121] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.121] lstrlenW (lpString="DD01793_.WMF") returned 12
	[0104.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.131] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3252) returned 1
	[0104.131] CloseHandle (hObject=0x1e8) returned 1
	[0104.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x20
	[0104.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.203] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.203] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.206] GetLastError () returned 0x0
	[0104.206] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xcb4, lpOverlapped=0x0) returned 1
	[0104.216] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xcc0, lpOverlapped=0x0) returned 1
	[0104.218] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.218] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.218] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.218] CloseHandle (hObject=0x1e8) returned 1
	[0104.218] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.218] SetEndOfFile (hFile=0x1a8) returned 1
	[0104.219] CloseHandle (hObject=0x1a8) returned 1
	[0104.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 1
	[0104.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0104.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0104.223] lstrlenW (lpString=".doc") returned 4
	[0104.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.224] lstrlenW (lpString=".docx") returned 5
	[0104.224] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.224] lstrlenW (lpString=".pdf") returned 4
	[0104.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.224] lstrlenW (lpString=".xls") returned 4
	[0104.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.224] lstrlenW (lpString=".xlsx") returned 5
	[0104.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.224] lstrlenW (lpString=".ppt") returned 4
	[0104.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0104.224] lstrlenW (lpString=".zip") returned 4
	[0104.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.224] lstrlenW (lpString=".rar") returned 4
	[0104.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.224] lstrlenW (lpString=".bz2") returned 4
	[0104.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.224] lstrlenW (lpString=".7z") returned 3
	[0104.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0104.224] lstrlenW (lpString=".dbf") returned 4
	[0104.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0104.224] lstrlenW (lpString=".1cd") returned 4
	[0104.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0104.225] lstrlenW (lpString=".jpg") returned 4
	[0104.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0104.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0104.225] lstrlenW (lpString=".doc") returned 4
	[0104.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.225] lstrlenW (lpString=".docx") returned 5
	[0104.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.225] lstrlenW (lpString=".pdf") returned 4
	[0104.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.225] lstrlenW (lpString=".xls") returned 4
	[0104.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.225] lstrlenW (lpString=".xlsx") returned 5
	[0104.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.225] lstrlenW (lpString=".ppt") returned 4
	[0104.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0104.225] lstrlenW (lpString=".zip") returned 4
	[0104.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.225] lstrlenW (lpString=".rar") returned 4
	[0104.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.225] lstrlenW (lpString=".bz2") returned 4
	[0104.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.225] lstrlenW (lpString=".7z") returned 3
	[0104.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0104.226] lstrlenW (lpString=".dbf") returned 4
	[0104.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0104.226] lstrlenW (lpString=".1cd") returned 4
	[0104.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0104.226] lstrlenW (lpString=".jpg") returned 4
	[0104.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.226] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.226] lstrlenW (lpString="ED00019_.WMF") returned 12
	[0104.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.227] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=13042) returned 1
	[0104.227] CloseHandle (hObject=0x1a8) returned 1
	[0104.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x20
	[0104.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.228] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.228] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.229] GetLastError () returned 0x0
	[0104.229] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x32f2, lpOverlapped=0x0) returned 1
	[0104.243] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x3300, lpOverlapped=0x0) returned 1
	[0104.245] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.245] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.246] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.246] CloseHandle (hObject=0x1e8) returned 1
	[0104.246] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.246] SetEndOfFile (hFile=0x1a8) returned 1
	[0104.247] CloseHandle (hObject=0x1a8) returned 1
	[0104.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 1
	[0104.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0104.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0104.248] lstrlenW (lpString=".doc") returned 4
	[0104.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.248] lstrlenW (lpString=".docx") returned 5
	[0104.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.248] lstrlenW (lpString=".pdf") returned 4
	[0104.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.248] lstrlenW (lpString=".xls") returned 4
	[0104.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.248] lstrlenW (lpString=".xlsx") returned 5
	[0104.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.248] lstrlenW (lpString=".ppt") returned 4
	[0104.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0104.248] lstrlenW (lpString=".zip") returned 4
	[0104.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.248] lstrlenW (lpString=".rar") returned 4
	[0104.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.248] lstrlenW (lpString=".bz2") returned 4
	[0104.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.248] lstrlenW (lpString=".7z") returned 3
	[0104.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0104.248] lstrlenW (lpString=".dbf") returned 4
	[0104.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0104.249] lstrlenW (lpString=".1cd") returned 4
	[0104.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0104.249] lstrlenW (lpString=".jpg") returned 4
	[0104.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0104.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0104.249] lstrlenW (lpString=".doc") returned 4
	[0104.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.249] lstrlenW (lpString=".docx") returned 5
	[0104.249] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.249] lstrlenW (lpString=".pdf") returned 4
	[0104.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.249] lstrlenW (lpString=".xls") returned 4
	[0104.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.249] lstrlenW (lpString=".xlsx") returned 5
	[0104.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.249] lstrlenW (lpString=".ppt") returned 4
	[0104.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0104.249] lstrlenW (lpString=".zip") returned 4
	[0104.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.249] lstrlenW (lpString=".rar") returned 4
	[0104.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.249] lstrlenW (lpString=".bz2") returned 4
	[0104.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.250] lstrlenW (lpString=".7z") returned 3
	[0104.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0104.250] lstrlenW (lpString=".dbf") returned 4
	[0104.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0104.250] lstrlenW (lpString=".1cd") returned 4
	[0104.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0104.250] lstrlenW (lpString=".jpg") returned 4
	[0104.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.250] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.250] lstrlenW (lpString="ED00184_.WMF") returned 12
	[0104.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.251] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=6958) returned 1
	[0104.251] CloseHandle (hObject=0x1a8) returned 1
	[0104.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x20
	[0104.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.252] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.252] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.253] GetLastError () returned 0x0
	[0104.253] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1b2e, lpOverlapped=0x0) returned 1
	[0104.263] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1b30, lpOverlapped=0x0) returned 1
	[0104.264] ReadFile (in: hFile=0x1a8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.265] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.265] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.265] CloseHandle (hObject=0x1e8) returned 1
	[0104.265] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.265] SetEndOfFile (hFile=0x1a8) returned 1
	[0104.266] CloseHandle (hObject=0x1a8) returned 1
	[0104.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 1
	[0104.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0104.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0104.269] lstrlenW (lpString=".doc") returned 4
	[0104.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.269] lstrlenW (lpString=".docx") returned 5
	[0104.269] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.269] lstrlenW (lpString=".pdf") returned 4
	[0104.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.269] lstrlenW (lpString=".xls") returned 4
	[0104.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.269] lstrlenW (lpString=".xlsx") returned 5
	[0104.269] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.269] lstrlenW (lpString=".ppt") returned 4
	[0104.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0104.269] lstrlenW (lpString=".zip") returned 4
	[0104.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.269] lstrlenW (lpString=".rar") returned 4
	[0104.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.269] lstrlenW (lpString=".bz2") returned 4
	[0104.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.269] lstrlenW (lpString=".7z") returned 3
	[0104.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0104.270] lstrlenW (lpString=".dbf") returned 4
	[0104.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0104.270] lstrlenW (lpString=".1cd") returned 4
	[0104.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0104.270] lstrlenW (lpString=".jpg") returned 4
	[0104.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0104.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0104.270] lstrlenW (lpString=".doc") returned 4
	[0104.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.270] lstrlenW (lpString=".docx") returned 5
	[0104.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.270] lstrlenW (lpString=".pdf") returned 4
	[0104.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.270] lstrlenW (lpString=".xls") returned 4
	[0104.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.270] lstrlenW (lpString=".xlsx") returned 5
	[0104.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.270] lstrlenW (lpString=".ppt") returned 4
	[0104.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0104.270] lstrlenW (lpString=".zip") returned 4
	[0104.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.270] lstrlenW (lpString=".rar") returned 4
	[0104.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.270] lstrlenW (lpString=".bz2") returned 4
	[0104.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.271] lstrlenW (lpString=".7z") returned 3
	[0104.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0104.271] lstrlenW (lpString=".dbf") returned 4
	[0104.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0104.271] lstrlenW (lpString=".1cd") returned 4
	[0104.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0104.271] lstrlenW (lpString=".jpg") returned 4
	[0104.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.271] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.271] lstrlenW (lpString="EN00202_.WMF") returned 12
	[0104.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.277] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=6938) returned 1
	[0104.277] CloseHandle (hObject=0x1a8) returned 1
	[0104.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 0x20
	[0104.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0104.314] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.314] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0104.317] GetLastError () returned 0x0
	[0104.317] ReadFile (in: hFile=0x1e4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1b1a, lpOverlapped=0x0) returned 1
	[0104.331] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1b20, lpOverlapped=0x0) returned 1
	[0104.332] ReadFile (in: hFile=0x1e4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.332] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.332] SetEndOfFile (hFile=0x184) returned 1
	[0104.332] CloseHandle (hObject=0x184) returned 1
	[0104.332] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.332] SetEndOfFile (hFile=0x1e4) returned 1
	[0104.333] CloseHandle (hObject=0x1e4) returned 1
	[0104.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 1
	[0104.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0104.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0104.334] lstrlenW (lpString=".doc") returned 4
	[0104.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.334] lstrlenW (lpString=".docx") returned 5
	[0104.334] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.334] lstrlenW (lpString=".pdf") returned 4
	[0104.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.334] lstrlenW (lpString=".xls") returned 4
	[0104.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.334] lstrlenW (lpString=".xlsx") returned 5
	[0104.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.334] lstrlenW (lpString=".ppt") returned 4
	[0104.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0104.334] lstrlenW (lpString=".zip") returned 4
	[0104.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.335] lstrlenW (lpString=".rar") returned 4
	[0104.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.335] lstrlenW (lpString=".bz2") returned 4
	[0104.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.335] lstrlenW (lpString=".7z") returned 3
	[0104.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0104.335] lstrlenW (lpString=".dbf") returned 4
	[0104.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0104.335] lstrlenW (lpString=".1cd") returned 4
	[0104.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0104.335] lstrlenW (lpString=".jpg") returned 4
	[0104.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0104.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0104.335] lstrlenW (lpString=".doc") returned 4
	[0104.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.335] lstrlenW (lpString=".docx") returned 5
	[0104.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.335] lstrlenW (lpString=".pdf") returned 4
	[0104.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.335] lstrlenW (lpString=".xls") returned 4
	[0104.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.336] lstrlenW (lpString=".xlsx") returned 5
	[0104.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.336] lstrlenW (lpString=".ppt") returned 4
	[0104.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0104.336] lstrlenW (lpString=".zip") returned 4
	[0104.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.336] lstrlenW (lpString=".rar") returned 4
	[0104.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.336] lstrlenW (lpString=".bz2") returned 4
	[0104.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.336] lstrlenW (lpString=".7z") returned 3
	[0104.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0104.336] lstrlenW (lpString=".dbf") returned 4
	[0104.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0104.336] lstrlenW (lpString=".1cd") returned 4
	[0104.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0104.336] lstrlenW (lpString=".jpg") returned 4
	[0104.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.337] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.337] lstrlenW (lpString="EN00242_.WMF") returned 12
	[0104.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.349] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=6780) returned 1
	[0104.349] CloseHandle (hObject=0x1e8) returned 1
	[0104.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 0x20
	[0104.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0104.386] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.386] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.402] GetLastError () returned 0x0
	[0104.402] ReadFile (in: hFile=0x1e0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1a7c, lpOverlapped=0x0) returned 1
	[0104.406] WriteFile (in: hFile=0x1c4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1a80, lpOverlapped=0x0) returned 1
	[0104.407] ReadFile (in: hFile=0x1e0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.407] WriteFile (in: hFile=0x1c4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.407] SetEndOfFile (hFile=0x1c4) returned 1
	[0104.408] CloseHandle (hObject=0x1c4) returned 1
	[0104.408] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.408] SetEndOfFile (hFile=0x1e0) returned 1
	[0104.409] CloseHandle (hObject=0x1e0) returned 1
	[0104.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 1
	[0104.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0104.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0104.409] lstrlenW (lpString=".doc") returned 4
	[0104.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.409] lstrlenW (lpString=".docx") returned 5
	[0104.409] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.409] lstrlenW (lpString=".pdf") returned 4
	[0104.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.410] lstrlenW (lpString=".xls") returned 4
	[0104.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.410] lstrlenW (lpString=".xlsx") returned 5
	[0104.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.410] lstrlenW (lpString=".ppt") returned 4
	[0104.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0104.410] lstrlenW (lpString=".zip") returned 4
	[0104.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.410] lstrlenW (lpString=".rar") returned 4
	[0104.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.410] lstrlenW (lpString=".bz2") returned 4
	[0104.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.410] lstrlenW (lpString=".7z") returned 3
	[0104.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0104.410] lstrlenW (lpString=".dbf") returned 4
	[0104.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0104.410] lstrlenW (lpString=".1cd") returned 4
	[0104.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0104.410] lstrlenW (lpString=".jpg") returned 4
	[0104.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0104.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0104.410] lstrlenW (lpString=".doc") returned 4
	[0104.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.410] lstrlenW (lpString=".docx") returned 5
	[0104.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.411] lstrlenW (lpString=".pdf") returned 4
	[0104.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.411] lstrlenW (lpString=".xls") returned 4
	[0104.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.411] lstrlenW (lpString=".xlsx") returned 5
	[0104.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.411] lstrlenW (lpString=".ppt") returned 4
	[0104.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0104.411] lstrlenW (lpString=".zip") returned 4
	[0104.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.411] lstrlenW (lpString=".rar") returned 4
	[0104.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.411] lstrlenW (lpString=".bz2") returned 4
	[0104.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.411] lstrlenW (lpString=".7z") returned 3
	[0104.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0104.411] lstrlenW (lpString=".dbf") returned 4
	[0104.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0104.411] lstrlenW (lpString=".1cd") returned 4
	[0104.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0104.411] lstrlenW (lpString=".jpg") returned 4
	[0104.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.412] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.412] lstrlenW (lpString="EN00320_.WMF") returned 12
	[0104.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0104.413] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=736) returned 1
	[0104.413] CloseHandle (hObject=0x1e0) returned 1
	[0104.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 0x20
	[0104.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0104.414] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.415] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.415] GetLastError () returned 0x0
	[0104.415] ReadFile (in: hFile=0x1e0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x2e0, lpOverlapped=0x0) returned 1
	[0104.426] WriteFile (in: hFile=0x1c4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2f0, lpOverlapped=0x0) returned 1
	[0104.428] ReadFile (in: hFile=0x1e0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.428] WriteFile (in: hFile=0x1c4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.428] SetEndOfFile (hFile=0x1c4) returned 1
	[0104.428] CloseHandle (hObject=0x1c4) returned 1
	[0104.428] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.428] SetEndOfFile (hFile=0x1e0) returned 1
	[0104.429] CloseHandle (hObject=0x1e0) returned 1
	[0104.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 1
	[0104.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0104.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0104.430] lstrlenW (lpString=".doc") returned 4
	[0104.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.430] lstrlenW (lpString=".docx") returned 5
	[0104.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.430] lstrlenW (lpString=".pdf") returned 4
	[0104.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.430] lstrlenW (lpString=".xls") returned 4
	[0104.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.430] lstrlenW (lpString=".xlsx") returned 5
	[0104.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.430] lstrlenW (lpString=".ppt") returned 4
	[0104.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0104.430] lstrlenW (lpString=".zip") returned 4
	[0104.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.430] lstrlenW (lpString=".rar") returned 4
	[0104.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.430] lstrlenW (lpString=".bz2") returned 4
	[0104.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.430] lstrlenW (lpString=".7z") returned 3
	[0104.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0104.431] lstrlenW (lpString=".dbf") returned 4
	[0104.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0104.431] lstrlenW (lpString=".1cd") returned 4
	[0104.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0104.431] lstrlenW (lpString=".jpg") returned 4
	[0104.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0104.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0104.431] lstrlenW (lpString=".doc") returned 4
	[0104.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.431] lstrlenW (lpString=".docx") returned 5
	[0104.431] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.431] lstrlenW (lpString=".pdf") returned 4
	[0104.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.431] lstrlenW (lpString=".xls") returned 4
	[0104.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.431] lstrlenW (lpString=".xlsx") returned 5
	[0104.431] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.431] lstrlenW (lpString=".ppt") returned 4
	[0104.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0104.431] lstrlenW (lpString=".zip") returned 4
	[0104.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.431] lstrlenW (lpString=".rar") returned 4
	[0104.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.431] lstrlenW (lpString=".bz2") returned 4
	[0104.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.432] lstrlenW (lpString=".7z") returned 3
	[0104.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0104.432] lstrlenW (lpString=".dbf") returned 4
	[0104.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0104.432] lstrlenW (lpString=".1cd") returned 4
	[0104.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0104.432] lstrlenW (lpString=".jpg") returned 4
	[0104.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.432] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.432] lstrlenW (lpString="EN00902_.WMF") returned 12
	[0104.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0104.448] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=7944) returned 1
	[0104.448] CloseHandle (hObject=0x1e0) returned 1
	[0104.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 0x20
	[0104.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.487] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.487] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.491] GetLastError () returned 0x0
	[0104.491] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x1f08, lpOverlapped=0x0) returned 1
	[0104.496] WriteFile (in: hFile=0x1dc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x1f10, lpOverlapped=0x0) returned 1
	[0104.497] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.497] WriteFile (in: hFile=0x1dc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.497] SetEndOfFile (hFile=0x1dc) returned 1
	[0104.497] CloseHandle (hObject=0x1dc) returned 1
	[0104.497] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.497] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.498] CloseHandle (hObject=0x1e8) returned 1
	[0104.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 1
	[0104.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0104.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0104.499] lstrlenW (lpString=".doc") returned 4
	[0104.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.499] lstrlenW (lpString=".docx") returned 5
	[0104.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.499] lstrlenW (lpString=".pdf") returned 4
	[0104.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.499] lstrlenW (lpString=".xls") returned 4
	[0104.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.499] lstrlenW (lpString=".xlsx") returned 5
	[0104.499] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.499] lstrlenW (lpString=".ppt") returned 4
	[0104.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0104.500] lstrlenW (lpString=".zip") returned 4
	[0104.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.500] lstrlenW (lpString=".rar") returned 4
	[0104.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.500] lstrlenW (lpString=".bz2") returned 4
	[0104.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.500] lstrlenW (lpString=".7z") returned 3
	[0104.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0104.500] lstrlenW (lpString=".dbf") returned 4
	[0104.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0104.500] lstrlenW (lpString=".1cd") returned 4
	[0104.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0104.500] lstrlenW (lpString=".jpg") returned 4
	[0104.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0104.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0104.500] lstrlenW (lpString=".doc") returned 4
	[0104.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.500] lstrlenW (lpString=".docx") returned 5
	[0104.500] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.500] lstrlenW (lpString=".pdf") returned 4
	[0104.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.501] lstrlenW (lpString=".xls") returned 4
	[0104.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.501] lstrlenW (lpString=".xlsx") returned 5
	[0104.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.501] lstrlenW (lpString=".ppt") returned 4
	[0104.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0104.501] lstrlenW (lpString=".zip") returned 4
	[0104.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.501] lstrlenW (lpString=".rar") returned 4
	[0104.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.501] lstrlenW (lpString=".bz2") returned 4
	[0104.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.501] lstrlenW (lpString=".7z") returned 3
	[0104.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0104.501] lstrlenW (lpString=".dbf") returned 4
	[0104.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0104.501] lstrlenW (lpString=".1cd") returned 4
	[0104.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0104.501] lstrlenW (lpString=".jpg") returned 4
	[0104.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.502] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.502] lstrlenW (lpString="FD00076_.WMF") returned 12
	[0104.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.503] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=11994) returned 1
	[0104.503] CloseHandle (hObject=0x1e8) returned 1
	[0104.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x20
	[0104.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.503] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.503] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.504] GetLastError () returned 0x0
	[0104.504] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x2eda, lpOverlapped=0x0) returned 1
	[0104.517] WriteFile (in: hFile=0x1dc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2ee0, lpOverlapped=0x0) returned 1
	[0104.518] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.518] WriteFile (in: hFile=0x1dc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.518] SetEndOfFile (hFile=0x1dc) returned 1
	[0104.518] CloseHandle (hObject=0x1dc) returned 1
	[0104.518] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.518] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.519] CloseHandle (hObject=0x1e8) returned 1
	[0104.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 1
	[0104.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0104.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0104.522] lstrlenW (lpString=".doc") returned 4
	[0104.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.522] lstrlenW (lpString=".docx") returned 5
	[0104.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.522] lstrlenW (lpString=".pdf") returned 4
	[0104.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.522] lstrlenW (lpString=".xls") returned 4
	[0104.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.522] lstrlenW (lpString=".xlsx") returned 5
	[0104.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.522] lstrlenW (lpString=".ppt") returned 4
	[0104.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0104.522] lstrlenW (lpString=".zip") returned 4
	[0104.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.522] lstrlenW (lpString=".rar") returned 4
	[0104.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.522] lstrlenW (lpString=".bz2") returned 4
	[0104.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.522] lstrlenW (lpString=".7z") returned 3
	[0104.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0104.523] lstrlenW (lpString=".dbf") returned 4
	[0104.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0104.523] lstrlenW (lpString=".1cd") returned 4
	[0104.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0104.523] lstrlenW (lpString=".jpg") returned 4
	[0104.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0104.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0104.523] lstrlenW (lpString=".doc") returned 4
	[0104.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.523] lstrlenW (lpString=".docx") returned 5
	[0104.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.523] lstrlenW (lpString=".pdf") returned 4
	[0104.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.523] lstrlenW (lpString=".xls") returned 4
	[0104.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.523] lstrlenW (lpString=".xlsx") returned 5
	[0104.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.523] lstrlenW (lpString=".ppt") returned 4
	[0104.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0104.524] lstrlenW (lpString=".zip") returned 4
	[0104.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.524] lstrlenW (lpString=".rar") returned 4
	[0104.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.524] lstrlenW (lpString=".bz2") returned 4
	[0104.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.524] lstrlenW (lpString=".7z") returned 3
	[0104.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0104.524] lstrlenW (lpString=".dbf") returned 4
	[0104.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0104.524] lstrlenW (lpString=".1cd") returned 4
	[0104.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0104.524] lstrlenW (lpString=".jpg") returned 4
	[0104.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.524] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.524] lstrlenW (lpString="FD00086_.WMF") returned 12
	[0104.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.530] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=29212) returned 1
	[0104.530] CloseHandle (hObject=0x1c4) returned 1
	[0104.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x20
	[0104.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0104.745] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.745] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.791] GetLastError () returned 0x0
	[0104.791] ReadFile (in: hFile=0x1e0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x721c, lpOverlapped=0x0) returned 1
	[0104.885] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x7220, lpOverlapped=0x0) returned 1
	[0104.886] ReadFile (in: hFile=0x1e0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.886] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.886] SetEndOfFile (hFile=0x1d8) returned 1
	[0104.886] CloseHandle (hObject=0x1d8) returned 1
	[0104.887] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.887] SetEndOfFile (hFile=0x1e0) returned 1
	[0104.887] CloseHandle (hObject=0x1e0) returned 1
	[0104.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 1
	[0104.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0104.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0104.888] lstrlenW (lpString=".doc") returned 4
	[0104.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.888] lstrlenW (lpString=".docx") returned 5
	[0104.888] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.888] lstrlenW (lpString=".pdf") returned 4
	[0104.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.888] lstrlenW (lpString=".xls") returned 4
	[0104.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.888] lstrlenW (lpString=".xlsx") returned 5
	[0104.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.888] lstrlenW (lpString=".ppt") returned 4
	[0104.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0104.888] lstrlenW (lpString=".zip") returned 4
	[0104.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.888] lstrlenW (lpString=".rar") returned 4
	[0104.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.889] lstrlenW (lpString=".bz2") returned 4
	[0104.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.889] lstrlenW (lpString=".7z") returned 3
	[0104.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0104.889] lstrlenW (lpString=".dbf") returned 4
	[0104.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0104.889] lstrlenW (lpString=".1cd") returned 4
	[0104.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0104.889] lstrlenW (lpString=".jpg") returned 4
	[0104.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0104.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0104.889] lstrlenW (lpString=".doc") returned 4
	[0104.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.889] lstrlenW (lpString=".docx") returned 5
	[0104.889] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.889] lstrlenW (lpString=".pdf") returned 4
	[0104.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.889] lstrlenW (lpString=".xls") returned 4
	[0104.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.889] lstrlenW (lpString=".xlsx") returned 5
	[0104.889] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.889] lstrlenW (lpString=".ppt") returned 4
	[0104.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0104.889] lstrlenW (lpString=".zip") returned 4
	[0104.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.889] lstrlenW (lpString=".rar") returned 4
	[0104.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.889] lstrlenW (lpString=".bz2") returned 4
	[0104.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.890] lstrlenW (lpString=".7z") returned 3
	[0104.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0104.890] lstrlenW (lpString=".dbf") returned 4
	[0104.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0104.890] lstrlenW (lpString=".1cd") returned 4
	[0104.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0104.890] lstrlenW (lpString=".jpg") returned 4
	[0104.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.890] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.890] lstrlenW (lpString="FD00297_.WMF") returned 12
	[0104.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.926] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=18194) returned 1
	[0104.926] CloseHandle (hObject=0x1c4) returned 1
	[0104.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x20
	[0104.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.938] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.939] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0104.947] GetLastError () returned 0x0
	[0104.947] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x4712, lpOverlapped=0x0) returned 1
	[0104.952] WriteFile (in: hFile=0x1ec, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x4720, lpOverlapped=0x0) returned 1
	[0104.955] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.955] WriteFile (in: hFile=0x1ec, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.955] SetEndOfFile (hFile=0x1ec) returned 1
	[0104.956] CloseHandle (hObject=0x1ec) returned 1
	[0104.956] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.956] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.957] CloseHandle (hObject=0x1e8) returned 1
	[0104.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 1
	[0104.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0104.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0104.958] lstrlenW (lpString=".doc") returned 4
	[0104.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.958] lstrlenW (lpString=".docx") returned 5
	[0104.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.958] lstrlenW (lpString=".pdf") returned 4
	[0104.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.958] lstrlenW (lpString=".xls") returned 4
	[0104.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.958] lstrlenW (lpString=".xlsx") returned 5
	[0104.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.958] lstrlenW (lpString=".ppt") returned 4
	[0104.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0104.958] lstrlenW (lpString=".zip") returned 4
	[0104.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.958] lstrlenW (lpString=".rar") returned 4
	[0104.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.958] lstrlenW (lpString=".bz2") returned 4
	[0104.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.959] lstrlenW (lpString=".7z") returned 3
	[0104.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0104.959] lstrlenW (lpString=".dbf") returned 4
	[0104.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0104.959] lstrlenW (lpString=".1cd") returned 4
	[0104.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0104.959] lstrlenW (lpString=".jpg") returned 4
	[0104.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0104.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0104.959] lstrlenW (lpString=".doc") returned 4
	[0104.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.959] lstrlenW (lpString=".docx") returned 5
	[0104.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.959] lstrlenW (lpString=".pdf") returned 4
	[0104.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.959] lstrlenW (lpString=".xls") returned 4
	[0104.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.959] lstrlenW (lpString=".xlsx") returned 5
	[0104.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.960] lstrlenW (lpString=".ppt") returned 4
	[0104.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0104.960] lstrlenW (lpString=".zip") returned 4
	[0104.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.960] lstrlenW (lpString=".rar") returned 4
	[0104.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.960] lstrlenW (lpString=".bz2") returned 4
	[0104.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.960] lstrlenW (lpString=".7z") returned 3
	[0104.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0104.960] lstrlenW (lpString=".dbf") returned 4
	[0104.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0104.960] lstrlenW (lpString=".1cd") returned 4
	[0104.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0104.960] lstrlenW (lpString=".jpg") returned 4
	[0104.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.960] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.961] lstrlenW (lpString="FD00336_.WMF") returned 12
	[0104.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.962] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=6068) returned 1
	[0104.962] CloseHandle (hObject=0x1e8) returned 1
	[0104.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x20
	[0104.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.962] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.963] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0104.964] GetLastError () returned 0x0
	[0104.964] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x17b4, lpOverlapped=0x0) returned 1
	[0104.981] WriteFile (in: hFile=0x1ec, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x17c0, lpOverlapped=0x0) returned 1
	[0104.983] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.983] WriteFile (in: hFile=0x1ec, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.983] SetEndOfFile (hFile=0x1ec) returned 1
	[0104.983] CloseHandle (hObject=0x1ec) returned 1
	[0104.983] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.983] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.984] CloseHandle (hObject=0x1e8) returned 1
	[0104.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 1
	[0104.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0104.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0104.985] lstrlenW (lpString=".doc") returned 4
	[0104.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.985] lstrlenW (lpString=".docx") returned 5
	[0104.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.985] lstrlenW (lpString=".pdf") returned 4
	[0104.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.985] lstrlenW (lpString=".xls") returned 4
	[0104.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.985] lstrlenW (lpString=".xlsx") returned 5
	[0104.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.986] lstrlenW (lpString=".ppt") returned 4
	[0104.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0104.986] lstrlenW (lpString=".zip") returned 4
	[0104.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.986] lstrlenW (lpString=".rar") returned 4
	[0104.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.986] lstrlenW (lpString=".bz2") returned 4
	[0104.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.986] lstrlenW (lpString=".7z") returned 3
	[0104.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0104.987] lstrlenW (lpString=".dbf") returned 4
	[0104.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0104.987] lstrlenW (lpString=".1cd") returned 4
	[0104.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0104.987] lstrlenW (lpString=".jpg") returned 4
	[0104.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0104.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0104.987] lstrlenW (lpString=".doc") returned 4
	[0104.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.987] lstrlenW (lpString=".docx") returned 5
	[0104.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.987] lstrlenW (lpString=".pdf") returned 4
	[0104.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.987] lstrlenW (lpString=".xls") returned 4
	[0104.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.987] lstrlenW (lpString=".xlsx") returned 5
	[0104.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.987] lstrlenW (lpString=".ppt") returned 4
	[0104.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0104.987] lstrlenW (lpString=".zip") returned 4
	[0104.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.987] lstrlenW (lpString=".rar") returned 4
	[0104.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.988] lstrlenW (lpString=".bz2") returned 4
	[0104.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.988] lstrlenW (lpString=".7z") returned 3
	[0104.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0104.988] lstrlenW (lpString=".dbf") returned 4
	[0104.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0104.988] lstrlenW (lpString=".1cd") returned 4
	[0104.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0104.988] lstrlenW (lpString=".jpg") returned 4
	[0104.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.988] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.988] lstrlenW (lpString="FD00369_.WMF") returned 12
	[0104.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.990] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=8552) returned 1
	[0104.990] CloseHandle (hObject=0x1e8) returned 1
	[0104.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x20
	[0104.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.991] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.991] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0104.991] GetLastError () returned 0x0
	[0104.992] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x2168, lpOverlapped=0x0) returned 1
	[0105.056] WriteFile (in: hFile=0x1ec, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2170, lpOverlapped=0x0) returned 1
	[0105.057] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.057] WriteFile (in: hFile=0x1ec, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.057] SetEndOfFile (hFile=0x1ec) returned 1
	[0105.058] CloseHandle (hObject=0x1ec) returned 1
	[0105.058] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.058] SetEndOfFile (hFile=0x1e8) returned 1
	[0105.060] CloseHandle (hObject=0x1e8) returned 1
	[0105.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 1
	[0105.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0105.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0105.060] lstrlenW (lpString=".doc") returned 4
	[0105.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.061] lstrlenW (lpString=".docx") returned 5
	[0105.061] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.061] lstrlenW (lpString=".pdf") returned 4
	[0105.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.061] lstrlenW (lpString=".xls") returned 4
	[0105.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.061] lstrlenW (lpString=".xlsx") returned 5
	[0105.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.061] lstrlenW (lpString=".ppt") returned 4
	[0105.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0105.062] lstrlenW (lpString=".zip") returned 4
	[0105.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.062] lstrlenW (lpString=".rar") returned 4
	[0105.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.062] lstrlenW (lpString=".bz2") returned 4
	[0105.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.062] lstrlenW (lpString=".7z") returned 3
	[0105.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0105.062] lstrlenW (lpString=".dbf") returned 4
	[0105.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0105.062] lstrlenW (lpString=".1cd") returned 4
	[0105.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0105.062] lstrlenW (lpString=".jpg") returned 4
	[0105.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0105.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0105.062] lstrlenW (lpString=".doc") returned 4
	[0105.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.062] lstrlenW (lpString=".docx") returned 5
	[0105.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.062] lstrlenW (lpString=".pdf") returned 4
	[0105.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.063] lstrlenW (lpString=".xls") returned 4
	[0105.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.063] lstrlenW (lpString=".xlsx") returned 5
	[0105.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.063] lstrlenW (lpString=".ppt") returned 4
	[0105.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0105.063] lstrlenW (lpString=".zip") returned 4
	[0105.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.063] lstrlenW (lpString=".rar") returned 4
	[0105.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.063] lstrlenW (lpString=".bz2") returned 4
	[0105.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.063] lstrlenW (lpString=".7z") returned 3
	[0105.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0105.063] lstrlenW (lpString=".dbf") returned 4
	[0105.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0105.063] lstrlenW (lpString=".1cd") returned 4
	[0105.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0105.063] lstrlenW (lpString=".jpg") returned 4
	[0105.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.064] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.064] lstrlenW (lpString="FD00397_.WMF") returned 12
	[0105.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.065] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=10816) returned 1
	[0105.065] CloseHandle (hObject=0x1e8) returned 1
	[0105.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x20
	[0105.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.066] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.066] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0105.067] GetLastError () returned 0x0
	[0105.067] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x2a40, lpOverlapped=0x0) returned 1
	[0105.097] WriteFile (in: hFile=0x1ec, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2a50, lpOverlapped=0x0) returned 1
	[0105.099] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.099] WriteFile (in: hFile=0x1ec, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.099] SetEndOfFile (hFile=0x1ec) returned 1
	[0105.099] CloseHandle (hObject=0x1ec) returned 1
	[0105.099] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.099] SetEndOfFile (hFile=0x1e8) returned 1
	[0105.100] CloseHandle (hObject=0x1e8) returned 1
	[0105.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 1
	[0105.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0105.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0105.105] lstrlenW (lpString=".doc") returned 4
	[0105.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.106] lstrlenW (lpString=".docx") returned 5
	[0105.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.106] lstrlenW (lpString=".pdf") returned 4
	[0105.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.106] lstrlenW (lpString=".xls") returned 4
	[0105.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.106] lstrlenW (lpString=".xlsx") returned 5
	[0105.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.106] lstrlenW (lpString=".ppt") returned 4
	[0105.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0105.106] lstrlenW (lpString=".zip") returned 4
	[0105.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.106] lstrlenW (lpString=".rar") returned 4
	[0105.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.106] lstrlenW (lpString=".bz2") returned 4
	[0105.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.106] lstrlenW (lpString=".7z") returned 3
	[0105.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0105.106] lstrlenW (lpString=".dbf") returned 4
	[0105.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0105.107] lstrlenW (lpString=".1cd") returned 4
	[0105.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0105.107] lstrlenW (lpString=".jpg") returned 4
	[0105.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0105.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0105.107] lstrlenW (lpString=".doc") returned 4
	[0105.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.107] lstrlenW (lpString=".docx") returned 5
	[0105.107] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.107] lstrlenW (lpString=".pdf") returned 4
	[0105.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.107] lstrlenW (lpString=".xls") returned 4
	[0105.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.107] lstrlenW (lpString=".xlsx") returned 5
	[0105.107] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.107] lstrlenW (lpString=".ppt") returned 4
	[0105.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0105.107] lstrlenW (lpString=".zip") returned 4
	[0105.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.108] lstrlenW (lpString=".rar") returned 4
	[0105.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.108] lstrlenW (lpString=".bz2") returned 4
	[0105.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.108] lstrlenW (lpString=".7z") returned 3
	[0105.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0105.108] lstrlenW (lpString=".dbf") returned 4
	[0105.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0105.108] lstrlenW (lpString=".1cd") returned 4
	[0105.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0105.108] lstrlenW (lpString=".jpg") returned 4
	[0105.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.108] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.108] lstrlenW (lpString="FD00414_.WMF") returned 12
	[0105.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.157] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=11002) returned 1
	[0105.157] CloseHandle (hObject=0x1dc) returned 1
	[0105.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x20
	[0105.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.164] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.164] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.167] GetLastError () returned 0x0
	[0105.167] ReadFile (in: hFile=0x1dc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x2afa, lpOverlapped=0x0) returned 1
	[0105.171] WriteFile (in: hFile=0x1f4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2b00, lpOverlapped=0x0) returned 1
	[0105.172] ReadFile (in: hFile=0x1dc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.172] WriteFile (in: hFile=0x1f4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.172] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.172] CloseHandle (hObject=0x1f4) returned 1
	[0105.172] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.172] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.173] CloseHandle (hObject=0x1dc) returned 1
	[0105.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 1
	[0105.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0105.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0105.174] lstrlenW (lpString=".doc") returned 4
	[0105.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.174] lstrlenW (lpString=".docx") returned 5
	[0105.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.174] lstrlenW (lpString=".pdf") returned 4
	[0105.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.174] lstrlenW (lpString=".xls") returned 4
	[0105.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.174] lstrlenW (lpString=".xlsx") returned 5
	[0105.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.174] lstrlenW (lpString=".ppt") returned 4
	[0105.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0105.174] lstrlenW (lpString=".zip") returned 4
	[0105.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.174] lstrlenW (lpString=".rar") returned 4
	[0105.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.174] lstrlenW (lpString=".bz2") returned 4
	[0105.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.174] lstrlenW (lpString=".7z") returned 3
	[0105.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0105.174] lstrlenW (lpString=".dbf") returned 4
	[0105.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0105.175] lstrlenW (lpString=".1cd") returned 4
	[0105.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0105.175] lstrlenW (lpString=".jpg") returned 4
	[0105.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0105.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0105.175] lstrlenW (lpString=".doc") returned 4
	[0105.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.175] lstrlenW (lpString=".docx") returned 5
	[0105.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.175] lstrlenW (lpString=".pdf") returned 4
	[0105.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.175] lstrlenW (lpString=".xls") returned 4
	[0105.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.175] lstrlenW (lpString=".xlsx") returned 5
	[0105.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.175] lstrlenW (lpString=".ppt") returned 4
	[0105.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0105.175] lstrlenW (lpString=".zip") returned 4
	[0105.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.175] lstrlenW (lpString=".rar") returned 4
	[0105.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.175] lstrlenW (lpString=".bz2") returned 4
	[0105.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.175] lstrlenW (lpString=".7z") returned 3
	[0105.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0105.176] lstrlenW (lpString=".dbf") returned 4
	[0105.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0105.176] lstrlenW (lpString=".1cd") returned 4
	[0105.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0105.176] lstrlenW (lpString=".jpg") returned 4
	[0105.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.176] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.176] lstrlenW (lpString="FD00428_.WMF") returned 12
	[0105.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.176] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=4796) returned 1
	[0105.177] CloseHandle (hObject=0x1dc) returned 1
	[0105.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x20
	[0105.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.177] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.177] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.178] GetLastError () returned 0x0
	[0105.178] ReadFile (in: hFile=0x1dc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x12bc, lpOverlapped=0x0) returned 1
	[0105.194] WriteFile (in: hFile=0x1f4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x12c0, lpOverlapped=0x0) returned 1
	[0105.196] ReadFile (in: hFile=0x1dc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.196] WriteFile (in: hFile=0x1f4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.196] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.196] CloseHandle (hObject=0x1f4) returned 1
	[0105.196] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.196] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.197] CloseHandle (hObject=0x1dc) returned 1
	[0105.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 1
	[0105.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0105.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0105.198] lstrlenW (lpString=".doc") returned 4
	[0105.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.198] lstrlenW (lpString=".docx") returned 5
	[0105.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.198] lstrlenW (lpString=".pdf") returned 4
	[0105.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.198] lstrlenW (lpString=".xls") returned 4
	[0105.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.198] lstrlenW (lpString=".xlsx") returned 5
	[0105.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.199] lstrlenW (lpString=".ppt") returned 4
	[0105.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0105.199] lstrlenW (lpString=".zip") returned 4
	[0105.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.199] lstrlenW (lpString=".rar") returned 4
	[0105.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.199] lstrlenW (lpString=".bz2") returned 4
	[0105.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.199] lstrlenW (lpString=".7z") returned 3
	[0105.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0105.199] lstrlenW (lpString=".dbf") returned 4
	[0105.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0105.199] lstrlenW (lpString=".1cd") returned 4
	[0105.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0105.200] lstrlenW (lpString=".jpg") returned 4
	[0105.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0105.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0105.200] lstrlenW (lpString=".doc") returned 4
	[0105.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.200] lstrlenW (lpString=".docx") returned 5
	[0105.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.200] lstrlenW (lpString=".pdf") returned 4
	[0105.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.200] lstrlenW (lpString=".xls") returned 4
	[0105.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.200] lstrlenW (lpString=".xlsx") returned 5
	[0105.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.200] lstrlenW (lpString=".ppt") returned 4
	[0105.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0105.201] lstrlenW (lpString=".zip") returned 4
	[0105.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.201] lstrlenW (lpString=".rar") returned 4
	[0105.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.201] lstrlenW (lpString=".bz2") returned 4
	[0105.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.201] lstrlenW (lpString=".7z") returned 3
	[0105.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0105.201] lstrlenW (lpString=".dbf") returned 4
	[0105.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0105.201] lstrlenW (lpString=".1cd") returned 4
	[0105.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0105.201] lstrlenW (lpString=".jpg") returned 4
	[0105.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.201] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.201] lstrlenW (lpString="FD00438_.WMF") returned 12
	[0105.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.202] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=5098) returned 1
	[0105.202] CloseHandle (hObject=0x1dc) returned 1
	[0105.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x20
	[0105.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.203] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.203] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.204] GetLastError () returned 0x0
	[0105.204] ReadFile (in: hFile=0x1dc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x13ea, lpOverlapped=0x0) returned 1
	[0105.233] WriteFile (in: hFile=0x1f4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x13f0, lpOverlapped=0x0) returned 1
	[0105.235] ReadFile (in: hFile=0x1dc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.235] WriteFile (in: hFile=0x1f4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.235] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.235] CloseHandle (hObject=0x1f4) returned 1
	[0105.235] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.236] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.237] CloseHandle (hObject=0x1dc) returned 1
	[0105.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 1
	[0105.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0105.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0105.237] lstrlenW (lpString=".doc") returned 4
	[0105.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.237] lstrlenW (lpString=".docx") returned 5
	[0105.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.238] lstrlenW (lpString=".pdf") returned 4
	[0105.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.238] lstrlenW (lpString=".xls") returned 4
	[0105.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.238] lstrlenW (lpString=".xlsx") returned 5
	[0105.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.238] lstrlenW (lpString=".ppt") returned 4
	[0105.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0105.238] lstrlenW (lpString=".zip") returned 4
	[0105.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.238] lstrlenW (lpString=".rar") returned 4
	[0105.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.238] lstrlenW (lpString=".bz2") returned 4
	[0105.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.238] lstrlenW (lpString=".7z") returned 3
	[0105.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0105.238] lstrlenW (lpString=".dbf") returned 4
	[0105.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0105.238] lstrlenW (lpString=".1cd") returned 4
	[0105.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0105.238] lstrlenW (lpString=".jpg") returned 4
	[0105.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0105.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0105.239] lstrlenW (lpString=".doc") returned 4
	[0105.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.239] lstrlenW (lpString=".docx") returned 5
	[0105.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.239] lstrlenW (lpString=".pdf") returned 4
	[0105.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.239] lstrlenW (lpString=".xls") returned 4
	[0105.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.239] lstrlenW (lpString=".xlsx") returned 5
	[0105.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.239] lstrlenW (lpString=".ppt") returned 4
	[0105.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0105.239] lstrlenW (lpString=".zip") returned 4
	[0105.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.239] lstrlenW (lpString=".rar") returned 4
	[0105.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.239] lstrlenW (lpString=".bz2") returned 4
	[0105.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.239] lstrlenW (lpString=".7z") returned 3
	[0105.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0105.239] lstrlenW (lpString=".dbf") returned 4
	[0105.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0105.240] lstrlenW (lpString=".1cd") returned 4
	[0105.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0105.240] lstrlenW (lpString=".jpg") returned 4
	[0105.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.240] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.240] lstrlenW (lpString="FD00459_.WMF") returned 12
	[0105.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.241] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=17406) returned 1
	[0105.241] CloseHandle (hObject=0x1dc) returned 1
	[0105.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x20
	[0105.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.242] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.242] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.243] GetLastError () returned 0x0
	[0105.243] ReadFile (in: hFile=0x1dc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x43fe, lpOverlapped=0x0) returned 1
	[0105.291] WriteFile (in: hFile=0x1f4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x4400, lpOverlapped=0x0) returned 1
	[0105.293] ReadFile (in: hFile=0x1dc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.293] WriteFile (in: hFile=0x1f4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.293] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.293] CloseHandle (hObject=0x1f4) returned 1
	[0105.294] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.294] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.295] CloseHandle (hObject=0x1dc) returned 1
	[0105.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 1
	[0105.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0105.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0105.295] lstrlenW (lpString=".doc") returned 4
	[0105.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.295] lstrlenW (lpString=".docx") returned 5
	[0105.295] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.295] lstrlenW (lpString=".pdf") returned 4
	[0105.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.296] lstrlenW (lpString=".xls") returned 4
	[0105.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.296] lstrlenW (lpString=".xlsx") returned 5
	[0105.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.296] lstrlenW (lpString=".ppt") returned 4
	[0105.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0105.296] lstrlenW (lpString=".zip") returned 4
	[0105.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.296] lstrlenW (lpString=".rar") returned 4
	[0105.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.296] lstrlenW (lpString=".bz2") returned 4
	[0105.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.296] lstrlenW (lpString=".7z") returned 3
	[0105.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0105.296] lstrlenW (lpString=".dbf") returned 4
	[0105.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0105.296] lstrlenW (lpString=".1cd") returned 4
	[0105.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0105.296] lstrlenW (lpString=".jpg") returned 4
	[0105.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0105.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0105.297] lstrlenW (lpString=".doc") returned 4
	[0105.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.297] lstrlenW (lpString=".docx") returned 5
	[0105.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.297] lstrlenW (lpString=".pdf") returned 4
	[0105.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.297] lstrlenW (lpString=".xls") returned 4
	[0105.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.297] lstrlenW (lpString=".xlsx") returned 5
	[0105.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.297] lstrlenW (lpString=".ppt") returned 4
	[0105.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0105.297] lstrlenW (lpString=".zip") returned 4
	[0105.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.297] lstrlenW (lpString=".rar") returned 4
	[0105.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.297] lstrlenW (lpString=".bz2") returned 4
	[0105.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.297] lstrlenW (lpString=".7z") returned 3
	[0105.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0105.297] lstrlenW (lpString=".dbf") returned 4
	[0105.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0105.297] lstrlenW (lpString=".1cd") returned 4
	[0105.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0105.298] lstrlenW (lpString=".jpg") returned 4
	[0105.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.298] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.298] lstrlenW (lpString="FD00564_.WMF") returned 12
	[0105.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.299] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=896) returned 1
	[0105.299] CloseHandle (hObject=0x1dc) returned 1
	[0105.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x20
	[0105.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.299] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.300] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.300] GetLastError () returned 0x0
	[0105.300] ReadFile (in: hFile=0x1dc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x380, lpOverlapped=0x0) returned 1
	[0105.324] WriteFile (in: hFile=0x1f4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x390, lpOverlapped=0x0) returned 1
	[0105.325] ReadFile (in: hFile=0x1dc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.325] WriteFile (in: hFile=0x1f4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.325] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.325] CloseHandle (hObject=0x1f4) returned 1
	[0105.325] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.325] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.326] CloseHandle (hObject=0x1dc) returned 1
	[0105.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 1
	[0105.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0105.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0105.327] lstrlenW (lpString=".doc") returned 4
	[0105.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.327] lstrlenW (lpString=".docx") returned 5
	[0105.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.327] lstrlenW (lpString=".pdf") returned 4
	[0105.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.327] lstrlenW (lpString=".xls") returned 4
	[0105.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.327] lstrlenW (lpString=".xlsx") returned 5
	[0105.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.327] lstrlenW (lpString=".ppt") returned 4
	[0105.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0105.327] lstrlenW (lpString=".zip") returned 4
	[0105.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.327] lstrlenW (lpString=".rar") returned 4
	[0105.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.327] lstrlenW (lpString=".bz2") returned 4
	[0105.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.327] lstrlenW (lpString=".7z") returned 3
	[0105.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0105.328] lstrlenW (lpString=".dbf") returned 4
	[0105.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0105.328] lstrlenW (lpString=".1cd") returned 4
	[0105.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0105.328] lstrlenW (lpString=".jpg") returned 4
	[0105.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0105.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0105.328] lstrlenW (lpString=".doc") returned 4
	[0105.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.328] lstrlenW (lpString=".docx") returned 5
	[0105.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.328] lstrlenW (lpString=".pdf") returned 4
	[0105.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.328] lstrlenW (lpString=".xls") returned 4
	[0105.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.328] lstrlenW (lpString=".xlsx") returned 5
	[0105.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.328] lstrlenW (lpString=".ppt") returned 4
	[0105.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0105.328] lstrlenW (lpString=".zip") returned 4
	[0105.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.329] lstrlenW (lpString=".rar") returned 4
	[0105.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.329] lstrlenW (lpString=".bz2") returned 4
	[0105.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.329] lstrlenW (lpString=".7z") returned 3
	[0105.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0105.329] lstrlenW (lpString=".dbf") returned 4
	[0105.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0105.329] lstrlenW (lpString=".1cd") returned 4
	[0105.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0105.329] lstrlenW (lpString=".jpg") returned 4
	[0105.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.329] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.329] lstrlenW (lpString="FD00775_.WMF") returned 12
	[0105.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.330] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=11152) returned 1
	[0105.330] CloseHandle (hObject=0x1dc) returned 1
	[0105.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x20
	[0105.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.331] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.331] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.332] GetLastError () returned 0x0
	[0105.332] ReadFile (in: hFile=0x1dc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x2b90, lpOverlapped=0x0) returned 1
	[0105.346] WriteFile (in: hFile=0x1f4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x2ba0, lpOverlapped=0x0) returned 1
	[0105.348] ReadFile (in: hFile=0x1dc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.348] WriteFile (in: hFile=0x1f4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.348] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.348] CloseHandle (hObject=0x1f4) returned 1
	[0105.348] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.348] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.349] CloseHandle (hObject=0x1dc) returned 1
	[0105.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 1
	[0105.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0105.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0105.353] lstrlenW (lpString=".doc") returned 4
	[0105.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.353] lstrlenW (lpString=".docx") returned 5
	[0105.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.353] lstrlenW (lpString=".pdf") returned 4
	[0105.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.353] lstrlenW (lpString=".xls") returned 4
	[0105.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.353] lstrlenW (lpString=".xlsx") returned 5
	[0105.354] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.354] lstrlenW (lpString=".ppt") returned 4
	[0105.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0105.354] lstrlenW (lpString=".zip") returned 4
	[0105.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.354] lstrlenW (lpString=".rar") returned 4
	[0105.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.354] lstrlenW (lpString=".bz2") returned 4
	[0105.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.354] lstrlenW (lpString=".7z") returned 3
	[0105.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0105.354] lstrlenW (lpString=".dbf") returned 4
	[0105.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0105.354] lstrlenW (lpString=".1cd") returned 4
	[0105.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0105.354] lstrlenW (lpString=".jpg") returned 4
	[0105.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0105.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0105.354] lstrlenW (lpString=".doc") returned 4
	[0105.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.354] lstrlenW (lpString=".docx") returned 5
	[0105.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.355] lstrlenW (lpString=".pdf") returned 4
	[0105.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.355] lstrlenW (lpString=".xls") returned 4
	[0105.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.355] lstrlenW (lpString=".xlsx") returned 5
	[0105.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.355] lstrlenW (lpString=".ppt") returned 4
	[0105.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0105.355] lstrlenW (lpString=".zip") returned 4
	[0105.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.355] lstrlenW (lpString=".rar") returned 4
	[0105.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.355] lstrlenW (lpString=".bz2") returned 4
	[0105.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.355] lstrlenW (lpString=".7z") returned 3
	[0105.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0105.355] lstrlenW (lpString=".dbf") returned 4
	[0105.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0105.355] lstrlenW (lpString=".1cd") returned 4
	[0105.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0105.355] lstrlenW (lpString=".jpg") returned 4
	[0105.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.356] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.356] lstrlenW (lpString="FD00799_.WMF") returned 12
	[0105.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.361] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=13968) returned 1
	[0105.362] CloseHandle (hObject=0x1dc) returned 1
	[0105.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x20
	[0105.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0105.370] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.370] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0105.389] GetLastError () returned 0x0
	[0105.389] ReadFile (in: hFile=0x1c4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x3690, lpOverlapped=0x0) returned 1
	[0105.416] WriteFile (in: hFile=0x1f0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x36a0, lpOverlapped=0x0) returned 1
	[0105.418] ReadFile (in: hFile=0x1c4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.418] WriteFile (in: hFile=0x1f0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.418] SetEndOfFile (hFile=0x1f0) returned 1
	[0105.418] CloseHandle (hObject=0x1f0) returned 1
	[0105.418] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.418] SetEndOfFile (hFile=0x1c4) returned 1
	[0105.419] CloseHandle (hObject=0x1c4) returned 1
	[0105.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 1
	[0105.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0105.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0105.420] lstrlenW (lpString=".doc") returned 4
	[0105.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.420] lstrlenW (lpString=".docx") returned 5
	[0105.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.420] lstrlenW (lpString=".pdf") returned 4
	[0105.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.420] lstrlenW (lpString=".xls") returned 4
	[0105.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.420] lstrlenW (lpString=".xlsx") returned 5
	[0105.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.420] lstrlenW (lpString=".ppt") returned 4
	[0105.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0105.420] lstrlenW (lpString=".zip") returned 4
	[0105.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.421] lstrlenW (lpString=".rar") returned 4
	[0105.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.421] lstrlenW (lpString=".bz2") returned 4
	[0105.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.421] lstrlenW (lpString=".7z") returned 3
	[0105.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0105.421] lstrlenW (lpString=".dbf") returned 4
	[0105.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0105.421] lstrlenW (lpString=".1cd") returned 4
	[0105.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0105.421] lstrlenW (lpString=".jpg") returned 4
	[0105.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0105.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0105.421] lstrlenW (lpString=".doc") returned 4
	[0105.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.421] lstrlenW (lpString=".docx") returned 5
	[0105.421] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.421] lstrlenW (lpString=".pdf") returned 4
	[0105.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.421] lstrlenW (lpString=".xls") returned 4
	[0105.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.422] lstrlenW (lpString=".xlsx") returned 5
	[0105.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.422] lstrlenW (lpString=".ppt") returned 4
	[0105.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0105.422] lstrlenW (lpString=".zip") returned 4
	[0105.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.422] lstrlenW (lpString=".rar") returned 4
	[0105.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.422] lstrlenW (lpString=".bz2") returned 4
	[0105.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.422] lstrlenW (lpString=".7z") returned 3
	[0105.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0105.422] lstrlenW (lpString=".dbf") returned 4
	[0105.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0105.422] lstrlenW (lpString=".1cd") returned 4
	[0105.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0105.422] lstrlenW (lpString=".jpg") returned 4
	[0105.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.422] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.423] lstrlenW (lpString="FD00965_.WMF") returned 12
	[0105.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.440] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=15164) returned 1
	[0105.440] CloseHandle (hObject=0x1f4) returned 1
	[0105.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x20
	[0105.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.448] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.448] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0105.469] GetLastError () returned 0x0
	[0105.469] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x3b3c, lpOverlapped=0x0) returned 1
	[0105.480] WriteFile (in: hFile=0x1e0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x3b40, lpOverlapped=0x0) returned 1
	[0105.481] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.481] WriteFile (in: hFile=0x1e0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.481] SetEndOfFile (hFile=0x1e0) returned 1
	[0105.481] CloseHandle (hObject=0x1e0) returned 1
	[0105.481] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.481] SetEndOfFile (hFile=0x1e8) returned 1
	[0105.482] CloseHandle (hObject=0x1e8) returned 1
	[0105.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 1
	[0105.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0105.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0105.483] lstrlenW (lpString=".doc") returned 4
	[0105.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.483] lstrlenW (lpString=".docx") returned 5
	[0105.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.483] lstrlenW (lpString=".pdf") returned 4
	[0105.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.483] lstrlenW (lpString=".xls") returned 4
	[0105.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.483] lstrlenW (lpString=".xlsx") returned 5
	[0105.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.483] lstrlenW (lpString=".ppt") returned 4
	[0105.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0105.483] lstrlenW (lpString=".zip") returned 4
	[0105.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.483] lstrlenW (lpString=".rar") returned 4
	[0105.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.483] lstrlenW (lpString=".bz2") returned 4
	[0105.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.483] lstrlenW (lpString=".7z") returned 3
	[0105.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0105.483] lstrlenW (lpString=".dbf") returned 4
	[0105.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0105.483] lstrlenW (lpString=".1cd") returned 4
	[0105.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0105.483] lstrlenW (lpString=".jpg") returned 4
	[0105.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0105.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0105.484] lstrlenW (lpString=".doc") returned 4
	[0105.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.484] lstrlenW (lpString=".docx") returned 5
	[0105.484] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.484] lstrlenW (lpString=".pdf") returned 4
	[0105.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.484] lstrlenW (lpString=".xls") returned 4
	[0105.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.484] lstrlenW (lpString=".xlsx") returned 5
	[0105.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.484] lstrlenW (lpString=".ppt") returned 4
	[0105.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0105.484] lstrlenW (lpString=".zip") returned 4
	[0105.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.484] lstrlenW (lpString=".rar") returned 4
	[0105.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.484] lstrlenW (lpString=".bz2") returned 4
	[0105.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.484] lstrlenW (lpString=".7z") returned 3
	[0105.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0105.484] lstrlenW (lpString=".dbf") returned 4
	[0105.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0105.484] lstrlenW (lpString=".1cd") returned 4
	[0105.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0105.484] lstrlenW (lpString=".jpg") returned 4
	[0105.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.485] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.485] lstrlenW (lpString="FD01084_.WMF") returned 12
	[0105.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.485] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2412) returned 1
	[0105.486] CloseHandle (hObject=0x1e8) returned 1
	[0105.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x20
	[0105.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.486] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.486] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0105.487] GetLastError () returned 0x0
	[0105.487] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x96c, lpOverlapped=0x0) returned 1
	[0105.502] WriteFile (in: hFile=0x1e0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x970, lpOverlapped=0x0) returned 1
	[0105.504] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.504] WriteFile (in: hFile=0x1e0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.504] SetEndOfFile (hFile=0x1e0) returned 1
	[0105.504] CloseHandle (hObject=0x1e0) returned 1
	[0105.504] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.504] SetEndOfFile (hFile=0x1e8) returned 1
	[0105.505] CloseHandle (hObject=0x1e8) returned 1
	[0105.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 1
	[0105.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0105.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0105.506] lstrlenW (lpString=".doc") returned 4
	[0105.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.506] lstrlenW (lpString=".docx") returned 5
	[0105.506] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.506] lstrlenW (lpString=".pdf") returned 4
	[0105.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.506] lstrlenW (lpString=".xls") returned 4
	[0105.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.506] lstrlenW (lpString=".xlsx") returned 5
	[0105.506] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.506] lstrlenW (lpString=".ppt") returned 4
	[0105.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0105.506] lstrlenW (lpString=".zip") returned 4
	[0105.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.506] lstrlenW (lpString=".rar") returned 4
	[0105.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.506] lstrlenW (lpString=".bz2") returned 4
	[0105.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.506] lstrlenW (lpString=".7z") returned 3
	[0105.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0105.507] lstrlenW (lpString=".dbf") returned 4
	[0105.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0105.507] lstrlenW (lpString=".1cd") returned 4
	[0105.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0105.507] lstrlenW (lpString=".jpg") returned 4
	[0105.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0105.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0105.507] lstrlenW (lpString=".doc") returned 4
	[0105.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.507] lstrlenW (lpString=".docx") returned 5
	[0105.507] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.507] lstrlenW (lpString=".pdf") returned 4
	[0105.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.507] lstrlenW (lpString=".xls") returned 4
	[0105.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.507] lstrlenW (lpString=".xlsx") returned 5
	[0105.507] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.507] lstrlenW (lpString=".ppt") returned 4
	[0105.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0105.507] lstrlenW (lpString=".zip") returned 4
	[0105.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.508] lstrlenW (lpString=".rar") returned 4
	[0105.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.508] lstrlenW (lpString=".bz2") returned 4
	[0105.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.508] lstrlenW (lpString=".7z") returned 3
	[0105.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0105.508] lstrlenW (lpString=".dbf") returned 4
	[0105.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0105.508] lstrlenW (lpString=".1cd") returned 4
	[0105.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0105.508] lstrlenW (lpString=".jpg") returned 4
	[0105.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.509] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.509] lstrlenW (lpString="FD01191_.WMF") returned 12
	[0105.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.523] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=3964) returned 1
	[0105.523] CloseHandle (hObject=0x1dc) returned 1
	[0105.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x20
	[0105.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.530] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.530] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.535] GetLastError () returned 0x0
	[0105.535] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0xf7c, lpOverlapped=0x0) returned 1
	[0105.548] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xf80, lpOverlapped=0x0) returned 1
	[0105.549] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.550] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.550] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.550] CloseHandle (hObject=0x1d8) returned 1
	[0105.550] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.550] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.551] CloseHandle (hObject=0x1f4) returned 1
	[0105.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 1
	[0105.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0105.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0105.552] lstrlenW (lpString=".doc") returned 4
	[0105.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.552] lstrlenW (lpString=".docx") returned 5
	[0105.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.552] lstrlenW (lpString=".pdf") returned 4
	[0105.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.552] lstrlenW (lpString=".xls") returned 4
	[0105.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.552] lstrlenW (lpString=".xlsx") returned 5
	[0105.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.552] lstrlenW (lpString=".ppt") returned 4
	[0105.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0105.552] lstrlenW (lpString=".zip") returned 4
	[0105.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.552] lstrlenW (lpString=".rar") returned 4
	[0105.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.552] lstrlenW (lpString=".bz2") returned 4
	[0105.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.552] lstrlenW (lpString=".7z") returned 3
	[0105.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0105.552] lstrlenW (lpString=".dbf") returned 4
	[0105.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0105.552] lstrlenW (lpString=".1cd") returned 4
	[0105.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0105.552] lstrlenW (lpString=".jpg") returned 4
	[0105.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0105.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0105.553] lstrlenW (lpString=".doc") returned 4
	[0105.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.553] lstrlenW (lpString=".docx") returned 5
	[0105.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.553] lstrlenW (lpString=".pdf") returned 4
	[0105.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.553] lstrlenW (lpString=".xls") returned 4
	[0105.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.553] lstrlenW (lpString=".xlsx") returned 5
	[0105.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.553] lstrlenW (lpString=".ppt") returned 4
	[0105.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0105.553] lstrlenW (lpString=".zip") returned 4
	[0105.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.553] lstrlenW (lpString=".rar") returned 4
	[0105.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.553] lstrlenW (lpString=".bz2") returned 4
	[0105.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.553] lstrlenW (lpString=".7z") returned 3
	[0105.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0105.553] lstrlenW (lpString=".dbf") returned 4
	[0105.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0105.553] lstrlenW (lpString=".1cd") returned 4
	[0105.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0105.553] lstrlenW (lpString=".jpg") returned 4
	[0105.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.554] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.554] lstrlenW (lpString="FD01196_.WMF") returned 12
	[0105.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.555] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=2332) returned 1
	[0105.555] CloseHandle (hObject=0x1f4) returned 1
	[0105.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x20
	[0105.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.555] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.555] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.556] GetLastError () returned 0x0
	[0105.556] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x91c, lpOverlapped=0x0) returned 1
	[0105.577] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x920, lpOverlapped=0x0) returned 1
	[0105.578] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.578] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.578] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.579] CloseHandle (hObject=0x1d8) returned 1
	[0105.579] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.579] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.580] CloseHandle (hObject=0x1f4) returned 1
	[0105.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 1
	[0105.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0105.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0105.580] lstrlenW (lpString=".doc") returned 4
	[0105.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.580] lstrlenW (lpString=".docx") returned 5
	[0105.580] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.581] lstrlenW (lpString=".pdf") returned 4
	[0105.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.581] lstrlenW (lpString=".xls") returned 4
	[0105.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.581] lstrlenW (lpString=".xlsx") returned 5
	[0105.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.581] lstrlenW (lpString=".ppt") returned 4
	[0105.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0105.581] lstrlenW (lpString=".zip") returned 4
	[0105.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.581] lstrlenW (lpString=".rar") returned 4
	[0105.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.581] lstrlenW (lpString=".bz2") returned 4
	[0105.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.581] lstrlenW (lpString=".7z") returned 3
	[0105.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0105.581] lstrlenW (lpString=".dbf") returned 4
	[0105.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0105.581] lstrlenW (lpString=".1cd") returned 4
	[0105.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0105.581] lstrlenW (lpString=".jpg") returned 4
	[0105.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0105.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0105.582] lstrlenW (lpString=".doc") returned 4
	[0105.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.582] lstrlenW (lpString=".docx") returned 5
	[0105.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.582] lstrlenW (lpString=".pdf") returned 4
	[0105.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.582] lstrlenW (lpString=".xls") returned 4
	[0105.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.582] lstrlenW (lpString=".xlsx") returned 5
	[0105.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.582] lstrlenW (lpString=".ppt") returned 4
	[0105.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0105.582] lstrlenW (lpString=".zip") returned 4
	[0105.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.582] lstrlenW (lpString=".rar") returned 4
	[0105.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.582] lstrlenW (lpString=".bz2") returned 4
	[0105.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.582] lstrlenW (lpString=".7z") returned 3
	[0105.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0105.583] lstrlenW (lpString=".dbf") returned 4
	[0105.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0105.583] lstrlenW (lpString=".1cd") returned 4
	[0105.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0105.583] lstrlenW (lpString=".jpg") returned 4
	[0105.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.583] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.583] lstrlenW (lpString="FD01657_.WMF") returned 12
	[0105.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.584] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=30414) returned 1
	[0105.584] CloseHandle (hObject=0x1f4) returned 1
	[0105.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x20
	[0105.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.585] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.585] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.586] GetLastError () returned 0x0
	[0105.586] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x76ce, lpOverlapped=0x0) returned 1
	[0105.600] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0x76d0, lpOverlapped=0x0) returned 1
	[0105.602] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x235fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x235fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.602] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x235fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x235fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.602] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.602] CloseHandle (hObject=0x1d8) returned 1
	[0105.602] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.602] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.604] CloseHandle (hObject=0x1f4) returned 1
	[0105.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 1
	[0105.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0105.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0105.605] lstrlenW (lpString=".doc") returned 4
	[0105.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.605] lstrlenW (lpString=".docx") returned 5
	[0105.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.605] lstrlenW (lpString=".pdf") returned 4
	[0105.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.605] lstrlenW (lpString=".xls") returned 4
	[0105.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.605] lstrlenW (lpString=".xlsx") returned 5
	[0105.605] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.605] lstrlenW (lpString=".ppt") returned 4
	[0105.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0105.606] lstrlenW (lpString=".zip") returned 4
	[0105.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.606] lstrlenW (lpString=".rar") returned 4
	[0105.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.606] lstrlenW (lpString=".bz2") returned 4
	[0105.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.606] lstrlenW (lpString=".7z") returned 3
	[0105.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0105.606] lstrlenW (lpString=".dbf") returned 4
	[0105.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0105.606] lstrlenW (lpString=".1cd") returned 4
	[0105.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0105.606] lstrlenW (lpString=".jpg") returned 4
	[0105.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0105.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0105.606] lstrlenW (lpString=".doc") returned 4
	[0105.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.606] lstrlenW (lpString=".docx") returned 5
	[0105.606] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.606] lstrlenW (lpString=".pdf") returned 4
	[0105.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.607] lstrlenW (lpString=".xls") returned 4
	[0105.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.607] lstrlenW (lpString=".xlsx") returned 5
	[0105.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.607] lstrlenW (lpString=".ppt") returned 4
	[0105.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0105.607] lstrlenW (lpString=".zip") returned 4
	[0105.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.607] lstrlenW (lpString=".rar") returned 4
	[0105.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.607] lstrlenW (lpString=".bz2") returned 4
	[0105.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.607] lstrlenW (lpString=".7z") returned 3
	[0105.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0105.607] lstrlenW (lpString=".dbf") returned 4
	[0105.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0105.607] lstrlenW (lpString=".1cd") returned 4
	[0105.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0105.607] lstrlenW (lpString=".jpg") returned 4
	[0105.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.608] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.608] lstrlenW (lpString="FD01659_.WMF") returned 12
	[0105.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.615] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x235ff1c | out: lpFileSize=0x235ff1c*=31180) returned 1
	[0105.615] CloseHandle (hObject=0x1f4) returned 1
	[0105.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x20
	[0105.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.660] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.660] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x235fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 55
	os_tid = 0xb8c

	[0073.171] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x680408
	[0073.171] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x690410
	[0073.172] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630920
	[0073.172] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x62ce98
	[0073.172] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630938
	[0073.172] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3530020
	[0073.172] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630950
	[0073.172] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630950, Size=0x20) returned 0x6162b0
	[0073.172] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630950
	[0073.172] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630950, Size=0x20) returned 0x6162d8
	[0073.172] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0073.172] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0073.173] Wow64DisableWow64FsRedirection (in: OldValue=0x2b5ff58 | out: OldValue=0x2b5ff58*=0x0) returned 1
	[0073.173] lstrlenW (lpString="kernel32.dll") returned 12
	[0073.173] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162b0 | out: hHeap=0x5e0000) returned 1
	[0073.173] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0073.173] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162d8 | out: hHeap=0x5e0000) returned 1
	[0073.173] Sleep (dwMilliseconds=0x64) 
	[0073.723] Sleep (dwMilliseconds=0x64) 
	[0074.245] lstrlenW (lpString="BCD") returned 3
	[0074.245] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.245] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0074.245] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0074.245] lstrlenW (lpString=".doc") returned 4
	[0074.246] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0074.246] lstrlenW (lpString=".docx") returned 5
	[0074.246] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0074.246] lstrlenW (lpString=".pdf") returned 4
	[0074.246] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0074.246] lstrlenW (lpString=".xls") returned 4
	[0074.246] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0074.246] lstrlenW (lpString=".xlsx") returned 5
	[0074.246] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0074.246] lstrlenW (lpString=".ppt") returned 4
	[0074.246] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0074.246] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0074.246] lstrlenW (lpString=".zip") returned 4
	[0074.246] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0074.246] lstrlenW (lpString=".rar") returned 4
	[0074.246] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0074.246] lstrlenW (lpString=".bz2") returned 4
	[0074.246] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0074.246] lstrlenW (lpString=".7z") returned 3
	[0074.246] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0074.246] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0074.246] lstrlenW (lpString=".dbf") returned 4
	[0074.246] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0074.246] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0074.246] lstrlenW (lpString=".1cd") returned 4
	[0074.247] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0074.247] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0074.247] lstrlenW (lpString=".jpg") returned 4
	[0074.247] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0074.247] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0074.247] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0074.247] lstrlenW (lpString=".doc") returned 4
	[0074.247] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0074.247] lstrlenW (lpString=".docx") returned 5
	[0074.247] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0074.247] lstrlenW (lpString=".pdf") returned 4
	[0074.247] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0074.247] lstrlenW (lpString=".xls") returned 4
	[0074.247] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0074.247] lstrlenW (lpString=".xlsx") returned 5
	[0074.247] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0074.247] lstrlenW (lpString=".ppt") returned 4
	[0074.247] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0074.247] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0074.247] lstrlenW (lpString=".zip") returned 4
	[0074.247] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0074.247] lstrlenW (lpString=".rar") returned 4
	[0074.247] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0074.247] lstrlenW (lpString=".bz2") returned 4
	[0074.247] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0074.247] lstrlenW (lpString=".7z") returned 3
	[0074.248] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0074.248] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0074.248] lstrlenW (lpString=".dbf") returned 4
	[0074.248] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0074.248] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0074.248] lstrlenW (lpString=".1cd") returned 4
	[0074.248] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0074.248] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0074.248] lstrlenW (lpString=".jpg") returned 4
	[0074.248] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0074.248] lstrcmpiW (lpString1=".LOG1", lpString2=".adobe") returned 1
	[0074.248] lstrlenW (lpString="BCD.LOG1") returned 8
	[0074.248] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0074.249] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=0) returned 1
	[0074.249] CloseHandle (hObject=0x170) returned 1
	[0074.249] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.249] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.249] lstrlenW (lpString=".doc") returned 4
	[0074.249] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0074.249] lstrlenW (lpString=".docx") returned 5
	[0074.249] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0074.249] lstrlenW (lpString=".pdf") returned 4
	[0074.249] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0074.249] lstrlenW (lpString=".xls") returned 4
	[0074.249] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0074.249] lstrlenW (lpString=".xlsx") returned 5
	[0074.249] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0074.249] lstrlenW (lpString=".ppt") returned 4
	[0074.249] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0074.249] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.249] lstrlenW (lpString=".zip") returned 4
	[0074.249] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0074.249] lstrlenW (lpString=".rar") returned 4
	[0074.249] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0074.249] lstrlenW (lpString=".bz2") returned 4
	[0074.250] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0074.250] lstrlenW (lpString=".7z") returned 3
	[0074.250] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0074.250] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.250] lstrlenW (lpString=".dbf") returned 4
	[0074.250] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0074.250] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.250] lstrlenW (lpString=".1cd") returned 4
	[0074.250] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0074.250] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.250] lstrlenW (lpString=".jpg") returned 4
	[0074.250] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0074.250] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.250] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.251] lstrlenW (lpString=".doc") returned 4
	[0074.251] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0074.251] lstrlenW (lpString=".docx") returned 5
	[0074.251] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0074.251] lstrlenW (lpString=".pdf") returned 4
	[0074.251] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0074.251] lstrlenW (lpString=".xls") returned 4
	[0074.251] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0074.251] lstrlenW (lpString=".xlsx") returned 5
	[0074.251] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0074.251] lstrlenW (lpString=".ppt") returned 4
	[0074.251] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0074.251] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.251] lstrlenW (lpString=".zip") returned 4
	[0074.251] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0074.251] lstrlenW (lpString=".rar") returned 4
	[0074.251] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0074.251] lstrlenW (lpString=".bz2") returned 4
	[0074.251] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0074.251] lstrlenW (lpString=".7z") returned 3
	[0074.251] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0074.251] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.251] lstrlenW (lpString=".dbf") returned 4
	[0074.251] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0074.251] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.251] lstrlenW (lpString=".1cd") returned 4
	[0074.251] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0074.252] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.252] lstrlenW (lpString=".jpg") returned 4
	[0074.252] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0074.252] lstrcmpiW (lpString1=".LOG2", lpString2=".adobe") returned 1
	[0074.252] lstrlenW (lpString="BCD.LOG2") returned 8
	[0074.252] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0074.252] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=0) returned 1
	[0074.252] CloseHandle (hObject=0x170) returned 1
	[0074.253] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.253] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.253] lstrlenW (lpString=".doc") returned 4
	[0074.253] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0074.253] lstrlenW (lpString=".docx") returned 5
	[0074.253] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0074.253] lstrlenW (lpString=".pdf") returned 4
	[0074.253] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0074.253] lstrlenW (lpString=".xls") returned 4
	[0074.253] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0074.253] lstrlenW (lpString=".xlsx") returned 5
	[0074.253] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0074.253] lstrlenW (lpString=".ppt") returned 4
	[0074.253] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0074.253] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.253] lstrlenW (lpString=".zip") returned 4
	[0074.253] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0074.253] lstrlenW (lpString=".rar") returned 4
	[0074.253] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0074.253] lstrlenW (lpString=".bz2") returned 4
	[0074.253] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0074.253] lstrlenW (lpString=".7z") returned 3
	[0074.253] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0074.253] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.253] lstrlenW (lpString=".dbf") returned 4
	[0074.253] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0074.253] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.253] lstrlenW (lpString=".1cd") returned 4
	[0074.254] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0074.254] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.254] lstrlenW (lpString=".jpg") returned 4
	[0074.254] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0074.254] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.254] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.254] lstrlenW (lpString=".doc") returned 4
	[0074.254] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0074.254] lstrlenW (lpString=".docx") returned 5
	[0074.254] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0074.254] lstrlenW (lpString=".pdf") returned 4
	[0074.254] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0074.254] lstrlenW (lpString=".xls") returned 4
	[0074.254] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0074.254] lstrlenW (lpString=".xlsx") returned 5
	[0074.254] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0074.254] lstrlenW (lpString=".ppt") returned 4
	[0074.254] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0074.254] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.254] lstrlenW (lpString=".zip") returned 4
	[0074.254] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0074.254] lstrlenW (lpString=".rar") returned 4
	[0074.254] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0074.254] lstrlenW (lpString=".bz2") returned 4
	[0074.254] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0074.254] lstrlenW (lpString=".7z") returned 3
	[0074.255] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0074.255] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.255] lstrlenW (lpString=".dbf") returned 4
	[0074.255] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0074.255] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.255] lstrlenW (lpString=".1cd") returned 4
	[0074.255] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0074.255] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.255] lstrlenW (lpString=".jpg") returned 4
	[0074.255] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0074.255] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0074.255] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0074.255] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0074.255] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=89168) returned 1
	[0074.256] CloseHandle (hObject=0x170) returned 1
	[0074.256] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20
	[0074.256] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.256] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.256] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.256] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.256] lstrlenW (lpString=".doc") returned 4
	[0074.256] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.256] lstrlenW (lpString=".docx") returned 5
	[0074.256] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.256] lstrlenW (lpString=".pdf") returned 4
	[0074.256] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.256] lstrlenW (lpString=".xls") returned 4
	[0074.256] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.256] lstrlenW (lpString=".xlsx") returned 5
	[0074.256] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.256] lstrlenW (lpString=".ppt") returned 4
	[0074.257] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.257] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.257] lstrlenW (lpString=".zip") returned 4
	[0074.257] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.257] lstrlenW (lpString=".rar") returned 4
	[0074.257] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.257] lstrlenW (lpString=".bz2") returned 4
	[0074.257] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.257] lstrlenW (lpString=".7z") returned 3
	[0074.257] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.257] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.257] lstrlenW (lpString=".dbf") returned 4
	[0074.257] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.257] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.257] lstrlenW (lpString=".1cd") returned 4
	[0074.257] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.257] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.257] lstrlenW (lpString=".jpg") returned 4
	[0074.257] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.257] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.257] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.257] lstrlenW (lpString=".doc") returned 4
	[0074.257] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.257] lstrlenW (lpString=".docx") returned 5
	[0074.257] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.257] lstrlenW (lpString=".pdf") returned 4
	[0074.258] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.258] lstrlenW (lpString=".xls") returned 4
	[0074.258] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.258] lstrlenW (lpString=".xlsx") returned 5
	[0074.258] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.258] lstrlenW (lpString=".ppt") returned 4
	[0074.258] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.258] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.258] lstrlenW (lpString=".zip") returned 4
	[0074.258] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.258] lstrlenW (lpString=".rar") returned 4
	[0074.258] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.258] lstrlenW (lpString=".bz2") returned 4
	[0074.258] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.258] lstrlenW (lpString=".7z") returned 3
	[0074.258] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.258] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.258] lstrlenW (lpString=".dbf") returned 4
	[0074.258] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.258] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.258] lstrlenW (lpString=".1cd") returned 4
	[0074.258] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.258] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.258] lstrlenW (lpString=".jpg") returned 4
	[0074.258] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.259] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0074.259] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0074.259] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0074.259] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=87616) returned 1
	[0074.259] CloseHandle (hObject=0x170) returned 1
	[0074.259] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20
	[0074.259] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.259] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.260] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0074.260] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0074.260] lstrlenW (lpString=".doc") returned 4
	[0074.260] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.260] lstrlenW (lpString=".docx") returned 5
	[0074.260] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.260] lstrlenW (lpString=".pdf") returned 4
	[0074.260] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.260] lstrlenW (lpString=".xls") returned 4
	[0074.260] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.260] lstrlenW (lpString=".xlsx") returned 5
	[0074.260] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.260] lstrlenW (lpString=".ppt") returned 4
	[0074.260] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.260] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0074.260] lstrlenW (lpString=".zip") returned 4
	[0074.260] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.260] lstrlenW (lpString=".rar") returned 4
	[0074.260] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.260] lstrlenW (lpString=".bz2") returned 4
	[0074.260] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.260] lstrlenW (lpString=".7z") returned 3
	[0074.260] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.260] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0074.260] lstrlenW (lpString=".dbf") returned 4
	[0074.260] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.260] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0074.261] lstrlenW (lpString=".1cd") returned 4
	[0074.261] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.261] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0074.261] lstrlenW (lpString=".jpg") returned 4
	[0074.261] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.261] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0074.261] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0074.261] lstrlenW (lpString=".doc") returned 4
	[0074.261] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.261] lstrlenW (lpString=".docx") returned 5
	[0074.261] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.261] lstrlenW (lpString=".pdf") returned 4
	[0074.261] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.261] lstrlenW (lpString=".xls") returned 4
	[0074.261] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.261] lstrlenW (lpString=".xlsx") returned 5
	[0074.261] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.261] lstrlenW (lpString=".ppt") returned 4
	[0074.261] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.261] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0074.261] lstrlenW (lpString=".zip") returned 4
	[0074.261] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.261] lstrlenW (lpString=".rar") returned 4
	[0074.261] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.261] lstrlenW (lpString=".bz2") returned 4
	[0074.262] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.262] lstrlenW (lpString=".7z") returned 3
	[0074.262] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.262] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0074.262] lstrlenW (lpString=".dbf") returned 4
	[0074.262] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.262] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0074.262] lstrlenW (lpString=".1cd") returned 4
	[0074.262] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.262] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0074.262] lstrlenW (lpString=".jpg") returned 4
	[0074.262] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.262] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0074.262] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0074.262] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0074.263] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=91712) returned 1
	[0074.263] CloseHandle (hObject=0x170) returned 1
	[0074.263] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20
	[0074.263] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.263] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.263] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0074.263] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0074.263] lstrlenW (lpString=".doc") returned 4
	[0074.263] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.263] lstrlenW (lpString=".docx") returned 5
	[0074.263] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.263] lstrlenW (lpString=".pdf") returned 4
	[0074.263] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.263] lstrlenW (lpString=".xls") returned 4
	[0074.263] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.263] lstrlenW (lpString=".xlsx") returned 5
	[0074.263] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.263] lstrlenW (lpString=".ppt") returned 4
	[0074.264] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.264] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0074.264] lstrlenW (lpString=".zip") returned 4
	[0074.264] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.264] lstrlenW (lpString=".rar") returned 4
	[0074.264] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.264] lstrlenW (lpString=".bz2") returned 4
	[0074.264] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.264] lstrlenW (lpString=".7z") returned 3
	[0074.264] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.264] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0074.264] lstrlenW (lpString=".dbf") returned 4
	[0074.264] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.264] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0074.264] lstrlenW (lpString=".1cd") returned 4
	[0074.264] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.264] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0074.264] lstrlenW (lpString=".jpg") returned 4
	[0074.264] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.264] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0074.264] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0074.264] lstrlenW (lpString=".doc") returned 4
	[0074.264] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.264] lstrlenW (lpString=".docx") returned 5
	[0074.264] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.264] lstrlenW (lpString=".pdf") returned 4
	[0074.265] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.265] lstrlenW (lpString=".xls") returned 4
	[0074.265] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.265] lstrlenW (lpString=".xlsx") returned 5
	[0074.265] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.265] lstrlenW (lpString=".ppt") returned 4
	[0074.265] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.265] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0074.265] lstrlenW (lpString=".zip") returned 4
	[0074.265] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.265] lstrlenW (lpString=".rar") returned 4
	[0074.265] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.265] lstrlenW (lpString=".bz2") returned 4
	[0074.265] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.265] lstrlenW (lpString=".7z") returned 3
	[0074.265] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.265] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0074.265] lstrlenW (lpString=".dbf") returned 4
	[0074.265] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.265] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0074.265] lstrlenW (lpString=".1cd") returned 4
	[0074.265] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.265] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0074.265] lstrlenW (lpString=".jpg") returned 4
	[0074.265] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.266] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0074.266] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0074.266] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0074.266] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=94800) returned 1
	[0074.266] CloseHandle (hObject=0x170) returned 1
	[0074.266] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20
	[0074.266] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.266] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.267] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0074.267] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0074.267] lstrlenW (lpString=".doc") returned 4
	[0074.267] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.267] lstrlenW (lpString=".docx") returned 5
	[0074.267] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.267] lstrlenW (lpString=".pdf") returned 4
	[0074.267] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.267] lstrlenW (lpString=".xls") returned 4
	[0074.267] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.267] lstrlenW (lpString=".xlsx") returned 5
	[0074.267] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.267] lstrlenW (lpString=".ppt") returned 4
	[0074.267] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.267] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0074.267] lstrlenW (lpString=".zip") returned 4
	[0074.267] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.267] lstrlenW (lpString=".rar") returned 4
	[0074.267] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.267] lstrlenW (lpString=".bz2") returned 4
	[0074.267] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.267] lstrlenW (lpString=".7z") returned 3
	[0074.267] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.267] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0074.269] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0074.738] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0074.769] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0074.770] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0074.770] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0074.770] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0074.770] ReadFile (in: hFile=0x160, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0074.815] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0074.815] ReadFile (in: hFile=0x160, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0074.823] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0074.823] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0074.823] ReadFile (in: hFile=0x160, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0074.843] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.843] WriteFile (in: hFile=0x160, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0074.886] SetEndOfFile (hFile=0x160) returned 1
	[0074.886] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f01060
	[0075.076] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0075.076] WriteFile (in: hFile=0x160, lpBuffer=0x3f01060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f01060*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0075.077] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0075.077] WriteFile (in: hFile=0x160, lpBuffer=0x3f01060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f01060*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0075.078] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0075.078] WriteFile (in: hFile=0x160, lpBuffer=0x3f01060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f01060*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0075.079] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f01060 | out: hHeap=0x5e0000) returned 1
	[0075.079] CloseHandle (hObject=0x160) returned 1
	[0075.643] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0075.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0075.643] lstrlenW (lpString=".doc") returned 4
	[0075.643] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0075.643] lstrlenW (lpString=".docx") returned 5
	[0075.643] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0075.643] lstrlenW (lpString=".pdf") returned 4
	[0075.643] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0075.643] lstrlenW (lpString=".xls") returned 4
	[0075.643] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0075.643] lstrlenW (lpString=".xlsx") returned 5
	[0075.643] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0075.644] lstrlenW (lpString=".ppt") returned 4
	[0075.644] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0075.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0075.644] lstrlenW (lpString=".zip") returned 4
	[0075.644] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0075.644] lstrlenW (lpString=".rar") returned 4
	[0075.644] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0075.644] lstrlenW (lpString=".bz2") returned 4
	[0075.644] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0075.644] lstrlenW (lpString=".7z") returned 3
	[0075.644] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0075.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0075.644] lstrlenW (lpString=".dbf") returned 4
	[0075.644] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0075.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0075.644] lstrlenW (lpString=".1cd") returned 4
	[0075.644] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0075.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0075.644] lstrlenW (lpString=".jpg") returned 4
	[0075.644] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0075.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0075.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0075.644] lstrlenW (lpString=".doc") returned 4
	[0075.644] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0075.644] lstrlenW (lpString=".docx") returned 5
	[0075.644] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0075.644] lstrlenW (lpString=".pdf") returned 4
	[0075.644] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0075.644] lstrlenW (lpString=".xls") returned 4
	[0075.644] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0075.644] lstrlenW (lpString=".xlsx") returned 5
	[0075.644] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0075.645] lstrlenW (lpString=".ppt") returned 4
	[0075.645] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0075.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0075.645] lstrlenW (lpString=".zip") returned 4
	[0075.645] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0075.645] lstrlenW (lpString=".rar") returned 4
	[0075.645] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0075.645] lstrlenW (lpString=".bz2") returned 4
	[0075.645] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0075.645] lstrlenW (lpString=".7z") returned 3
	[0075.645] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0075.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0075.645] lstrlenW (lpString=".dbf") returned 4
	[0075.645] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0075.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0075.645] lstrlenW (lpString=".1cd") returned 4
	[0075.645] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0075.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0075.645] lstrlenW (lpString=".jpg") returned 4
	[0075.645] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0075.645] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0075.645] lstrlenW (lpString="PubLR.cab") returned 9
	[0075.645] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.744] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=9958388) returned 1
	[0075.744] CloseHandle (hObject=0x1ac) returned 1
	[0075.744] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020
	[0075.744] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.746] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0076.234] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0076.234] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0076.234] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0076.234] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0076.239] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0076.239] ReadFile (in: hFile=0x1a4, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0076.338] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0076.338] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0076.338] ReadFile (in: hFile=0x1a4, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0076.475] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.475] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0076.496] SetEndOfFile (hFile=0x1a4) returned 1
	[0076.496] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0076.500] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0076.500] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0076.502] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0076.502] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0076.506] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0076.506] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0076.523] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0076.525] CloseHandle (hObject=0x1a4) returned 1
	[0077.990] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0077.991] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0077.991] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0077.991] lstrlenW (lpString=".doc") returned 4
	[0077.991] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0077.991] lstrlenW (lpString=".docx") returned 5
	[0077.991] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0077.991] lstrlenW (lpString=".pdf") returned 4
	[0077.991] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0077.991] lstrlenW (lpString=".xls") returned 4
	[0077.991] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0077.991] lstrlenW (lpString=".xlsx") returned 5
	[0077.991] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0077.991] lstrlenW (lpString=".ppt") returned 4
	[0077.991] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0077.991] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0077.991] lstrlenW (lpString=".zip") returned 4
	[0077.991] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0077.991] lstrlenW (lpString=".rar") returned 4
	[0077.991] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0077.992] lstrlenW (lpString=".bz2") returned 4
	[0077.992] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0077.992] lstrlenW (lpString=".7z") returned 3
	[0077.992] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0077.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0077.992] lstrlenW (lpString=".dbf") returned 4
	[0077.992] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0077.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0077.992] lstrlenW (lpString=".1cd") returned 4
	[0077.992] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0077.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0077.992] lstrlenW (lpString=".jpg") returned 4
	[0077.992] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0077.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0077.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0077.992] lstrlenW (lpString=".doc") returned 4
	[0077.992] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0077.992] lstrlenW (lpString=".docx") returned 5
	[0077.992] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0077.992] lstrlenW (lpString=".pdf") returned 4
	[0077.992] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0077.992] lstrlenW (lpString=".xls") returned 4
	[0077.992] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0077.992] lstrlenW (lpString=".xlsx") returned 5
	[0077.992] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0077.992] lstrlenW (lpString=".ppt") returned 4
	[0077.993] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0077.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0077.993] lstrlenW (lpString=".zip") returned 4
	[0077.993] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0077.993] lstrlenW (lpString=".rar") returned 4
	[0077.993] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0077.993] lstrlenW (lpString=".bz2") returned 4
	[0077.993] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0077.993] lstrlenW (lpString=".7z") returned 3
	[0077.993] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0077.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0077.993] lstrlenW (lpString=".dbf") returned 4
	[0077.993] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0077.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0077.993] lstrlenW (lpString=".1cd") returned 4
	[0077.993] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0077.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0077.993] lstrlenW (lpString=".jpg") returned 4
	[0077.993] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0077.993] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0077.993] lstrlenW (lpString="WordMUI.msi") returned 11
	[0077.993] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0077.994] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=2522624) returned 1
	[0077.994] CloseHandle (hObject=0x1a4) returned 1
	[0077.994] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020
	[0077.994] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0077.995] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0077.995] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0077.996] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0077.996] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.996] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0078.178] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0078.178] ReadFile (in: hFile=0x1a4, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0078.261] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0078.261] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0078.261] ReadFile (in: hFile=0x1a4, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0078.340] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.340] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0078.359] SetEndOfFile (hFile=0x1a4) returned 1
	[0078.360] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f40078
	[0078.411] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.412] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.461] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.461] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.469] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.469] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.473] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f40078 | out: hHeap=0x5e0000) returned 1
	[0078.475] CloseHandle (hObject=0x1a4) returned 1
	[0078.682] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0078.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0078.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0078.683] lstrlenW (lpString=".doc") returned 4
	[0078.683] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0078.683] lstrlenW (lpString=".docx") returned 5
	[0078.683] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0078.683] lstrlenW (lpString=".pdf") returned 4
	[0078.683] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0078.683] lstrlenW (lpString=".xls") returned 4
	[0078.683] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0078.683] lstrlenW (lpString=".xlsx") returned 5
	[0078.683] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0078.683] lstrlenW (lpString=".ppt") returned 4
	[0078.683] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0078.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0078.683] lstrlenW (lpString=".zip") returned 4
	[0078.683] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0078.683] lstrlenW (lpString=".rar") returned 4
	[0078.683] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0078.683] lstrlenW (lpString=".bz2") returned 4
	[0078.683] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0078.683] lstrlenW (lpString=".7z") returned 3
	[0078.683] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0078.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0078.683] lstrlenW (lpString=".dbf") returned 4
	[0078.683] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0078.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0078.684] lstrlenW (lpString=".1cd") returned 4
	[0078.684] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0078.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0078.684] lstrlenW (lpString=".jpg") returned 4
	[0078.684] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0078.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0078.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0078.684] lstrlenW (lpString=".doc") returned 4
	[0078.684] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0078.684] lstrlenW (lpString=".docx") returned 5
	[0078.684] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0078.684] lstrlenW (lpString=".pdf") returned 4
	[0078.684] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0078.684] lstrlenW (lpString=".xls") returned 4
	[0078.684] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0078.684] lstrlenW (lpString=".xlsx") returned 5
	[0078.684] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0078.684] lstrlenW (lpString=".ppt") returned 4
	[0078.684] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0078.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0078.684] lstrlenW (lpString=".zip") returned 4
	[0078.684] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0078.684] lstrlenW (lpString=".rar") returned 4
	[0078.684] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0078.684] lstrlenW (lpString=".bz2") returned 4
	[0078.684] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0078.685] lstrlenW (lpString=".7z") returned 3
	[0078.685] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0078.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0078.685] lstrlenW (lpString=".dbf") returned 4
	[0078.685] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0078.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0078.685] lstrlenW (lpString=".1cd") returned 4
	[0078.685] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0078.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0078.685] lstrlenW (lpString=".jpg") returned 4
	[0078.685] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0078.685] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0078.685] lstrlenW (lpString="Proof.cab") returned 9
	[0078.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0078.698] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=13642474) returned 1
	[0078.698] CloseHandle (hObject=0x198) returned 1
	[0078.698] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020
	[0078.941] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0078.942] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0080.377] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0080.378] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0080.378] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.378] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.509] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.509] ReadFile (in: hFile=0x1a8, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.514] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0080.514] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.514] ReadFile (in: hFile=0x1a8, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.538] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.538] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0080.719] SetEndOfFile (hFile=0x1a8) returned 1
	[0080.719] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f40078
	[0080.723] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.723] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.724] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.724] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.725] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.725] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.727] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f40078 | out: hHeap=0x5e0000) returned 1
	[0080.727] CloseHandle (hObject=0x1a8) returned 1
	[0080.727] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0080.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0080.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0080.728] lstrlenW (lpString=".doc") returned 4
	[0080.728] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0080.728] lstrlenW (lpString=".docx") returned 5
	[0080.728] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0080.728] lstrlenW (lpString=".pdf") returned 4
	[0080.728] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0080.728] lstrlenW (lpString=".xls") returned 4
	[0080.728] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0080.728] lstrlenW (lpString=".xlsx") returned 5
	[0080.728] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0080.728] lstrlenW (lpString=".ppt") returned 4
	[0080.728] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0080.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0080.728] lstrlenW (lpString=".zip") returned 4
	[0080.728] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0080.728] lstrlenW (lpString=".rar") returned 4
	[0080.728] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0080.728] lstrlenW (lpString=".bz2") returned 4
	[0080.728] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0080.728] lstrlenW (lpString=".7z") returned 3
	[0080.728] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0080.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0080.728] lstrlenW (lpString=".dbf") returned 4
	[0080.728] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0080.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0080.728] lstrlenW (lpString=".1cd") returned 4
	[0080.728] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0080.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0080.729] lstrlenW (lpString=".jpg") returned 4
	[0080.729] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0080.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0080.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0080.729] lstrlenW (lpString=".doc") returned 4
	[0080.729] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0080.729] lstrlenW (lpString=".docx") returned 5
	[0080.729] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0080.729] lstrlenW (lpString=".pdf") returned 4
	[0080.729] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0080.729] lstrlenW (lpString=".xls") returned 4
	[0080.729] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0080.729] lstrlenW (lpString=".xlsx") returned 5
	[0080.729] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0080.729] lstrlenW (lpString=".ppt") returned 4
	[0080.729] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0080.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0080.729] lstrlenW (lpString=".zip") returned 4
	[0080.729] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0080.729] lstrlenW (lpString=".rar") returned 4
	[0080.729] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0080.729] lstrlenW (lpString=".bz2") returned 4
	[0080.729] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0080.729] lstrlenW (lpString=".7z") returned 3
	[0080.729] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0080.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0080.729] lstrlenW (lpString=".dbf") returned 4
	[0080.729] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0080.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0080.730] lstrlenW (lpString=".1cd") returned 4
	[0080.730] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0080.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0080.730] lstrlenW (lpString=".jpg") returned 4
	[0080.730] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0080.730] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0080.730] lstrlenW (lpString="VisioLR.cab") returned 11
	[0080.730] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0080.730] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=50823389) returned 1
	[0080.730] CloseHandle (hObject=0x1a8) returned 1
	[0080.731] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020
	[0080.731] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0080.731] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0080.731] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0080.731] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0080.732] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.732] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.814] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.814] ReadFile (in: hFile=0x1a8, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.905] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0080.905] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.905] ReadFile (in: hFile=0x1a8, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0081.009] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.010] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0081.029] SetEndOfFile (hFile=0x1a8) returned 1
	[0081.029] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f80080
	[0081.084] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.084] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f80080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f80080*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.085] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.085] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f80080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f80080*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.086] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.086] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f80080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f80080*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.089] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f80080 | out: hHeap=0x5e0000) returned 1
	[0081.092] CloseHandle (hObject=0x1a8) returned 1
	[0081.093] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0081.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0081.093] lstrlenW (lpString=".doc") returned 4
	[0081.093] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0081.093] lstrlenW (lpString=".docx") returned 5
	[0081.093] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0081.093] lstrlenW (lpString=".pdf") returned 4
	[0081.093] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0081.093] lstrlenW (lpString=".xls") returned 4
	[0081.093] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0081.093] lstrlenW (lpString=".xlsx") returned 5
	[0081.093] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0081.093] lstrlenW (lpString=".ppt") returned 4
	[0081.093] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0081.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0081.093] lstrlenW (lpString=".zip") returned 4
	[0081.093] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0081.093] lstrlenW (lpString=".rar") returned 4
	[0081.093] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0081.093] lstrlenW (lpString=".bz2") returned 4
	[0081.093] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0081.093] lstrlenW (lpString=".7z") returned 3
	[0081.093] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0081.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0081.093] lstrlenW (lpString=".dbf") returned 4
	[0081.093] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0081.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0081.094] lstrlenW (lpString=".1cd") returned 4
	[0081.094] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0081.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0081.094] lstrlenW (lpString=".jpg") returned 4
	[0081.094] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0081.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0081.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0081.094] lstrlenW (lpString=".doc") returned 4
	[0081.094] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0081.094] lstrlenW (lpString=".docx") returned 5
	[0081.094] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0081.094] lstrlenW (lpString=".pdf") returned 4
	[0081.094] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0081.094] lstrlenW (lpString=".xls") returned 4
	[0081.094] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0081.094] lstrlenW (lpString=".xlsx") returned 5
	[0081.094] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0081.094] lstrlenW (lpString=".ppt") returned 4
	[0081.094] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0081.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0081.094] lstrlenW (lpString=".zip") returned 4
	[0081.094] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0081.094] lstrlenW (lpString=".rar") returned 4
	[0081.094] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0081.094] lstrlenW (lpString=".bz2") returned 4
	[0081.094] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0081.095] lstrlenW (lpString=".7z") returned 3
	[0081.095] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0081.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0081.095] lstrlenW (lpString=".dbf") returned 4
	[0081.095] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0081.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0081.095] lstrlenW (lpString=".1cd") returned 4
	[0081.095] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0081.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0081.095] lstrlenW (lpString=".jpg") returned 4
	[0081.095] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0081.095] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0081.095] lstrlenW (lpString="GrooveLR.cab") returned 12
	[0081.095] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0081.095] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=4095519) returned 1
	[0081.096] CloseHandle (hObject=0x1a8) returned 1
	[0081.096] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020
	[0081.096] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.096] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0081.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0081.097] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0081.097] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0081.097] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0081.100] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0081.100] ReadFile (in: hFile=0x1a8, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0081.221] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0081.221] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0081.221] ReadFile (in: hFile=0x1a8, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0081.237] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.237] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0081.261] SetEndOfFile (hFile=0x1a8) returned 1
	[0081.261] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f80080
	[0081.261] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.261] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f80080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f80080*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.263] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.263] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f80080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f80080*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.265] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.265] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f80080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f80080*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.341] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f80080 | out: hHeap=0x5e0000) returned 1
	[0081.343] CloseHandle (hObject=0x1a8) returned 1
	[0081.344] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0081.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0081.344] lstrlenW (lpString=".doc") returned 4
	[0081.344] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0081.344] lstrlenW (lpString=".docx") returned 5
	[0081.344] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0081.344] lstrlenW (lpString=".pdf") returned 4
	[0081.344] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0081.344] lstrlenW (lpString=".xls") returned 4
	[0081.344] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0081.344] lstrlenW (lpString=".xlsx") returned 5
	[0081.344] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0081.344] lstrlenW (lpString=".ppt") returned 4
	[0081.344] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0081.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0081.344] lstrlenW (lpString=".zip") returned 4
	[0081.345] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0081.345] lstrlenW (lpString=".rar") returned 4
	[0081.345] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0081.345] lstrlenW (lpString=".bz2") returned 4
	[0081.345] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0081.345] lstrlenW (lpString=".7z") returned 3
	[0081.345] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0081.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0081.345] lstrlenW (lpString=".dbf") returned 4
	[0081.345] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0081.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0081.345] lstrlenW (lpString=".1cd") returned 4
	[0081.345] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0081.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0081.345] lstrlenW (lpString=".jpg") returned 4
	[0081.345] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0081.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0081.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0081.345] lstrlenW (lpString=".doc") returned 4
	[0081.345] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0081.345] lstrlenW (lpString=".docx") returned 5
	[0081.345] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0081.345] lstrlenW (lpString=".pdf") returned 4
	[0081.345] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0081.345] lstrlenW (lpString=".xls") returned 4
	[0081.345] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0081.345] lstrlenW (lpString=".xlsx") returned 5
	[0081.345] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0081.345] lstrlenW (lpString=".ppt") returned 4
	[0081.345] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0081.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0081.346] lstrlenW (lpString=".zip") returned 4
	[0081.346] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0081.346] lstrlenW (lpString=".rar") returned 4
	[0081.346] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0081.346] lstrlenW (lpString=".bz2") returned 4
	[0081.346] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0081.346] lstrlenW (lpString=".7z") returned 3
	[0081.346] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0081.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0081.346] lstrlenW (lpString=".dbf") returned 4
	[0081.346] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0081.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0081.346] lstrlenW (lpString=".1cd") returned 4
	[0081.346] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0081.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0081.346] lstrlenW (lpString=".jpg") returned 4
	[0081.346] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0081.346] lstrcmpiW (lpString1=".EXE", lpString2=".adobe") returned 1
	[0081.346] lstrlenW (lpString="DW20.EXE") returned 8
	[0081.346] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0081.479] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=838536) returned 1
	[0081.479] CloseHandle (hObject=0x19c) returned 1
	[0081.480] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020
	[0081.495] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.496] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0081.587] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.588] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0081.727] GetLastError () returned 0x0
	[0081.727] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xccb88, lpOverlapped=0x0) returned 1
	[0081.781] WriteFile (in: hFile=0x1b4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xccb90, lpOverlapped=0x0) returned 1
	[0081.830] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.830] WriteFile (in: hFile=0x1b4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0081.830] SetEndOfFile (hFile=0x1b4) returned 1
	[0081.845] CloseHandle (hObject=0x1b4) returned 1
	[0081.849] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.849] SetEndOfFile (hFile=0x1a4) returned 1
	[0081.874] CloseHandle (hObject=0x1a4) returned 1
	[0081.881] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.886] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1
	[0081.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0081.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0081.888] lstrlenW (lpString=".doc") returned 4
	[0081.888] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0081.888] lstrlenW (lpString=".docx") returned 5
	[0081.888] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1
	[0081.888] lstrlenW (lpString=".pdf") returned 4
	[0081.888] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0081.888] lstrlenW (lpString=".xls") returned 4
	[0081.888] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0081.888] lstrlenW (lpString=".xlsx") returned 5
	[0081.888] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1
	[0081.888] lstrlenW (lpString=".ppt") returned 4
	[0081.888] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0081.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0081.889] lstrlenW (lpString=".zip") returned 4
	[0081.889] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0081.889] lstrlenW (lpString=".rar") returned 4
	[0081.889] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0081.889] lstrlenW (lpString=".bz2") returned 4
	[0081.889] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0081.889] lstrlenW (lpString=".7z") returned 3
	[0081.889] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0081.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0081.889] lstrlenW (lpString=".dbf") returned 4
	[0081.889] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0081.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0081.889] lstrlenW (lpString=".1cd") returned 4
	[0081.889] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0081.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0081.889] lstrlenW (lpString=".jpg") returned 4
	[0081.889] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0081.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0081.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0081.889] lstrlenW (lpString=".doc") returned 4
	[0081.889] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0081.889] lstrlenW (lpString=".docx") returned 5
	[0081.889] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1
	[0081.890] lstrlenW (lpString=".pdf") returned 4
	[0081.890] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0081.890] lstrlenW (lpString=".xls") returned 4
	[0081.890] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0081.890] lstrlenW (lpString=".xlsx") returned 5
	[0081.890] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1
	[0081.890] lstrlenW (lpString=".ppt") returned 4
	[0081.890] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0081.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0081.890] lstrlenW (lpString=".zip") returned 4
	[0081.890] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0081.890] lstrlenW (lpString=".rar") returned 4
	[0081.890] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0081.890] lstrlenW (lpString=".bz2") returned 4
	[0081.890] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0081.890] lstrlenW (lpString=".7z") returned 3
	[0081.890] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0081.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0081.890] lstrlenW (lpString=".dbf") returned 4
	[0081.890] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0081.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0081.890] lstrlenW (lpString=".1cd") returned 4
	[0081.890] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0081.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0081.890] lstrlenW (lpString=".jpg") returned 4
	[0081.890] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0081.891] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0081.891] lstrlenW (lpString="OfficeMUISet.msi") returned 16
	[0081.891] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.966] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=868864) returned 1
	[0081.966] CloseHandle (hObject=0x184) returned 1
	[0081.966] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020
	[0081.972] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.973] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.980] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.980] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.980] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0081.990] GetLastError () returned 0x0
	[0081.990] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xd4200, lpOverlapped=0x0) returned 1
	[0082.051] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xd4210, lpOverlapped=0x0) returned 1
	[0082.076] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0082.077] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0082.077] SetEndOfFile (hFile=0x1a8) returned 1
	[0082.086] CloseHandle (hObject=0x1a8) returned 1
	[0082.087] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.087] SetEndOfFile (hFile=0x198) returned 1
	[0082.099] CloseHandle (hObject=0x198) returned 1
	[0082.104] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0082.111] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1
	[0082.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0082.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0082.185] lstrlenW (lpString=".doc") returned 4
	[0082.185] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0082.185] lstrlenW (lpString=".docx") returned 5
	[0082.185] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1
	[0082.185] lstrlenW (lpString=".pdf") returned 4
	[0082.185] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0082.185] lstrlenW (lpString=".xls") returned 4
	[0082.185] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0082.185] lstrlenW (lpString=".xlsx") returned 5
	[0082.185] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1
	[0082.185] lstrlenW (lpString=".ppt") returned 4
	[0082.186] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0082.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0082.186] lstrlenW (lpString=".zip") returned 4
	[0082.186] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0082.186] lstrlenW (lpString=".rar") returned 4
	[0082.186] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0082.186] lstrlenW (lpString=".bz2") returned 4
	[0082.186] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0082.186] lstrlenW (lpString=".7z") returned 3
	[0082.186] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0082.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0082.186] lstrlenW (lpString=".dbf") returned 4
	[0082.186] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0082.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0082.186] lstrlenW (lpString=".1cd") returned 4
	[0082.186] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0082.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0082.186] lstrlenW (lpString=".jpg") returned 4
	[0082.186] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0082.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0082.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0082.186] lstrlenW (lpString=".doc") returned 4
	[0082.186] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0082.187] lstrlenW (lpString=".docx") returned 5
	[0082.187] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1
	[0082.187] lstrlenW (lpString=".pdf") returned 4
	[0082.187] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0082.187] lstrlenW (lpString=".xls") returned 4
	[0082.187] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0082.187] lstrlenW (lpString=".xlsx") returned 5
	[0082.187] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1
	[0082.187] lstrlenW (lpString=".ppt") returned 4
	[0082.187] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0082.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0082.187] lstrlenW (lpString=".zip") returned 4
	[0082.187] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0082.187] lstrlenW (lpString=".rar") returned 4
	[0082.187] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0082.187] lstrlenW (lpString=".bz2") returned 4
	[0082.187] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0082.187] lstrlenW (lpString=".7z") returned 3
	[0082.187] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0082.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0082.187] lstrlenW (lpString=".dbf") returned 4
	[0082.187] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0082.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0082.187] lstrlenW (lpString=".1cd") returned 4
	[0082.187] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0082.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0082.187] lstrlenW (lpString=".jpg") returned 4
	[0082.187] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0082.188] lstrcmpiW (lpString1=".MST", lpString2=".adobe") returned 1
	[0082.188] lstrlenW (lpString="ShellUI.MST") returned 11
	[0082.188] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0082.325] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=3584) returned 1
	[0082.325] CloseHandle (hObject=0x19c) returned 1
	[0082.325] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020
	[0082.607] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.607] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0082.719] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.719] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.719] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0082.739] GetLastError () returned 0x0
	[0082.739] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xe00, lpOverlapped=0x0) returned 1
	[0082.763] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe10, lpOverlapped=0x0) returned 1
	[0082.764] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0082.764] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0082.764] SetEndOfFile (hFile=0x1a4) returned 1
	[0082.765] CloseHandle (hObject=0x1a4) returned 1
	[0082.765] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.765] SetEndOfFile (hFile=0x19c) returned 1
	[0082.766] CloseHandle (hObject=0x19c) returned 1
	[0082.766] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0082.767] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1
	[0082.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0082.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0082.767] lstrlenW (lpString=".doc") returned 4
	[0082.767] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1
	[0082.767] lstrlenW (lpString=".docx") returned 5
	[0082.767] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1
	[0082.767] lstrlenW (lpString=".pdf") returned 4
	[0082.767] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1
	[0082.767] lstrlenW (lpString=".xls") returned 4
	[0082.767] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1
	[0082.767] lstrlenW (lpString=".xlsx") returned 5
	[0082.767] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1
	[0082.767] lstrlenW (lpString=".ppt") returned 4
	[0082.767] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1
	[0082.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0082.767] lstrlenW (lpString=".zip") returned 4
	[0082.767] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1
	[0082.768] lstrlenW (lpString=".rar") returned 4
	[0082.768] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1
	[0082.768] lstrlenW (lpString=".bz2") returned 4
	[0082.768] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1
	[0082.768] lstrlenW (lpString=".7z") returned 3
	[0082.768] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1
	[0082.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0082.768] lstrlenW (lpString=".dbf") returned 4
	[0082.768] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1
	[0082.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0082.768] lstrlenW (lpString=".1cd") returned 4
	[0082.768] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1
	[0082.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0082.768] lstrlenW (lpString=".jpg") returned 4
	[0082.768] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1
	[0082.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0082.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0082.768] lstrlenW (lpString=".doc") returned 4
	[0082.768] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1
	[0082.768] lstrlenW (lpString=".docx") returned 5
	[0082.768] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1
	[0082.768] lstrlenW (lpString=".pdf") returned 4
	[0082.768] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1
	[0082.768] lstrlenW (lpString=".xls") returned 4
	[0082.768] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1
	[0082.769] lstrlenW (lpString=".xlsx") returned 5
	[0082.769] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1
	[0082.769] lstrlenW (lpString=".ppt") returned 4
	[0082.769] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1
	[0082.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0082.769] lstrlenW (lpString=".zip") returned 4
	[0082.769] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1
	[0082.769] lstrlenW (lpString=".rar") returned 4
	[0082.769] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1
	[0082.769] lstrlenW (lpString=".bz2") returned 4
	[0082.769] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1
	[0082.769] lstrlenW (lpString=".7z") returned 3
	[0082.769] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1
	[0082.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0082.769] lstrlenW (lpString=".dbf") returned 4
	[0082.769] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1
	[0082.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0082.769] lstrlenW (lpString=".1cd") returned 4
	[0082.769] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1
	[0082.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0082.769] lstrlenW (lpString=".jpg") returned 4
	[0082.769] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1
	[0082.770] lstrcmpiW (lpString1=".xrm-ms", lpString2=".adobe") returned 1
	[0082.770] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24
	[0082.770] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0082.793] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=715834) returned 1
	[0082.807] CloseHandle (hObject=0x1b0) returned 1
	[0082.807] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020
	[0082.818] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.819] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0082.907] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.907] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.907] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0082.948] GetLastError () returned 0x0
	[0082.948] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xaec3a, lpOverlapped=0x0) returned 1
	[0082.969] WriteFile (in: hFile=0x1ac, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xaec40, lpOverlapped=0x0) returned 1
	[0082.988] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0082.988] WriteFile (in: hFile=0x1ac, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x104, lpOverlapped=0x0) returned 1
	[0082.989] SetEndOfFile (hFile=0x1ac) returned 1
	[0082.993] CloseHandle (hObject=0x1ac) returned 1
	[0082.995] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.995] SetEndOfFile (hFile=0x1a4) returned 1
	[0083.063] CloseHandle (hObject=0x1a4) returned 1
	[0083.139] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0083.140] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1
	[0083.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0083.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0083.163] lstrlenW (lpString=".doc") returned 4
	[0083.163] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0083.163] lstrlenW (lpString=".docx") returned 5
	[0083.163] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0083.163] lstrlenW (lpString=".pdf") returned 4
	[0083.163] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0083.163] lstrlenW (lpString=".xls") returned 4
	[0083.163] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0083.163] lstrlenW (lpString=".xlsx") returned 5
	[0083.163] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0083.163] lstrlenW (lpString=".ppt") returned 4
	[0083.163] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0083.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0083.163] lstrlenW (lpString=".zip") returned 4
	[0083.163] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0083.163] lstrlenW (lpString=".rar") returned 4
	[0083.163] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0083.163] lstrlenW (lpString=".bz2") returned 4
	[0083.163] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0083.163] lstrlenW (lpString=".7z") returned 3
	[0083.163] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0083.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0083.164] lstrlenW (lpString=".dbf") returned 4
	[0083.164] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0083.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0083.164] lstrlenW (lpString=".1cd") returned 4
	[0083.164] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0083.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0083.164] lstrlenW (lpString=".jpg") returned 4
	[0083.164] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0083.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0083.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0083.164] lstrlenW (lpString=".doc") returned 4
	[0083.164] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0083.164] lstrlenW (lpString=".docx") returned 5
	[0083.164] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0083.164] lstrlenW (lpString=".pdf") returned 4
	[0083.164] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0083.164] lstrlenW (lpString=".xls") returned 4
	[0083.164] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0083.164] lstrlenW (lpString=".xlsx") returned 5
	[0083.164] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0083.164] lstrlenW (lpString=".ppt") returned 4
	[0083.164] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0083.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0083.164] lstrlenW (lpString=".zip") returned 4
	[0083.164] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0083.164] lstrlenW (lpString=".rar") returned 4
	[0083.164] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0083.164] lstrlenW (lpString=".bz2") returned 4
	[0083.164] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0083.165] lstrlenW (lpString=".7z") returned 3
	[0083.165] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0083.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0083.165] lstrlenW (lpString=".dbf") returned 4
	[0083.165] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0083.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0083.165] lstrlenW (lpString=".1cd") returned 4
	[0083.165] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0083.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0083.165] lstrlenW (lpString=".jpg") returned 4
	[0083.165] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0083.165] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0083.165] lstrlenW (lpString="ProPlusrWW.msi") returned 14
	[0083.165] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0083.251] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=27532288) returned 1
	[0083.251] CloseHandle (hObject=0x1a4) returned 1
	[0083.251] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020
	[0083.269] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.269] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0083.301] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0083.342] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0083.342] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.342] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.390] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.390] ReadFile (in: hFile=0x1a4, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.422] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0083.422] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.422] ReadFile (in: hFile=0x1a4, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.445] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.445] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0083.472] SetEndOfFile (hFile=0x1a4) returned 1
	[0083.489] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0083.495] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.495] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.496] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.496] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.500] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.501] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.503] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0083.503] CloseHandle (hObject=0x1a4) returned 1
	[0083.511] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0083.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0083.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0083.549] lstrlenW (lpString=".doc") returned 4
	[0083.549] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0083.549] lstrlenW (lpString=".docx") returned 5
	[0083.549] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0083.549] lstrlenW (lpString=".pdf") returned 4
	[0083.549] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0083.549] lstrlenW (lpString=".xls") returned 4
	[0083.550] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0083.550] lstrlenW (lpString=".xlsx") returned 5
	[0083.550] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0083.550] lstrlenW (lpString=".ppt") returned 4
	[0083.550] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0083.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0083.550] lstrlenW (lpString=".zip") returned 4
	[0083.550] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0083.550] lstrlenW (lpString=".rar") returned 4
	[0083.550] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0083.550] lstrlenW (lpString=".bz2") returned 4
	[0083.550] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0083.550] lstrlenW (lpString=".7z") returned 3
	[0083.550] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0083.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0083.550] lstrlenW (lpString=".dbf") returned 4
	[0083.550] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0083.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0083.550] lstrlenW (lpString=".1cd") returned 4
	[0083.550] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0083.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0083.550] lstrlenW (lpString=".jpg") returned 4
	[0083.550] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0083.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0083.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0083.550] lstrlenW (lpString=".doc") returned 4
	[0083.550] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0083.550] lstrlenW (lpString=".docx") returned 5
	[0083.551] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0083.551] lstrlenW (lpString=".pdf") returned 4
	[0083.551] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0083.551] lstrlenW (lpString=".xls") returned 4
	[0083.551] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0083.551] lstrlenW (lpString=".xlsx") returned 5
	[0083.551] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0083.551] lstrlenW (lpString=".ppt") returned 4
	[0083.551] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0083.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0083.551] lstrlenW (lpString=".zip") returned 4
	[0083.551] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0083.551] lstrlenW (lpString=".rar") returned 4
	[0083.551] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0083.551] lstrlenW (lpString=".bz2") returned 4
	[0083.551] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0083.551] lstrlenW (lpString=".7z") returned 3
	[0083.551] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0083.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0083.551] lstrlenW (lpString=".dbf") returned 4
	[0083.551] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0083.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0083.551] lstrlenW (lpString=".1cd") returned 4
	[0083.551] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0083.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0083.551] lstrlenW (lpString=".jpg") returned 4
	[0083.551] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0083.551] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0083.552] lstrlenW (lpString="Office32WW.msi") returned 14
	[0083.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.553] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1992192) returned 1
	[0083.553] CloseHandle (hObject=0x1a8) returned 1
	[0083.553] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020
	[0083.553] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.553] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0083.554] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.554] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0083.554] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.554] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.558] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.558] ReadFile (in: hFile=0x1a8, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.573] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0083.573] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.573] ReadFile (in: hFile=0x1a8, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.591] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.591] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0083.637] SetEndOfFile (hFile=0x1a8) returned 1
	[0083.637] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0083.642] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.642] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.643] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.643] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.646] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.646] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.648] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0083.648] CloseHandle (hObject=0x1a8) returned 1
	[0083.648] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0083.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0083.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0083.648] lstrlenW (lpString=".doc") returned 4
	[0083.649] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0083.649] lstrlenW (lpString=".docx") returned 5
	[0083.649] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0083.649] lstrlenW (lpString=".pdf") returned 4
	[0083.649] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0083.649] lstrlenW (lpString=".xls") returned 4
	[0083.649] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0083.649] lstrlenW (lpString=".xlsx") returned 5
	[0083.649] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0083.649] lstrlenW (lpString=".ppt") returned 4
	[0083.649] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0083.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0083.649] lstrlenW (lpString=".zip") returned 4
	[0083.649] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0083.649] lstrlenW (lpString=".rar") returned 4
	[0083.649] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0083.649] lstrlenW (lpString=".bz2") returned 4
	[0083.649] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0083.649] lstrlenW (lpString=".7z") returned 3
	[0083.649] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0083.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0083.649] lstrlenW (lpString=".dbf") returned 4
	[0083.649] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0083.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0083.649] lstrlenW (lpString=".1cd") returned 4
	[0083.649] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0083.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0083.649] lstrlenW (lpString=".jpg") returned 4
	[0083.649] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0083.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0083.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0083.649] lstrlenW (lpString=".doc") returned 4
	[0083.650] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0083.650] lstrlenW (lpString=".docx") returned 5
	[0083.650] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0083.650] lstrlenW (lpString=".pdf") returned 4
	[0083.650] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0083.650] lstrlenW (lpString=".xls") returned 4
	[0083.650] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0083.650] lstrlenW (lpString=".xlsx") returned 5
	[0083.650] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0083.650] lstrlenW (lpString=".ppt") returned 4
	[0083.650] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0083.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0083.650] lstrlenW (lpString=".zip") returned 4
	[0083.650] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0083.650] lstrlenW (lpString=".rar") returned 4
	[0083.650] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0083.650] lstrlenW (lpString=".bz2") returned 4
	[0083.650] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0083.650] lstrlenW (lpString=".7z") returned 3
	[0083.650] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0083.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0083.650] lstrlenW (lpString=".dbf") returned 4
	[0083.650] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0083.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0083.650] lstrlenW (lpString=".1cd") returned 4
	[0083.650] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0083.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0083.650] lstrlenW (lpString=".jpg") returned 4
	[0083.650] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0083.651] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0083.651] lstrlenW (lpString="ose.exe") returned 7
	[0083.651] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.651] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=174440) returned 1
	[0083.651] CloseHandle (hObject=0x1a8) returned 1
	[0083.651] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020
	[0083.651] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.652] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.652] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.652] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.652] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0083.652] GetLastError () returned 0x0
	[0083.652] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x2a968, lpOverlapped=0x0) returned 1
	[0083.659] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2a970, lpOverlapped=0x0) returned 1
	[0083.663] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0083.663] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0083.663] SetEndOfFile (hFile=0x1b0) returned 1
	[0083.663] CloseHandle (hObject=0x1b0) returned 1
	[0083.663] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.663] SetEndOfFile (hFile=0x1a8) returned 1
	[0083.665] CloseHandle (hObject=0x1a8) returned 1
	[0083.665] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0083.665] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1
	[0083.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0083.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0083.666] lstrlenW (lpString=".doc") returned 4
	[0083.666] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.666] lstrlenW (lpString=".docx") returned 5
	[0083.666] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0083.666] lstrlenW (lpString=".pdf") returned 4
	[0083.666] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.666] lstrlenW (lpString=".xls") returned 4
	[0083.666] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.666] lstrlenW (lpString=".xlsx") returned 5
	[0083.666] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0083.666] lstrlenW (lpString=".ppt") returned 4
	[0083.666] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0083.666] lstrlenW (lpString=".zip") returned 4
	[0083.666] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.666] lstrlenW (lpString=".rar") returned 4
	[0083.666] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.666] lstrlenW (lpString=".bz2") returned 4
	[0083.666] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.666] lstrlenW (lpString=".7z") returned 3
	[0083.666] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0083.666] lstrlenW (lpString=".dbf") returned 4
	[0083.666] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0083.666] lstrlenW (lpString=".1cd") returned 4
	[0083.666] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0083.666] lstrlenW (lpString=".jpg") returned 4
	[0083.666] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0083.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0083.667] lstrlenW (lpString=".doc") returned 4
	[0083.667] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.667] lstrlenW (lpString=".docx") returned 5
	[0083.667] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0083.667] lstrlenW (lpString=".pdf") returned 4
	[0083.667] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.667] lstrlenW (lpString=".xls") returned 4
	[0083.667] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.667] lstrlenW (lpString=".xlsx") returned 5
	[0083.667] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0083.667] lstrlenW (lpString=".ppt") returned 4
	[0083.667] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0083.668] lstrlenW (lpString=".zip") returned 4
	[0083.668] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.668] lstrlenW (lpString=".rar") returned 4
	[0083.715] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.715] lstrlenW (lpString=".bz2") returned 4
	[0083.715] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.715] lstrlenW (lpString=".7z") returned 3
	[0083.715] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0083.715] lstrlenW (lpString=".dbf") returned 4
	[0083.715] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0083.715] lstrlenW (lpString=".1cd") returned 4
	[0083.715] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0083.715] lstrlenW (lpString=".jpg") returned 4
	[0083.715] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.715] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0083.716] lstrlenW (lpString="OWOW32WW.cab") returned 12
	[0083.716] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.851] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=36233052) returned 1
	[0083.851] CloseHandle (hObject=0x1a8) returned 1
	[0083.852] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020
	[0083.889] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.891] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0084.065] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0084.075] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0084.075] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.075] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.079] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.079] ReadFile (in: hFile=0x1a4, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.085] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0084.085] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.085] ReadFile (in: hFile=0x1a4, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.108] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.108] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0084.131] SetEndOfFile (hFile=0x1a4) returned 1
	[0084.188] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0084.193] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0084.193] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0084.195] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0084.195] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0084.196] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0084.196] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0084.199] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0084.199] CloseHandle (hObject=0x1a4) returned 1
	[0084.204] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0084.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0084.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0084.216] lstrlenW (lpString=".doc") returned 4
	[0084.216] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0084.216] lstrlenW (lpString=".docx") returned 5
	[0084.216] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0084.216] lstrlenW (lpString=".pdf") returned 4
	[0084.216] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0084.216] lstrlenW (lpString=".xls") returned 4
	[0084.216] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0084.216] lstrlenW (lpString=".xlsx") returned 5
	[0084.216] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0084.216] lstrlenW (lpString=".ppt") returned 4
	[0084.216] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0084.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0084.216] lstrlenW (lpString=".zip") returned 4
	[0084.216] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0084.216] lstrlenW (lpString=".rar") returned 4
	[0084.216] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0084.216] lstrlenW (lpString=".bz2") returned 4
	[0084.216] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0084.216] lstrlenW (lpString=".7z") returned 3
	[0084.216] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0084.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0084.217] lstrlenW (lpString=".dbf") returned 4
	[0084.217] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0084.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0084.217] lstrlenW (lpString=".1cd") returned 4
	[0084.217] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0084.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0084.217] lstrlenW (lpString=".jpg") returned 4
	[0084.217] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0084.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0084.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0084.217] lstrlenW (lpString=".doc") returned 4
	[0084.217] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0084.217] lstrlenW (lpString=".docx") returned 5
	[0084.217] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0084.217] lstrlenW (lpString=".pdf") returned 4
	[0084.217] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0084.217] lstrlenW (lpString=".xls") returned 4
	[0084.217] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0084.217] lstrlenW (lpString=".xlsx") returned 5
	[0084.217] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0084.217] lstrlenW (lpString=".ppt") returned 4
	[0084.217] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0084.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0084.217] lstrlenW (lpString=".zip") returned 4
	[0084.217] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0084.218] lstrlenW (lpString=".rar") returned 4
	[0084.218] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0084.218] lstrlenW (lpString=".bz2") returned 4
	[0084.218] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0084.218] lstrlenW (lpString=".7z") returned 3
	[0084.218] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0084.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0084.218] lstrlenW (lpString=".dbf") returned 4
	[0084.218] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0084.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0084.218] lstrlenW (lpString=".1cd") returned 4
	[0084.218] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0084.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0084.218] lstrlenW (lpString=".jpg") returned 4
	[0084.218] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0084.218] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0084.218] lstrlenW (lpString="Office32WW.msi") returned 14
	[0084.218] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0084.220] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1992192) returned 1
	[0084.220] CloseHandle (hObject=0x1a4) returned 1
	[0084.220] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020
	[0084.220] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.220] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0084.221] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0084.221] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0084.221] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.221] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.226] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.226] ReadFile (in: hFile=0x1a4, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.230] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0084.230] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.230] ReadFile (in: hFile=0x1a4, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.251] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.251] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0084.289] SetEndOfFile (hFile=0x1a4) returned 1
	[0084.289] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0084.295] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0084.295] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0084.297] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0084.297] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0084.300] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0084.300] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0084.303] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0084.303] CloseHandle (hObject=0x1a4) returned 1
	[0084.303] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0084.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0084.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0084.303] lstrlenW (lpString=".doc") returned 4
	[0084.303] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0084.303] lstrlenW (lpString=".docx") returned 5
	[0084.303] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0084.303] lstrlenW (lpString=".pdf") returned 4
	[0084.303] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0084.304] lstrlenW (lpString=".xls") returned 4
	[0084.304] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0084.304] lstrlenW (lpString=".xlsx") returned 5
	[0084.304] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0084.304] lstrlenW (lpString=".ppt") returned 4
	[0084.304] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0084.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0084.304] lstrlenW (lpString=".zip") returned 4
	[0084.304] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0084.304] lstrlenW (lpString=".rar") returned 4
	[0084.304] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0084.304] lstrlenW (lpString=".bz2") returned 4
	[0084.304] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0084.304] lstrlenW (lpString=".7z") returned 3
	[0084.304] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0084.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0084.304] lstrlenW (lpString=".dbf") returned 4
	[0084.304] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0084.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0084.304] lstrlenW (lpString=".1cd") returned 4
	[0084.304] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0084.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0084.305] lstrlenW (lpString=".jpg") returned 4
	[0084.305] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0084.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0084.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0084.305] lstrlenW (lpString=".doc") returned 4
	[0084.305] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0084.305] lstrlenW (lpString=".docx") returned 5
	[0084.305] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0084.305] lstrlenW (lpString=".pdf") returned 4
	[0084.305] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0084.305] lstrlenW (lpString=".xls") returned 4
	[0084.305] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0084.305] lstrlenW (lpString=".xlsx") returned 5
	[0084.305] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0084.305] lstrlenW (lpString=".ppt") returned 4
	[0084.305] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0084.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0084.306] lstrlenW (lpString=".zip") returned 4
	[0084.306] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0084.306] lstrlenW (lpString=".rar") returned 4
	[0084.306] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0084.306] lstrlenW (lpString=".bz2") returned 4
	[0084.306] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0084.306] lstrlenW (lpString=".7z") returned 3
	[0084.306] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0084.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0084.306] lstrlenW (lpString=".dbf") returned 4
	[0084.306] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0084.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0084.306] lstrlenW (lpString=".1cd") returned 4
	[0084.306] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0084.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0084.306] lstrlenW (lpString=".jpg") returned 4
	[0084.306] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0084.307] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0084.307] lstrlenW (lpString="ose.exe") returned 7
	[0084.307] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0084.323] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=174440) returned 1
	[0084.323] CloseHandle (hObject=0x1a4) returned 1
	[0084.323] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020
	[0084.335] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.335] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.447] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.447] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.597] GetLastError () returned 0x0
	[0084.597] ReadFile (in: hFile=0x1ac, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x2a968, lpOverlapped=0x0) returned 1
	[0084.603] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2a970, lpOverlapped=0x0) returned 1
	[0084.608] ReadFile (in: hFile=0x1ac, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.608] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0084.608] SetEndOfFile (hFile=0x1b0) returned 1
	[0084.611] CloseHandle (hObject=0x1b0) returned 1
	[0084.612] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.612] SetEndOfFile (hFile=0x1ac) returned 1
	[0084.634] CloseHandle (hObject=0x1ac) returned 1
	[0084.639] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0084.683] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1
	[0084.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0084.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0084.745] lstrlenW (lpString=".doc") returned 4
	[0084.745] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0084.745] lstrlenW (lpString=".docx") returned 5
	[0084.745] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0084.745] lstrlenW (lpString=".pdf") returned 4
	[0084.745] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0084.745] lstrlenW (lpString=".xls") returned 4
	[0084.745] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0084.745] lstrlenW (lpString=".xlsx") returned 5
	[0084.745] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0084.745] lstrlenW (lpString=".ppt") returned 4
	[0084.745] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0084.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0084.745] lstrlenW (lpString=".zip") returned 4
	[0084.745] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0084.745] lstrlenW (lpString=".rar") returned 4
	[0084.745] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0084.745] lstrlenW (lpString=".bz2") returned 4
	[0084.745] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0084.745] lstrlenW (lpString=".7z") returned 3
	[0084.745] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0084.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0084.745] lstrlenW (lpString=".dbf") returned 4
	[0084.745] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0084.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0084.745] lstrlenW (lpString=".1cd") returned 4
	[0084.746] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0084.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0084.746] lstrlenW (lpString=".jpg") returned 4
	[0084.746] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0084.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0084.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0084.746] lstrlenW (lpString=".doc") returned 4
	[0084.746] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0084.746] lstrlenW (lpString=".docx") returned 5
	[0084.746] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0084.746] lstrlenW (lpString=".pdf") returned 4
	[0084.746] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0084.746] lstrlenW (lpString=".xls") returned 4
	[0084.746] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0084.746] lstrlenW (lpString=".xlsx") returned 5
	[0084.746] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0084.746] lstrlenW (lpString=".ppt") returned 4
	[0084.746] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0084.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0084.746] lstrlenW (lpString=".zip") returned 4
	[0084.746] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0084.746] lstrlenW (lpString=".rar") returned 4
	[0084.746] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0084.746] lstrlenW (lpString=".bz2") returned 4
	[0084.746] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0084.747] lstrlenW (lpString=".7z") returned 3
	[0084.747] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0084.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0084.747] lstrlenW (lpString=".dbf") returned 4
	[0084.747] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0084.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0084.747] lstrlenW (lpString=".1cd") returned 4
	[0084.747] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0084.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0084.747] lstrlenW (lpString=".jpg") returned 4
	[0084.747] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0084.747] lstrcmpiW (lpString1=".xrm-ms", lpString2=".adobe") returned 1
	[0084.747] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24
	[0084.747] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.965] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=715834) returned 1
	[0084.965] CloseHandle (hObject=0x1ac) returned 1
	[0084.965] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020
	[0085.072] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.090] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0085.177] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.177] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0085.385] GetLastError () returned 0x0
	[0085.385] ReadFile (in: hFile=0x160, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xaec3a, lpOverlapped=0x0) returned 1
	[0085.408] WriteFile (in: hFile=0x1ac, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xaec40, lpOverlapped=0x0) returned 1
	[0085.424] ReadFile (in: hFile=0x160, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.424] WriteFile (in: hFile=0x1ac, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x104, lpOverlapped=0x0) returned 1
	[0085.424] SetEndOfFile (hFile=0x1ac) returned 1
	[0085.492] CloseHandle (hObject=0x1ac) returned 1
	[0085.493] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.493] SetEndOfFile (hFile=0x160) returned 1
	[0085.568] CloseHandle (hObject=0x160) returned 1
	[0085.586] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0085.588] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1
	[0085.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0085.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0085.606] lstrlenW (lpString=".doc") returned 4
	[0085.606] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0085.606] lstrlenW (lpString=".docx") returned 5
	[0085.606] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0085.606] lstrlenW (lpString=".pdf") returned 4
	[0085.606] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0085.606] lstrlenW (lpString=".xls") returned 4
	[0085.606] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0085.606] lstrlenW (lpString=".xlsx") returned 5
	[0085.606] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0085.606] lstrlenW (lpString=".ppt") returned 4
	[0085.606] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0085.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0085.606] lstrlenW (lpString=".zip") returned 4
	[0085.606] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0085.606] lstrlenW (lpString=".rar") returned 4
	[0085.606] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0085.606] lstrlenW (lpString=".bz2") returned 4
	[0085.606] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0085.606] lstrlenW (lpString=".7z") returned 3
	[0085.606] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0085.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0085.606] lstrlenW (lpString=".dbf") returned 4
	[0085.606] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0085.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0085.607] lstrlenW (lpString=".1cd") returned 4
	[0085.607] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0085.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0085.607] lstrlenW (lpString=".jpg") returned 4
	[0085.607] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0085.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0085.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0085.607] lstrlenW (lpString=".doc") returned 4
	[0085.607] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0085.607] lstrlenW (lpString=".docx") returned 5
	[0085.607] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0085.607] lstrlenW (lpString=".pdf") returned 4
	[0085.607] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0085.607] lstrlenW (lpString=".xls") returned 4
	[0085.607] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0085.607] lstrlenW (lpString=".xlsx") returned 5
	[0085.607] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0085.607] lstrlenW (lpString=".ppt") returned 4
	[0085.607] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0085.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0085.607] lstrlenW (lpString=".zip") returned 4
	[0085.607] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0085.607] lstrlenW (lpString=".rar") returned 4
	[0085.607] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0085.607] lstrlenW (lpString=".bz2") returned 4
	[0085.608] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0085.608] lstrlenW (lpString=".7z") returned 3
	[0085.608] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0085.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0085.608] lstrlenW (lpString=".dbf") returned 4
	[0085.608] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0085.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0085.608] lstrlenW (lpString=".1cd") returned 4
	[0085.608] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0085.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0085.608] lstrlenW (lpString=".jpg") returned 4
	[0085.608] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0085.608] lstrcmpiW (lpString1=".sys", lpString2=".adobe") returned 1
	[0085.608] lstrlenW (lpString="pagefile.sys") returned 12
	[0085.608] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0085.608] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0085.609] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0085.609] lstrlenW (lpString=".doc") returned 4
	[0085.609] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0085.609] lstrlenW (lpString=".docx") returned 5
	[0085.609] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1
	[0085.609] lstrlenW (lpString=".pdf") returned 4
	[0085.609] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0085.609] lstrlenW (lpString=".xls") returned 4
	[0085.609] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0085.609] lstrlenW (lpString=".xlsx") returned 5
	[0085.609] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1
	[0085.609] lstrlenW (lpString=".ppt") returned 4
	[0085.609] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0085.609] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0085.609] lstrlenW (lpString=".zip") returned 4
	[0085.609] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0085.609] lstrlenW (lpString=".rar") returned 4
	[0085.609] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0085.609] lstrlenW (lpString=".bz2") returned 4
	[0085.609] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0085.609] lstrlenW (lpString=".7z") returned 3
	[0085.609] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0085.609] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0085.609] lstrlenW (lpString=".dbf") returned 4
	[0085.609] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0085.609] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0085.610] lstrlenW (lpString=".1cd") returned 4
	[0085.610] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0085.610] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0085.610] lstrlenW (lpString=".jpg") returned 4
	[0085.610] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0085.610] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0085.610] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0085.610] lstrlenW (lpString=".doc") returned 4
	[0085.610] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0085.610] lstrlenW (lpString=".docx") returned 5
	[0085.610] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1
	[0085.610] lstrlenW (lpString=".pdf") returned 4
	[0085.610] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0085.610] lstrlenW (lpString=".xls") returned 4
	[0085.610] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0085.610] lstrlenW (lpString=".xlsx") returned 5
	[0085.610] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1
	[0085.610] lstrlenW (lpString=".ppt") returned 4
	[0085.610] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0085.610] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0085.610] lstrlenW (lpString=".zip") returned 4
	[0085.610] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0085.610] lstrlenW (lpString=".rar") returned 4
	[0085.610] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0085.610] lstrlenW (lpString=".bz2") returned 4
	[0085.611] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0085.611] lstrlenW (lpString=".7z") returned 3
	[0085.611] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0085.611] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0085.611] lstrlenW (lpString=".dbf") returned 4
	[0085.611] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0085.611] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0085.611] lstrlenW (lpString=".1cd") returned 4
	[0085.611] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0085.611] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0085.611] lstrlenW (lpString=".jpg") returned 4
	[0085.611] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0085.611] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0085.611] lstrlenW (lpString="MSADDNDR.DLL") returned 12
	[0085.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.613] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=99136) returned 1
	[0085.613] CloseHandle (hObject=0x198) returned 1
	[0085.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20
	[0085.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.614] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.614] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0085.615] GetLastError () returned 0x0
	[0085.615] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x18340, lpOverlapped=0x0) returned 1
	[0085.623] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x18350, lpOverlapped=0x0) returned 1
	[0085.626] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.626] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0085.627] SetEndOfFile (hFile=0x19c) returned 1
	[0085.627] CloseHandle (hObject=0x19c) returned 1
	[0085.627] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.627] SetEndOfFile (hFile=0x198) returned 1
	[0085.629] CloseHandle (hObject=0x198) returned 1
	[0085.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.629] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1
	[0085.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0085.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0085.630] lstrlenW (lpString=".doc") returned 4
	[0085.630] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0085.630] lstrlenW (lpString=".docx") returned 5
	[0085.630] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0085.630] lstrlenW (lpString=".pdf") returned 4
	[0085.630] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0085.630] lstrlenW (lpString=".xls") returned 4
	[0085.630] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0085.630] lstrlenW (lpString=".xlsx") returned 5
	[0085.630] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0085.630] lstrlenW (lpString=".ppt") returned 4
	[0085.630] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0085.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0085.630] lstrlenW (lpString=".zip") returned 4
	[0085.630] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0085.630] lstrlenW (lpString=".rar") returned 4
	[0085.630] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0085.630] lstrlenW (lpString=".bz2") returned 4
	[0085.630] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0085.630] lstrlenW (lpString=".7z") returned 3
	[0085.631] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0085.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0085.631] lstrlenW (lpString=".dbf") returned 4
	[0085.631] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0085.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0085.631] lstrlenW (lpString=".1cd") returned 4
	[0085.631] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0085.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0085.631] lstrlenW (lpString=".jpg") returned 4
	[0085.631] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0085.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0085.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0085.631] lstrlenW (lpString=".doc") returned 4
	[0085.631] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0085.632] lstrlenW (lpString=".docx") returned 5
	[0085.632] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0085.632] lstrlenW (lpString=".pdf") returned 4
	[0085.632] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0085.632] lstrlenW (lpString=".xls") returned 4
	[0085.632] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0085.632] lstrlenW (lpString=".xlsx") returned 5
	[0085.632] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0085.632] lstrlenW (lpString=".ppt") returned 4
	[0085.632] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0085.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0085.632] lstrlenW (lpString=".zip") returned 4
	[0085.632] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0085.632] lstrlenW (lpString=".rar") returned 4
	[0085.632] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0085.632] lstrlenW (lpString=".bz2") returned 4
	[0085.632] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0085.632] lstrlenW (lpString=".7z") returned 3
	[0085.632] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0085.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0085.632] lstrlenW (lpString=".dbf") returned 4
	[0085.632] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0085.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0085.632] lstrlenW (lpString=".1cd") returned 4
	[0085.632] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0085.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0085.632] lstrlenW (lpString=".jpg") returned 4
	[0085.633] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0085.633] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0085.633] lstrlenW (lpString="marvel steps judgment.exe") returned 25
	[0085.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\marvel steps judgment.exe" (normalized: "c:\\program files\\common files\\marvel steps judgment.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.633] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=78336) returned 1
	[0085.633] CloseHandle (hObject=0x198) returned 1
	[0085.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\marvel steps judgment.exe" (normalized: "c:\\program files\\common files\\marvel steps judgment.exe")) returned 0x20
	[0085.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\marvel steps judgment.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\marvel steps judgment.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\marvel steps judgment.exe" (normalized: "c:\\program files\\common files\\marvel steps judgment.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0085.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\marvel steps judgment.exe") returned 55
	[0085.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\marvel steps judgment.exe") returned 55
	[0085.634] lstrlenW (lpString=".doc") returned 4
	[0085.634] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0085.634] lstrlenW (lpString=".docx") returned 5
	[0085.634] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0085.634] lstrlenW (lpString=".pdf") returned 4
	[0085.634] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0085.634] lstrlenW (lpString=".xls") returned 4
	[0085.634] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0085.634] lstrlenW (lpString=".xlsx") returned 5
	[0085.634] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0085.635] lstrlenW (lpString=".ppt") returned 4
	[0085.635] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0085.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\marvel steps judgment.exe") returned 55
	[0085.635] lstrlenW (lpString=".zip") returned 4
	[0085.635] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0085.635] lstrlenW (lpString=".rar") returned 4
	[0085.635] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0085.635] lstrlenW (lpString=".bz2") returned 4
	[0085.635] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0085.635] lstrlenW (lpString=".7z") returned 3
	[0085.635] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0085.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\marvel steps judgment.exe") returned 55
	[0085.635] lstrlenW (lpString=".dbf") returned 4
	[0085.635] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0085.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\marvel steps judgment.exe") returned 55
	[0085.635] lstrlenW (lpString=".1cd") returned 4
	[0085.635] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0085.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\marvel steps judgment.exe") returned 55
	[0085.635] lstrlenW (lpString=".jpg") returned 4
	[0085.635] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0085.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\marvel steps judgment.exe") returned 55
	[0085.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\marvel steps judgment.exe") returned 55
	[0085.635] lstrlenW (lpString=".doc") returned 4
	[0085.635] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0085.635] lstrlenW (lpString=".docx") returned 5
	[0085.635] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0085.636] lstrlenW (lpString=".pdf") returned 4
	[0085.636] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0085.636] lstrlenW (lpString=".xls") returned 4
	[0085.636] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0085.636] lstrlenW (lpString=".xlsx") returned 5
	[0085.636] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0085.636] lstrlenW (lpString=".ppt") returned 4
	[0085.636] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0085.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\marvel steps judgment.exe") returned 55
	[0085.636] lstrlenW (lpString=".zip") returned 4
	[0085.636] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0085.636] lstrlenW (lpString=".rar") returned 4
	[0085.636] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0085.636] lstrlenW (lpString=".bz2") returned 4
	[0085.636] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0085.636] lstrlenW (lpString=".7z") returned 3
	[0085.636] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0085.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\marvel steps judgment.exe") returned 55
	[0085.636] lstrlenW (lpString=".dbf") returned 4
	[0085.636] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0085.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\marvel steps judgment.exe") returned 55
	[0085.636] lstrlenW (lpString=".1cd") returned 4
	[0085.636] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0085.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\marvel steps judgment.exe") returned 55
	[0085.636] lstrlenW (lpString=".jpg") returned 4
	[0085.636] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0085.637] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0085.637] lstrlenW (lpString="DBGHELP.DLL") returned 11
	[0085.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.654] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1369952) returned 1
	[0085.654] CloseHandle (hObject=0x198) returned 1
	[0085.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20
	[0085.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.655] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.655] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0085.656] GetLastError () returned 0x0
	[0085.656] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0085.687] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0085.717] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x4e770, lpOverlapped=0x0) returned 1
	[0085.738] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x4e780, lpOverlapped=0x0) returned 1
	[0085.753] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.753] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0085.754] SetEndOfFile (hFile=0x19c) returned 1
	[0085.754] CloseHandle (hObject=0x19c) returned 1
	[0085.754] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.754] SetEndOfFile (hFile=0x198) returned 1
	[0085.759] CloseHandle (hObject=0x198) returned 1
	[0085.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.759] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1
	[0085.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0085.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0085.760] lstrlenW (lpString=".doc") returned 4
	[0085.760] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0085.760] lstrlenW (lpString=".docx") returned 5
	[0085.760] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1
	[0085.760] lstrlenW (lpString=".pdf") returned 4
	[0085.760] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0085.760] lstrlenW (lpString=".xls") returned 4
	[0085.760] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0085.760] lstrlenW (lpString=".xlsx") returned 5
	[0085.760] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1
	[0085.760] lstrlenW (lpString=".ppt") returned 4
	[0085.760] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0085.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0085.760] lstrlenW (lpString=".zip") returned 4
	[0085.760] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0085.760] lstrlenW (lpString=".rar") returned 4
	[0085.760] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0085.760] lstrlenW (lpString=".bz2") returned 4
	[0085.760] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0085.760] lstrlenW (lpString=".7z") returned 3
	[0085.760] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0085.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0085.760] lstrlenW (lpString=".dbf") returned 4
	[0085.760] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0085.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0085.760] lstrlenW (lpString=".1cd") returned 4
	[0085.760] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0085.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0085.760] lstrlenW (lpString=".jpg") returned 4
	[0085.760] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0085.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0085.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0085.761] lstrlenW (lpString=".doc") returned 4
	[0085.761] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0085.761] lstrlenW (lpString=".docx") returned 5
	[0085.761] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1
	[0085.761] lstrlenW (lpString=".pdf") returned 4
	[0085.761] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0085.761] lstrlenW (lpString=".xls") returned 4
	[0085.761] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0085.761] lstrlenW (lpString=".xlsx") returned 5
	[0085.761] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1
	[0085.761] lstrlenW (lpString=".ppt") returned 4
	[0085.761] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0085.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0085.761] lstrlenW (lpString=".zip") returned 4
	[0085.761] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0085.761] lstrlenW (lpString=".rar") returned 4
	[0085.761] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0085.761] lstrlenW (lpString=".bz2") returned 4
	[0085.761] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0085.761] lstrlenW (lpString=".7z") returned 3
	[0085.761] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0085.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0085.761] lstrlenW (lpString=".dbf") returned 4
	[0085.761] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0085.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0085.761] lstrlenW (lpString=".1cd") returned 4
	[0085.761] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0085.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0085.761] lstrlenW (lpString=".jpg") returned 4
	[0085.762] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0085.762] lstrcmpiW (lpString1=".EXE", lpString2=".adobe") returned 1
	[0085.762] lstrlenW (lpString="DW20.EXE") returned 8
	[0085.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0085.766] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=994184) returned 1
	[0085.766] CloseHandle (hObject=0x19c) returned 1
	[0085.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20
	[0085.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0085.767] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.767] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0085.770] GetLastError () returned 0x0
	[0085.770] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xf2b88, lpOverlapped=0x0) returned 1
	[0085.789] WriteFile (in: hFile=0x194, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xf2b90, lpOverlapped=0x0) returned 1
	[0085.810] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.810] WriteFile (in: hFile=0x194, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0085.810] SetEndOfFile (hFile=0x194) returned 1
	[0085.810] CloseHandle (hObject=0x194) returned 1
	[0085.811] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.811] SetEndOfFile (hFile=0x19c) returned 1
	[0085.830] CloseHandle (hObject=0x19c) returned 1
	[0085.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.833] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1
	[0085.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0085.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0085.833] lstrlenW (lpString=".doc") returned 4
	[0085.833] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0085.833] lstrlenW (lpString=".docx") returned 5
	[0085.833] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1
	[0085.833] lstrlenW (lpString=".pdf") returned 4
	[0085.833] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0085.833] lstrlenW (lpString=".xls") returned 4
	[0085.833] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0085.833] lstrlenW (lpString=".xlsx") returned 5
	[0085.833] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1
	[0085.833] lstrlenW (lpString=".ppt") returned 4
	[0085.833] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0085.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0085.834] lstrlenW (lpString=".zip") returned 4
	[0085.834] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0085.834] lstrlenW (lpString=".rar") returned 4
	[0085.834] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0085.834] lstrlenW (lpString=".bz2") returned 4
	[0085.834] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0085.834] lstrlenW (lpString=".7z") returned 3
	[0085.834] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0085.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0085.834] lstrlenW (lpString=".dbf") returned 4
	[0085.834] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0085.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0085.834] lstrlenW (lpString=".1cd") returned 4
	[0085.834] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0085.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0085.834] lstrlenW (lpString=".jpg") returned 4
	[0085.834] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0085.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0085.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0085.834] lstrlenW (lpString=".doc") returned 4
	[0085.834] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0085.834] lstrlenW (lpString=".docx") returned 5
	[0085.834] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1
	[0085.834] lstrlenW (lpString=".pdf") returned 4
	[0085.834] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0085.834] lstrlenW (lpString=".xls") returned 4
	[0085.834] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0085.834] lstrlenW (lpString=".xlsx") returned 5
	[0085.834] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1
	[0085.834] lstrlenW (lpString=".ppt") returned 4
	[0085.834] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0085.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0085.835] lstrlenW (lpString=".zip") returned 4
	[0085.835] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0085.835] lstrlenW (lpString=".rar") returned 4
	[0085.835] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0085.835] lstrlenW (lpString=".bz2") returned 4
	[0085.835] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0085.835] lstrlenW (lpString=".7z") returned 3
	[0085.835] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0085.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0085.835] lstrlenW (lpString=".dbf") returned 4
	[0085.835] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0085.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0085.835] lstrlenW (lpString=".1cd") returned 4
	[0085.835] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0085.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0085.835] lstrlenW (lpString=".jpg") returned 4
	[0085.835] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0085.835] lstrcmpiW (lpString1=".EXE", lpString2=".adobe") returned 1
	[0085.835] lstrlenW (lpString="DWTRIG20.EXE") returned 12
	[0085.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0085.842] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=629664) returned 1
	[0085.842] CloseHandle (hObject=0x1a8) returned 1
	[0085.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20
	[0085.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0085.843] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.843] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0085.843] GetLastError () returned 0x0
	[0085.843] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x99ba0, lpOverlapped=0x0) returned 1
	[0085.860] WriteFile (in: hFile=0x184, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x99bb0, lpOverlapped=0x0) returned 1
	[0085.873] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.873] WriteFile (in: hFile=0x184, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0085.873] SetEndOfFile (hFile=0x184) returned 1
	[0085.873] CloseHandle (hObject=0x184) returned 1
	[0085.873] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.873] SetEndOfFile (hFile=0x1a8) returned 1
	[0085.879] CloseHandle (hObject=0x1a8) returned 1
	[0085.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.879] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1
	[0085.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0085.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0085.879] lstrlenW (lpString=".doc") returned 4
	[0085.879] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0085.879] lstrlenW (lpString=".docx") returned 5
	[0085.879] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1
	[0085.879] lstrlenW (lpString=".pdf") returned 4
	[0085.879] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0085.879] lstrlenW (lpString=".xls") returned 4
	[0085.879] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0085.880] lstrlenW (lpString=".xlsx") returned 5
	[0085.880] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1
	[0085.880] lstrlenW (lpString=".ppt") returned 4
	[0085.880] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0085.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0085.880] lstrlenW (lpString=".zip") returned 4
	[0085.880] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0085.880] lstrlenW (lpString=".rar") returned 4
	[0085.880] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0085.880] lstrlenW (lpString=".bz2") returned 4
	[0085.880] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0085.880] lstrlenW (lpString=".7z") returned 3
	[0085.880] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0085.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0085.880] lstrlenW (lpString=".dbf") returned 4
	[0085.880] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0085.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0085.880] lstrlenW (lpString=".1cd") returned 4
	[0085.880] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0085.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0085.880] lstrlenW (lpString=".jpg") returned 4
	[0085.880] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0085.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0085.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0085.880] lstrlenW (lpString=".doc") returned 4
	[0085.880] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0085.880] lstrlenW (lpString=".docx") returned 5
	[0085.880] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1
	[0085.880] lstrlenW (lpString=".pdf") returned 4
	[0085.880] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0085.880] lstrlenW (lpString=".xls") returned 4
	[0085.880] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0085.881] lstrlenW (lpString=".xlsx") returned 5
	[0085.881] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1
	[0085.881] lstrlenW (lpString=".ppt") returned 4
	[0085.881] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0085.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0085.881] lstrlenW (lpString=".zip") returned 4
	[0085.881] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0085.881] lstrlenW (lpString=".rar") returned 4
	[0085.881] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0085.881] lstrlenW (lpString=".bz2") returned 4
	[0085.881] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0085.881] lstrlenW (lpString=".7z") returned 3
	[0085.881] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0085.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0085.881] lstrlenW (lpString=".dbf") returned 4
	[0085.881] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0085.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0085.881] lstrlenW (lpString=".1cd") returned 4
	[0085.881] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0085.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0085.881] lstrlenW (lpString=".jpg") returned 4
	[0085.881] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0085.881] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0085.881] lstrlenW (lpString="EEINTL.DLL") returned 10
	[0085.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0085.882] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=64096) returned 1
	[0085.882] CloseHandle (hObject=0x1a8) returned 1
	[0085.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20
	[0085.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0085.883] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.883] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0085.885] GetLastError () returned 0x0
	[0085.885] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xfa60, lpOverlapped=0x0) returned 1
	[0085.889] WriteFile (in: hFile=0x184, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xfa70, lpOverlapped=0x0) returned 1
	[0085.890] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.890] WriteFile (in: hFile=0x184, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0085.891] SetEndOfFile (hFile=0x184) returned 1
	[0085.891] CloseHandle (hObject=0x184) returned 1
	[0085.891] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.891] SetEndOfFile (hFile=0x1a8) returned 1
	[0085.892] CloseHandle (hObject=0x1a8) returned 1
	[0085.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.892] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1
	[0085.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0085.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0085.893] lstrlenW (lpString=".doc") returned 4
	[0085.893] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0085.893] lstrlenW (lpString=".docx") returned 5
	[0085.893] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0085.893] lstrlenW (lpString=".pdf") returned 4
	[0085.893] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0085.893] lstrlenW (lpString=".xls") returned 4
	[0085.893] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0085.893] lstrlenW (lpString=".xlsx") returned 5
	[0085.893] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0085.893] lstrlenW (lpString=".ppt") returned 4
	[0085.893] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0085.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0085.893] lstrlenW (lpString=".zip") returned 4
	[0085.893] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0085.893] lstrlenW (lpString=".rar") returned 4
	[0085.893] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0085.893] lstrlenW (lpString=".bz2") returned 4
	[0085.893] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0085.893] lstrlenW (lpString=".7z") returned 3
	[0085.893] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0085.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0085.893] lstrlenW (lpString=".dbf") returned 4
	[0085.893] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0085.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0085.893] lstrlenW (lpString=".1cd") returned 4
	[0085.893] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0085.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0085.893] lstrlenW (lpString=".jpg") returned 4
	[0085.893] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0085.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0085.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0085.894] lstrlenW (lpString=".doc") returned 4
	[0085.894] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0085.894] lstrlenW (lpString=".docx") returned 5
	[0085.894] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0085.894] lstrlenW (lpString=".pdf") returned 4
	[0085.894] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0085.894] lstrlenW (lpString=".xls") returned 4
	[0085.894] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0085.894] lstrlenW (lpString=".xlsx") returned 5
	[0085.894] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0085.894] lstrlenW (lpString=".ppt") returned 4
	[0085.894] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0085.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0085.894] lstrlenW (lpString=".zip") returned 4
	[0085.894] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0085.894] lstrlenW (lpString=".rar") returned 4
	[0085.894] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0085.894] lstrlenW (lpString=".bz2") returned 4
	[0085.894] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0085.894] lstrlenW (lpString=".7z") returned 3
	[0085.894] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0085.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0085.894] lstrlenW (lpString=".dbf") returned 4
	[0085.894] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0085.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0085.894] lstrlenW (lpString=".1cd") returned 4
	[0085.894] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0085.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0085.894] lstrlenW (lpString=".jpg") returned 4
	[0085.894] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0085.895] lstrcmpiW (lpString1=".CNT", lpString2=".adobe") returned 1
	[0085.895] lstrlenW (lpString="EQNEDT32.CNT") returned 12
	[0085.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0085.906] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=2557) returned 1
	[0085.906] CloseHandle (hObject=0x194) returned 1
	[0085.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20
	[0085.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0085.907] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.907] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.907] GetLastError () returned 0x0
	[0085.907] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x9fd, lpOverlapped=0x0) returned 1
	[0085.913] WriteFile (in: hFile=0x198, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xa00, lpOverlapped=0x0) returned 1
	[0085.916] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.916] WriteFile (in: hFile=0x198, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0085.916] SetEndOfFile (hFile=0x198) returned 1
	[0085.917] CloseHandle (hObject=0x198) returned 1
	[0085.917] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.917] SetEndOfFile (hFile=0x194) returned 1
	[0085.918] CloseHandle (hObject=0x194) returned 1
	[0085.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.918] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1
	[0085.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0085.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0085.918] lstrlenW (lpString=".doc") returned 4
	[0085.918] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1
	[0085.918] lstrlenW (lpString=".docx") returned 5
	[0085.918] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1
	[0085.918] lstrlenW (lpString=".pdf") returned 4
	[0085.918] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1
	[0085.918] lstrlenW (lpString=".xls") returned 4
	[0085.919] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1
	[0085.919] lstrlenW (lpString=".xlsx") returned 5
	[0085.919] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1
	[0085.919] lstrlenW (lpString=".ppt") returned 4
	[0085.919] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1
	[0085.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0085.919] lstrlenW (lpString=".zip") returned 4
	[0085.919] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1
	[0085.919] lstrlenW (lpString=".rar") returned 4
	[0085.919] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1
	[0085.919] lstrlenW (lpString=".bz2") returned 4
	[0085.919] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1
	[0085.919] lstrlenW (lpString=".7z") returned 3
	[0085.919] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1
	[0085.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0085.919] lstrlenW (lpString=".dbf") returned 4
	[0085.919] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1
	[0085.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0085.919] lstrlenW (lpString=".1cd") returned 4
	[0085.919] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1
	[0085.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0085.919] lstrlenW (lpString=".jpg") returned 4
	[0085.919] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1
	[0085.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0085.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0085.919] lstrlenW (lpString=".doc") returned 4
	[0085.919] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1
	[0085.919] lstrlenW (lpString=".docx") returned 5
	[0085.919] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1
	[0085.919] lstrlenW (lpString=".pdf") returned 4
	[0085.919] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1
	[0085.919] lstrlenW (lpString=".xls") returned 4
	[0085.920] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1
	[0085.920] lstrlenW (lpString=".xlsx") returned 5
	[0085.920] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1
	[0085.920] lstrlenW (lpString=".ppt") returned 4
	[0085.920] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1
	[0085.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0085.920] lstrlenW (lpString=".zip") returned 4
	[0085.920] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1
	[0085.920] lstrlenW (lpString=".rar") returned 4
	[0085.920] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1
	[0085.920] lstrlenW (lpString=".bz2") returned 4
	[0085.920] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1
	[0085.920] lstrlenW (lpString=".7z") returned 3
	[0085.920] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1
	[0085.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0085.920] lstrlenW (lpString=".dbf") returned 4
	[0085.920] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1
	[0085.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0085.920] lstrlenW (lpString=".1cd") returned 4
	[0085.920] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1
	[0085.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0085.920] lstrlenW (lpString=".jpg") returned 4
	[0085.920] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1
	[0085.920] lstrcmpiW (lpString1=".EXE", lpString2=".adobe") returned 1
	[0085.920] lstrlenW (lpString="EQNEDT32.EXE") returned 12
	[0085.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.019] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=543304) returned 1
	[0086.019] CloseHandle (hObject=0x19c) returned 1
	[0086.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20
	[0086.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.247] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.247] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0086.296] GetLastError () returned 0x0
	[0086.296] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x84a48, lpOverlapped=0x0) returned 1
	[0086.318] WriteFile (in: hFile=0x1b4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x84a50, lpOverlapped=0x0) returned 1
	[0086.332] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.332] WriteFile (in: hFile=0x1b4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0086.332] SetEndOfFile (hFile=0x1b4) returned 1
	[0086.332] CloseHandle (hObject=0x1b4) returned 1
	[0086.333] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.333] SetEndOfFile (hFile=0x19c) returned 1
	[0086.347] CloseHandle (hObject=0x19c) returned 1
	[0086.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.347] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1
	[0086.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0086.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0086.348] lstrlenW (lpString=".doc") returned 4
	[0086.348] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0086.348] lstrlenW (lpString=".docx") returned 5
	[0086.348] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1
	[0086.348] lstrlenW (lpString=".pdf") returned 4
	[0086.348] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0086.348] lstrlenW (lpString=".xls") returned 4
	[0086.348] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0086.348] lstrlenW (lpString=".xlsx") returned 5
	[0086.348] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1
	[0086.348] lstrlenW (lpString=".ppt") returned 4
	[0086.348] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0086.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0086.348] lstrlenW (lpString=".zip") returned 4
	[0086.348] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0086.348] lstrlenW (lpString=".rar") returned 4
	[0086.348] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0086.348] lstrlenW (lpString=".bz2") returned 4
	[0086.348] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0086.348] lstrlenW (lpString=".7z") returned 3
	[0086.348] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0086.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0086.349] lstrlenW (lpString=".dbf") returned 4
	[0086.349] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0086.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0086.349] lstrlenW (lpString=".1cd") returned 4
	[0086.349] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0086.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0086.349] lstrlenW (lpString=".jpg") returned 4
	[0086.349] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0086.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0086.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0086.349] lstrlenW (lpString=".doc") returned 4
	[0086.349] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0086.349] lstrlenW (lpString=".docx") returned 5
	[0086.349] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1
	[0086.349] lstrlenW (lpString=".pdf") returned 4
	[0086.349] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0086.349] lstrlenW (lpString=".xls") returned 4
	[0086.349] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0086.349] lstrlenW (lpString=".xlsx") returned 5
	[0086.349] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1
	[0086.349] lstrlenW (lpString=".ppt") returned 4
	[0086.349] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0086.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0086.350] lstrlenW (lpString=".zip") returned 4
	[0086.350] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0086.350] lstrlenW (lpString=".rar") returned 4
	[0086.350] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0086.350] lstrlenW (lpString=".bz2") returned 4
	[0086.350] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0086.350] lstrlenW (lpString=".7z") returned 3
	[0086.350] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0086.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0086.350] lstrlenW (lpString=".dbf") returned 4
	[0086.350] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0086.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0086.350] lstrlenW (lpString=".1cd") returned 4
	[0086.350] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0086.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0086.350] lstrlenW (lpString=".jpg") returned 4
	[0086.350] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0086.350] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0086.350] lstrlenW (lpString="MSOEURO.DLL") returned 11
	[0086.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.352] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=31104) returned 1
	[0086.352] CloseHandle (hObject=0x19c) returned 1
	[0086.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20
	[0086.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.353] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.353] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.354] GetLastError () returned 0x0
	[0086.354] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x7980, lpOverlapped=0x0) returned 1
	[0086.359] WriteFile (in: hFile=0x194, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x7990, lpOverlapped=0x0) returned 1
	[0086.361] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.361] WriteFile (in: hFile=0x194, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0086.361] SetEndOfFile (hFile=0x194) returned 1
	[0086.361] CloseHandle (hObject=0x194) returned 1
	[0086.362] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.362] SetEndOfFile (hFile=0x19c) returned 1
	[0086.363] CloseHandle (hObject=0x19c) returned 1
	[0086.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.363] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1
	[0086.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0086.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0086.363] lstrlenW (lpString=".doc") returned 4
	[0086.363] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0086.363] lstrlenW (lpString=".docx") returned 5
	[0086.364] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1
	[0086.364] lstrlenW (lpString=".pdf") returned 4
	[0086.364] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0086.364] lstrlenW (lpString=".xls") returned 4
	[0086.364] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0086.364] lstrlenW (lpString=".xlsx") returned 5
	[0086.364] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1
	[0086.364] lstrlenW (lpString=".ppt") returned 4
	[0086.364] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0086.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0086.364] lstrlenW (lpString=".zip") returned 4
	[0086.364] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0086.364] lstrlenW (lpString=".rar") returned 4
	[0086.364] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0086.364] lstrlenW (lpString=".bz2") returned 4
	[0086.364] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0086.364] lstrlenW (lpString=".7z") returned 3
	[0086.364] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0086.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0086.364] lstrlenW (lpString=".dbf") returned 4
	[0086.364] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0086.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0086.364] lstrlenW (lpString=".1cd") returned 4
	[0086.364] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0086.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0086.364] lstrlenW (lpString=".jpg") returned 4
	[0086.364] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0086.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0086.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0086.365] lstrlenW (lpString=".doc") returned 4
	[0086.365] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0086.365] lstrlenW (lpString=".docx") returned 5
	[0086.365] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1
	[0086.365] lstrlenW (lpString=".pdf") returned 4
	[0086.365] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0086.365] lstrlenW (lpString=".xls") returned 4
	[0086.365] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0086.365] lstrlenW (lpString=".xlsx") returned 5
	[0086.365] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1
	[0086.365] lstrlenW (lpString=".ppt") returned 4
	[0086.365] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0086.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0086.365] lstrlenW (lpString=".zip") returned 4
	[0086.365] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0086.365] lstrlenW (lpString=".rar") returned 4
	[0086.365] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0086.365] lstrlenW (lpString=".bz2") returned 4
	[0086.365] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0086.365] lstrlenW (lpString=".7z") returned 3
	[0086.365] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0086.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0086.365] lstrlenW (lpString=".dbf") returned 4
	[0086.365] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0086.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0086.366] lstrlenW (lpString=".1cd") returned 4
	[0086.366] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0086.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0086.366] lstrlenW (lpString=".jpg") returned 4
	[0086.366] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0086.366] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0086.366] lstrlenW (lpString="msgfilt.dll") returned 11
	[0086.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.370] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=38768) returned 1
	[0086.370] CloseHandle (hObject=0x194) returned 1
	[0086.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20
	[0086.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.370] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.371] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0086.374] GetLastError () returned 0x0
	[0086.374] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x9770, lpOverlapped=0x0) returned 1
	[0086.377] WriteFile (in: hFile=0x160, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x9780, lpOverlapped=0x0) returned 1
	[0086.379] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.379] WriteFile (in: hFile=0x160, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0086.379] SetEndOfFile (hFile=0x160) returned 1
	[0086.380] CloseHandle (hObject=0x160) returned 1
	[0086.380] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.380] SetEndOfFile (hFile=0x194) returned 1
	[0086.381] CloseHandle (hObject=0x194) returned 1
	[0086.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.381] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1
	[0086.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0086.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0086.382] lstrlenW (lpString=".doc") returned 4
	[0086.382] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.382] lstrlenW (lpString=".docx") returned 5
	[0086.382] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0086.382] lstrlenW (lpString=".pdf") returned 4
	[0086.382] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.382] lstrlenW (lpString=".xls") returned 4
	[0086.382] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.382] lstrlenW (lpString=".xlsx") returned 5
	[0086.382] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0086.382] lstrlenW (lpString=".ppt") returned 4
	[0086.382] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0086.382] lstrlenW (lpString=".zip") returned 4
	[0086.382] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.382] lstrlenW (lpString=".rar") returned 4
	[0086.382] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.383] lstrlenW (lpString=".bz2") returned 4
	[0086.383] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.383] lstrlenW (lpString=".7z") returned 3
	[0086.383] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0086.383] lstrlenW (lpString=".dbf") returned 4
	[0086.383] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0086.383] lstrlenW (lpString=".1cd") returned 4
	[0086.383] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0086.383] lstrlenW (lpString=".jpg") returned 4
	[0086.383] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0086.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0086.383] lstrlenW (lpString=".doc") returned 4
	[0086.383] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.383] lstrlenW (lpString=".docx") returned 5
	[0086.383] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0086.383] lstrlenW (lpString=".pdf") returned 4
	[0086.383] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.383] lstrlenW (lpString=".xls") returned 4
	[0086.383] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.383] lstrlenW (lpString=".xlsx") returned 5
	[0086.383] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0086.384] lstrlenW (lpString=".ppt") returned 4
	[0086.384] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0086.384] lstrlenW (lpString=".zip") returned 4
	[0086.384] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.384] lstrlenW (lpString=".rar") returned 4
	[0086.384] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.384] lstrlenW (lpString=".bz2") returned 4
	[0086.384] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.384] lstrlenW (lpString=".7z") returned 3
	[0086.384] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0086.384] lstrlenW (lpString=".dbf") returned 4
	[0086.384] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0086.384] lstrlenW (lpString=".1cd") returned 4
	[0086.384] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0086.384] lstrlenW (lpString=".jpg") returned 4
	[0086.384] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.384] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0086.384] lstrlenW (lpString="odffilt.dll") returned 11
	[0086.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.388] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1312656) returned 1
	[0086.388] CloseHandle (hObject=0x194) returned 1
	[0086.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20
	[0086.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.389] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.389] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0086.390] GetLastError () returned 0x0
	[0086.390] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0086.421] WriteFile (in: hFile=0x1b4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0086.451] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x407a0, lpOverlapped=0x0) returned 1
	[0086.471] WriteFile (in: hFile=0x1b4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x407b0, lpOverlapped=0x0) returned 1
	[0086.483] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.483] WriteFile (in: hFile=0x1b4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0086.483] SetEndOfFile (hFile=0x1b4) returned 1
	[0086.484] CloseHandle (hObject=0x1b4) returned 1
	[0086.484] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.484] SetEndOfFile (hFile=0x194) returned 1
	[0086.487] CloseHandle (hObject=0x194) returned 1
	[0086.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.488] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1
	[0086.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0086.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0086.492] lstrlenW (lpString=".doc") returned 4
	[0086.492] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.492] lstrlenW (lpString=".docx") returned 5
	[0086.492] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0086.492] lstrlenW (lpString=".pdf") returned 4
	[0086.492] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.492] lstrlenW (lpString=".xls") returned 4
	[0086.492] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.492] lstrlenW (lpString=".xlsx") returned 5
	[0086.492] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0086.492] lstrlenW (lpString=".ppt") returned 4
	[0086.492] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0086.492] lstrlenW (lpString=".zip") returned 4
	[0086.492] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.492] lstrlenW (lpString=".rar") returned 4
	[0086.492] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.492] lstrlenW (lpString=".bz2") returned 4
	[0086.492] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.492] lstrlenW (lpString=".7z") returned 3
	[0086.493] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0086.493] lstrlenW (lpString=".dbf") returned 4
	[0086.493] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0086.493] lstrlenW (lpString=".1cd") returned 4
	[0086.493] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0086.493] lstrlenW (lpString=".jpg") returned 4
	[0086.493] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0086.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0086.493] lstrlenW (lpString=".doc") returned 4
	[0086.493] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.493] lstrlenW (lpString=".docx") returned 5
	[0086.493] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0086.493] lstrlenW (lpString=".pdf") returned 4
	[0086.493] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.493] lstrlenW (lpString=".xls") returned 4
	[0086.493] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.493] lstrlenW (lpString=".xlsx") returned 5
	[0086.493] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0086.493] lstrlenW (lpString=".ppt") returned 4
	[0086.493] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0086.493] lstrlenW (lpString=".zip") returned 4
	[0086.493] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.494] lstrlenW (lpString=".rar") returned 4
	[0086.494] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.494] lstrlenW (lpString=".bz2") returned 4
	[0086.494] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.494] lstrlenW (lpString=".7z") returned 3
	[0086.494] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0086.494] lstrlenW (lpString=".dbf") returned 4
	[0086.494] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0086.494] lstrlenW (lpString=".1cd") returned 4
	[0086.494] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0086.494] lstrlenW (lpString=".jpg") returned 4
	[0086.494] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.494] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0086.494] lstrlenW (lpString="offfiltx.dll") returned 12
	[0086.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.502] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1486736) returned 1
	[0086.502] CloseHandle (hObject=0x19c) returned 1
	[0086.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20
	[0086.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.503] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.503] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.504] GetLastError () returned 0x0
	[0086.504] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0086.534] WriteFile (in: hFile=0x194, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0086.559] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x6afa0, lpOverlapped=0x0) returned 1
	[0086.585] WriteFile (in: hFile=0x194, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x6afb0, lpOverlapped=0x0) returned 1
	[0086.599] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.599] WriteFile (in: hFile=0x194, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0086.600] SetEndOfFile (hFile=0x194) returned 1
	[0086.600] CloseHandle (hObject=0x194) returned 1
	[0086.600] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.600] SetEndOfFile (hFile=0x19c) returned 1
	[0086.605] CloseHandle (hObject=0x19c) returned 1
	[0086.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.606] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1
	[0086.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0086.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0086.606] lstrlenW (lpString=".doc") returned 4
	[0086.606] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.606] lstrlenW (lpString=".docx") returned 5
	[0086.606] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1
	[0086.606] lstrlenW (lpString=".pdf") returned 4
	[0086.606] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.606] lstrlenW (lpString=".xls") returned 4
	[0086.606] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.606] lstrlenW (lpString=".xlsx") returned 5
	[0086.606] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1
	[0086.606] lstrlenW (lpString=".ppt") returned 4
	[0086.606] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0086.607] lstrlenW (lpString=".zip") returned 4
	[0086.607] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.607] lstrlenW (lpString=".rar") returned 4
	[0086.607] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.607] lstrlenW (lpString=".bz2") returned 4
	[0086.607] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.607] lstrlenW (lpString=".7z") returned 3
	[0086.607] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0086.607] lstrlenW (lpString=".dbf") returned 4
	[0086.607] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0086.607] lstrlenW (lpString=".1cd") returned 4
	[0086.607] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0086.607] lstrlenW (lpString=".jpg") returned 4
	[0086.607] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0086.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0086.607] lstrlenW (lpString=".doc") returned 4
	[0086.607] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.607] lstrlenW (lpString=".docx") returned 5
	[0086.607] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1
	[0086.607] lstrlenW (lpString=".pdf") returned 4
	[0086.607] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.607] lstrlenW (lpString=".xls") returned 4
	[0086.607] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.608] lstrlenW (lpString=".xlsx") returned 5
	[0086.608] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1
	[0086.608] lstrlenW (lpString=".ppt") returned 4
	[0086.608] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0086.608] lstrlenW (lpString=".zip") returned 4
	[0086.608] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.608] lstrlenW (lpString=".rar") returned 4
	[0086.608] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.608] lstrlenW (lpString=".bz2") returned 4
	[0086.608] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.608] lstrlenW (lpString=".7z") returned 3
	[0086.608] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0086.608] lstrlenW (lpString=".dbf") returned 4
	[0086.608] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0086.608] lstrlenW (lpString=".1cd") returned 4
	[0086.608] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0086.608] lstrlenW (lpString=".jpg") returned 4
	[0086.608] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.608] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0086.609] lstrlenW (lpString="VISFILT.DLL") returned 11
	[0086.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0086.620] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=2124664) returned 1
	[0086.620] CloseHandle (hObject=0x188) returned 1
	[0086.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20
	[0086.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.620] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0086.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0086.635] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0086.635] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0086.635] ReadFile (in: hFile=0x188, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0086.647] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0086.647] ReadFile (in: hFile=0x188, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0086.651] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0086.651] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0086.651] ReadFile (in: hFile=0x188, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0086.682] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.682] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0086.701] SetEndOfFile (hFile=0x188) returned 1
	[0086.701] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0086.706] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.706] WriteFile (in: hFile=0x188, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.708] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.708] WriteFile (in: hFile=0x188, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.711] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.711] WriteFile (in: hFile=0x188, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.713] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0086.713] CloseHandle (hObject=0x188) returned 1
	[0086.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0086.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0086.714] lstrlenW (lpString=".doc") returned 4
	[0086.714] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0086.714] lstrlenW (lpString=".docx") returned 5
	[0086.714] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0086.714] lstrlenW (lpString=".pdf") returned 4
	[0086.714] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0086.714] lstrlenW (lpString=".xls") returned 4
	[0086.714] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0086.714] lstrlenW (lpString=".xlsx") returned 5
	[0086.714] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0086.714] lstrlenW (lpString=".ppt") returned 4
	[0086.714] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0086.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0086.714] lstrlenW (lpString=".zip") returned 4
	[0086.714] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0086.714] lstrlenW (lpString=".rar") returned 4
	[0086.714] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0086.714] lstrlenW (lpString=".bz2") returned 4
	[0086.714] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0086.715] lstrlenW (lpString=".7z") returned 3
	[0086.715] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0086.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0086.715] lstrlenW (lpString=".dbf") returned 4
	[0086.715] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0086.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0086.715] lstrlenW (lpString=".1cd") returned 4
	[0086.715] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0086.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0086.715] lstrlenW (lpString=".jpg") returned 4
	[0086.715] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0086.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0086.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0086.715] lstrlenW (lpString=".doc") returned 4
	[0086.715] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0086.715] lstrlenW (lpString=".docx") returned 5
	[0086.715] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0086.715] lstrlenW (lpString=".pdf") returned 4
	[0086.715] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0086.715] lstrlenW (lpString=".xls") returned 4
	[0086.715] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0086.715] lstrlenW (lpString=".xlsx") returned 5
	[0086.715] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0086.715] lstrlenW (lpString=".ppt") returned 4
	[0086.715] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0086.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0086.715] lstrlenW (lpString=".zip") returned 4
	[0086.716] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0086.716] lstrlenW (lpString=".rar") returned 4
	[0086.716] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0086.716] lstrlenW (lpString=".bz2") returned 4
	[0086.716] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0086.716] lstrlenW (lpString=".7z") returned 3
	[0086.716] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0086.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0086.716] lstrlenW (lpString=".dbf") returned 4
	[0086.716] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0086.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0086.716] lstrlenW (lpString=".1cd") returned 4
	[0086.716] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0086.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0086.716] lstrlenW (lpString=".jpg") returned 4
	[0086.716] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0086.716] lstrcmpiW (lpString1=".FNT", lpString2=".adobe") returned 1
	[0086.716] lstrlenW (lpString="CGMIMP32.FNT") returned 12
	[0086.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0086.728] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=606062) returned 1
	[0086.728] CloseHandle (hObject=0x1ac) returned 1
	[0086.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20
	[0086.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0086.993] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.993] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0087.078] GetLastError () returned 0x0
	[0087.078] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x93f6e, lpOverlapped=0x0) returned 1
	[0087.095] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x93f70, lpOverlapped=0x0) returned 1
	[0087.108] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.108] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0087.109] SetEndOfFile (hFile=0x19c) returned 1
	[0087.113] CloseHandle (hObject=0x19c) returned 1
	[0087.114] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.114] SetEndOfFile (hFile=0x1b4) returned 1
	[0087.123] CloseHandle (hObject=0x1b4) returned 1
	[0087.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0087.131] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1
	[0087.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67
	[0087.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67
	[0087.138] lstrlenW (lpString=".doc") returned 4
	[0087.138] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1
	[0087.138] lstrlenW (lpString=".docx") returned 5
	[0087.138] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1
	[0087.138] lstrlenW (lpString=".pdf") returned 4
	[0087.138] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1
	[0087.138] lstrlenW (lpString=".xls") returned 4
	[0087.138] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1
	[0087.138] lstrlenW (lpString=".xlsx") returned 5
	[0087.138] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1
	[0087.138] lstrlenW (lpString=".ppt") returned 4
	[0087.138] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1
	[0087.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67
	[0087.138] lstrlenW (lpString=".zip") returned 4
	[0087.138] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1
	[0087.138] lstrlenW (lpString=".rar") returned 4
	[0087.138] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1
	[0087.138] lstrlenW (lpString=".bz2") returned 4
	[0087.138] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1
	[0087.138] lstrlenW (lpString=".7z") returned 3
	[0087.139] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1
	[0087.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67
	[0087.139] lstrlenW (lpString=".dbf") returned 4
	[0087.139] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1
	[0087.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67
	[0087.139] lstrlenW (lpString=".1cd") returned 4
	[0087.139] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1
	[0087.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67
	[0087.139] lstrlenW (lpString=".jpg") returned 4
	[0087.139] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1
	[0087.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67
	[0087.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67
	[0087.139] lstrlenW (lpString=".doc") returned 4
	[0087.139] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1
	[0087.139] lstrlenW (lpString=".docx") returned 5
	[0087.139] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1
	[0087.139] lstrlenW (lpString=".pdf") returned 4
	[0087.139] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1
	[0087.139] lstrlenW (lpString=".xls") returned 4
	[0087.139] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1
	[0087.139] lstrlenW (lpString=".xlsx") returned 5
	[0087.139] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1
	[0087.139] lstrlenW (lpString=".ppt") returned 4
	[0087.139] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1
	[0087.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67
	[0087.139] lstrlenW (lpString=".zip") returned 4
	[0087.140] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1
	[0087.140] lstrlenW (lpString=".rar") returned 4
	[0087.140] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1
	[0087.140] lstrlenW (lpString=".bz2") returned 4
	[0087.140] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1
	[0087.140] lstrlenW (lpString=".7z") returned 3
	[0087.140] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1
	[0087.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67
	[0087.140] lstrlenW (lpString=".dbf") returned 4
	[0087.140] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1
	[0087.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67
	[0087.140] lstrlenW (lpString=".1cd") returned 4
	[0087.140] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1
	[0087.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67
	[0087.140] lstrlenW (lpString=".jpg") returned 4
	[0087.140] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1
	[0087.140] lstrcmpiW (lpString1=".CGM", lpString2=".adobe") returned 1
	[0087.140] lstrlenW (lpString="MS.CGM") returned 6
	[0087.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.221] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1908) returned 1
	[0087.221] CloseHandle (hObject=0x174) returned 1
	[0087.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20
	[0087.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.282] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.283] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0087.328] GetLastError () returned 0x0
	[0087.328] ReadFile (in: hFile=0x1ac, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x774, lpOverlapped=0x0) returned 1
	[0087.331] WriteFile (in: hFile=0x160, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x780, lpOverlapped=0x0) returned 1
	[0087.333] ReadFile (in: hFile=0x1ac, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.333] WriteFile (in: hFile=0x160, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0087.333] SetEndOfFile (hFile=0x160) returned 1
	[0087.339] CloseHandle (hObject=0x160) returned 1
	[0087.342] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.342] SetEndOfFile (hFile=0x1ac) returned 1
	[0087.349] CloseHandle (hObject=0x1ac) returned 1
	[0087.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0087.354] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1
	[0087.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0087.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0087.363] lstrlenW (lpString=".doc") returned 4
	[0087.363] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1
	[0087.363] lstrlenW (lpString=".docx") returned 5
	[0087.363] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1
	[0087.363] lstrlenW (lpString=".pdf") returned 4
	[0087.363] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1
	[0087.363] lstrlenW (lpString=".xls") returned 4
	[0087.363] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1
	[0087.364] lstrlenW (lpString=".xlsx") returned 5
	[0087.364] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1
	[0087.364] lstrlenW (lpString=".ppt") returned 4
	[0087.364] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1
	[0087.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0087.364] lstrlenW (lpString=".zip") returned 4
	[0087.364] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1
	[0087.364] lstrlenW (lpString=".rar") returned 4
	[0087.364] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1
	[0087.364] lstrlenW (lpString=".bz2") returned 4
	[0087.364] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1
	[0087.364] lstrlenW (lpString=".7z") returned 3
	[0087.364] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1
	[0087.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0087.364] lstrlenW (lpString=".dbf") returned 4
	[0087.364] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1
	[0087.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0087.364] lstrlenW (lpString=".1cd") returned 4
	[0087.364] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1
	[0087.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0087.364] lstrlenW (lpString=".jpg") returned 4
	[0087.364] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1
	[0087.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0087.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0087.364] lstrlenW (lpString=".doc") returned 4
	[0087.364] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1
	[0087.365] lstrlenW (lpString=".docx") returned 5
	[0087.365] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1
	[0087.365] lstrlenW (lpString=".pdf") returned 4
	[0087.365] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1
	[0087.365] lstrlenW (lpString=".xls") returned 4
	[0087.365] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1
	[0087.365] lstrlenW (lpString=".xlsx") returned 5
	[0087.365] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1
	[0087.365] lstrlenW (lpString=".ppt") returned 4
	[0087.365] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1
	[0087.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0087.365] lstrlenW (lpString=".zip") returned 4
	[0087.365] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1
	[0087.365] lstrlenW (lpString=".rar") returned 4
	[0087.365] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1
	[0087.365] lstrlenW (lpString=".bz2") returned 4
	[0087.365] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1
	[0087.365] lstrlenW (lpString=".7z") returned 3
	[0087.365] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1
	[0087.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0087.365] lstrlenW (lpString=".dbf") returned 4
	[0087.365] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1
	[0087.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0087.365] lstrlenW (lpString=".1cd") returned 4
	[0087.365] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1
	[0087.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0087.365] lstrlenW (lpString=".jpg") returned 4
	[0087.366] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1
	[0087.366] lstrcmpiW (lpString1=".FLT", lpString2=".adobe") returned 1
	[0087.366] lstrlenW (lpString="WPGIMP32.FLT") returned 12
	[0087.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0087.405] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=280448) returned 1
	[0087.405] CloseHandle (hObject=0x160) returned 1
	[0087.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20
	[0087.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0087.710] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.710] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.768] GetLastError () returned 0x0
	[0087.768] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x44780, lpOverlapped=0x0) returned 1
	[0087.780] WriteFile (in: hFile=0x174, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x44790, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x44790, lpOverlapped=0x0) returned 1
	[0087.788] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.788] WriteFile (in: hFile=0x174, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0087.788] SetEndOfFile (hFile=0x174) returned 1
	[0087.789] CloseHandle (hObject=0x174) returned 1
	[0087.789] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.789] SetEndOfFile (hFile=0x19c) returned 1
	[0087.793] CloseHandle (hObject=0x19c) returned 1
	[0087.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0087.794] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1
	[0087.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67
	[0087.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67
	[0087.800] lstrlenW (lpString=".doc") returned 4
	[0087.800] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0087.800] lstrlenW (lpString=".docx") returned 5
	[0087.800] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0087.800] lstrlenW (lpString=".pdf") returned 4
	[0087.800] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0087.800] lstrlenW (lpString=".xls") returned 4
	[0087.801] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0087.801] lstrlenW (lpString=".xlsx") returned 5
	[0087.801] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0087.801] lstrlenW (lpString=".ppt") returned 4
	[0087.801] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0087.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67
	[0087.801] lstrlenW (lpString=".zip") returned 4
	[0087.801] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0087.801] lstrlenW (lpString=".rar") returned 4
	[0087.801] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0087.801] lstrlenW (lpString=".bz2") returned 4
	[0087.801] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0087.801] lstrlenW (lpString=".7z") returned 3
	[0087.801] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0087.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67
	[0087.801] lstrlenW (lpString=".dbf") returned 4
	[0087.801] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0087.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67
	[0087.801] lstrlenW (lpString=".1cd") returned 4
	[0087.801] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0087.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67
	[0087.801] lstrlenW (lpString=".jpg") returned 4
	[0087.801] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0087.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67
	[0087.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67
	[0087.801] lstrlenW (lpString=".doc") returned 4
	[0087.802] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0087.802] lstrlenW (lpString=".docx") returned 5
	[0087.802] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0087.802] lstrlenW (lpString=".pdf") returned 4
	[0087.802] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0087.802] lstrlenW (lpString=".xls") returned 4
	[0087.802] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0087.802] lstrlenW (lpString=".xlsx") returned 5
	[0087.802] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0087.802] lstrlenW (lpString=".ppt") returned 4
	[0087.802] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0087.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67
	[0087.802] lstrlenW (lpString=".zip") returned 4
	[0087.802] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0087.802] lstrlenW (lpString=".rar") returned 4
	[0087.802] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0087.802] lstrlenW (lpString=".bz2") returned 4
	[0087.802] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0087.802] lstrlenW (lpString=".7z") returned 3
	[0087.802] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0087.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67
	[0087.802] lstrlenW (lpString=".dbf") returned 4
	[0087.802] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0087.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67
	[0087.802] lstrlenW (lpString=".1cd") returned 4
	[0087.802] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0087.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67
	[0087.803] lstrlenW (lpString=".jpg") returned 4
	[0087.803] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0087.803] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0087.803] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22
	[0087.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.848] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=22528) returned 1
	[0087.848] CloseHandle (hObject=0x1ac) returned 1
	[0087.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20
	[0087.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0087.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0087.886] lstrlenW (lpString=".doc") returned 4
	[0087.886] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.886] lstrlenW (lpString=".docx") returned 5
	[0087.886] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.886] lstrlenW (lpString=".pdf") returned 4
	[0087.886] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.886] lstrlenW (lpString=".xls") returned 4
	[0087.886] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.886] lstrlenW (lpString=".xlsx") returned 5
	[0087.886] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.886] lstrlenW (lpString=".ppt") returned 4
	[0087.886] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0087.886] lstrlenW (lpString=".zip") returned 4
	[0087.886] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.886] lstrlenW (lpString=".rar") returned 4
	[0087.886] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.886] lstrlenW (lpString=".bz2") returned 4
	[0087.887] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.887] lstrlenW (lpString=".7z") returned 3
	[0087.887] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0087.887] lstrlenW (lpString=".dbf") returned 4
	[0087.887] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0087.887] lstrlenW (lpString=".1cd") returned 4
	[0087.887] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0087.887] lstrlenW (lpString=".jpg") returned 4
	[0087.887] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0087.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0087.887] lstrlenW (lpString=".doc") returned 4
	[0087.887] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.887] lstrlenW (lpString=".docx") returned 5
	[0087.887] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.887] lstrlenW (lpString=".pdf") returned 4
	[0087.887] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.887] lstrlenW (lpString=".xls") returned 4
	[0087.887] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.887] lstrlenW (lpString=".xlsx") returned 5
	[0087.887] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.887] lstrlenW (lpString=".ppt") returned 4
	[0087.887] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0087.888] lstrlenW (lpString=".zip") returned 4
	[0087.888] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.888] lstrlenW (lpString=".rar") returned 4
	[0087.888] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.888] lstrlenW (lpString=".bz2") returned 4
	[0087.888] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.888] lstrlenW (lpString=".7z") returned 3
	[0087.888] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0087.888] lstrlenW (lpString=".dbf") returned 4
	[0087.888] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0087.888] lstrlenW (lpString=".1cd") returned 4
	[0087.888] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0087.888] lstrlenW (lpString=".jpg") returned 4
	[0087.888] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.889] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0087.889] lstrlenW (lpString="mshwLatin.dll.mui") returned 17
	[0087.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0087.943] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=2560) returned 1
	[0087.943] CloseHandle (hObject=0x188) returned 1
	[0087.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20
	[0088.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0088.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0088.046] lstrlenW (lpString=".doc") returned 4
	[0088.046] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.046] lstrlenW (lpString=".docx") returned 5
	[0088.046] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.046] lstrlenW (lpString=".pdf") returned 4
	[0088.046] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.046] lstrlenW (lpString=".xls") returned 4
	[0088.046] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.046] lstrlenW (lpString=".xlsx") returned 5
	[0088.046] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.046] lstrlenW (lpString=".ppt") returned 4
	[0088.046] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0088.046] lstrlenW (lpString=".zip") returned 4
	[0088.046] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.046] lstrlenW (lpString=".rar") returned 4
	[0088.046] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.046] lstrlenW (lpString=".bz2") returned 4
	[0088.046] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.047] lstrlenW (lpString=".7z") returned 3
	[0088.047] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0088.047] lstrlenW (lpString=".dbf") returned 4
	[0088.047] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0088.047] lstrlenW (lpString=".1cd") returned 4
	[0088.047] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0088.047] lstrlenW (lpString=".jpg") returned 4
	[0088.047] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0088.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0088.047] lstrlenW (lpString=".doc") returned 4
	[0088.047] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.047] lstrlenW (lpString=".docx") returned 5
	[0088.047] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.047] lstrlenW (lpString=".pdf") returned 4
	[0088.047] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.047] lstrlenW (lpString=".xls") returned 4
	[0088.047] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.047] lstrlenW (lpString=".xlsx") returned 5
	[0088.047] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.047] lstrlenW (lpString=".ppt") returned 4
	[0088.047] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0088.048] lstrlenW (lpString=".zip") returned 4
	[0088.048] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.048] lstrlenW (lpString=".rar") returned 4
	[0088.048] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.048] lstrlenW (lpString=".bz2") returned 4
	[0088.048] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.048] lstrlenW (lpString=".7z") returned 3
	[0088.048] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0088.048] lstrlenW (lpString=".dbf") returned 4
	[0088.048] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0088.048] lstrlenW (lpString=".1cd") returned 4
	[0088.048] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0088.048] lstrlenW (lpString=".jpg") returned 4
	[0088.048] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.048] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0088.048] lstrlenW (lpString="TipBand.dll.mui") returned 15
	[0088.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.125] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=3072) returned 1
	[0088.125] CloseHandle (hObject=0x188) returned 1
	[0088.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui")) returned 0x20
	[0088.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72
	[0088.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72
	[0088.239] lstrlenW (lpString=".doc") returned 4
	[0088.239] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.239] lstrlenW (lpString=".docx") returned 5
	[0088.239] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.239] lstrlenW (lpString=".pdf") returned 4
	[0088.239] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.239] lstrlenW (lpString=".xls") returned 4
	[0088.239] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.239] lstrlenW (lpString=".xlsx") returned 5
	[0088.239] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.239] lstrlenW (lpString=".ppt") returned 4
	[0088.239] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72
	[0088.239] lstrlenW (lpString=".zip") returned 4
	[0088.239] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.239] lstrlenW (lpString=".rar") returned 4
	[0088.239] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.239] lstrlenW (lpString=".bz2") returned 4
	[0088.239] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.239] lstrlenW (lpString=".7z") returned 3
	[0088.240] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72
	[0088.240] lstrlenW (lpString=".dbf") returned 4
	[0088.240] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72
	[0088.240] lstrlenW (lpString=".1cd") returned 4
	[0088.240] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72
	[0088.240] lstrlenW (lpString=".jpg") returned 4
	[0088.240] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72
	[0088.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72
	[0088.240] lstrlenW (lpString=".doc") returned 4
	[0088.240] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.240] lstrlenW (lpString=".docx") returned 5
	[0088.240] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.240] lstrlenW (lpString=".pdf") returned 4
	[0088.240] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.240] lstrlenW (lpString=".xls") returned 4
	[0088.240] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.240] lstrlenW (lpString=".xlsx") returned 5
	[0088.240] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.240] lstrlenW (lpString=".ppt") returned 4
	[0088.240] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72
	[0088.240] lstrlenW (lpString=".zip") returned 4
	[0088.240] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.241] lstrlenW (lpString=".rar") returned 4
	[0088.241] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.241] lstrlenW (lpString=".bz2") returned 4
	[0088.241] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.241] lstrlenW (lpString=".7z") returned 3
	[0088.241] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72
	[0088.241] lstrlenW (lpString=".dbf") returned 4
	[0088.241] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72
	[0088.241] lstrlenW (lpString=".1cd") returned 4
	[0088.241] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72
	[0088.241] lstrlenW (lpString=".jpg") returned 4
	[0088.241] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.241] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0088.241] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0088.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0088.242] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=4096) returned 1
	[0088.242] CloseHandle (hObject=0x1a4) returned 1
	[0088.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20
	[0088.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0088.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0088.243] lstrlenW (lpString=".doc") returned 4
	[0088.243] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.243] lstrlenW (lpString=".docx") returned 5
	[0088.243] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.243] lstrlenW (lpString=".pdf") returned 4
	[0088.243] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.243] lstrlenW (lpString=".xls") returned 4
	[0088.243] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.243] lstrlenW (lpString=".xlsx") returned 5
	[0088.243] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.243] lstrlenW (lpString=".ppt") returned 4
	[0088.243] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0088.243] lstrlenW (lpString=".zip") returned 4
	[0088.244] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.244] lstrlenW (lpString=".rar") returned 4
	[0088.244] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.244] lstrlenW (lpString=".bz2") returned 4
	[0088.244] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.244] lstrlenW (lpString=".7z") returned 3
	[0088.244] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0088.244] lstrlenW (lpString=".dbf") returned 4
	[0088.244] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0088.244] lstrlenW (lpString=".1cd") returned 4
	[0088.244] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0088.244] lstrlenW (lpString=".jpg") returned 4
	[0088.244] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0088.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0088.244] lstrlenW (lpString=".doc") returned 4
	[0088.244] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.244] lstrlenW (lpString=".docx") returned 5
	[0088.244] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.244] lstrlenW (lpString=".pdf") returned 4
	[0088.244] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.244] lstrlenW (lpString=".xls") returned 4
	[0088.245] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.245] lstrlenW (lpString=".xlsx") returned 5
	[0088.245] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.245] lstrlenW (lpString=".ppt") returned 4
	[0088.245] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0088.245] lstrlenW (lpString=".zip") returned 4
	[0088.245] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.245] lstrlenW (lpString=".rar") returned 4
	[0088.245] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.245] lstrlenW (lpString=".bz2") returned 4
	[0088.245] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.245] lstrlenW (lpString=".7z") returned 3
	[0088.245] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0088.245] lstrlenW (lpString=".dbf") returned 4
	[0088.245] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0088.245] lstrlenW (lpString=".1cd") returned 4
	[0088.245] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0088.245] lstrlenW (lpString=".jpg") returned 4
	[0088.245] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.246] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0088.246] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0088.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0088.246] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=4096) returned 1
	[0088.246] CloseHandle (hObject=0x1a4) returned 1
	[0088.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20
	[0088.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72
	[0088.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72
	[0088.247] lstrlenW (lpString=".doc") returned 4
	[0088.247] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.247] lstrlenW (lpString=".docx") returned 5
	[0088.247] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.247] lstrlenW (lpString=".pdf") returned 4
	[0088.247] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.248] lstrlenW (lpString=".xls") returned 4
	[0088.248] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.248] lstrlenW (lpString=".xlsx") returned 5
	[0088.248] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.248] lstrlenW (lpString=".ppt") returned 4
	[0088.248] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72
	[0088.248] lstrlenW (lpString=".zip") returned 4
	[0088.248] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.248] lstrlenW (lpString=".rar") returned 4
	[0088.248] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.248] lstrlenW (lpString=".bz2") returned 4
	[0088.248] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.248] lstrlenW (lpString=".7z") returned 3
	[0088.248] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72
	[0088.248] lstrlenW (lpString=".dbf") returned 4
	[0088.248] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72
	[0088.248] lstrlenW (lpString=".1cd") returned 4
	[0088.248] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72
	[0088.248] lstrlenW (lpString=".jpg") returned 4
	[0088.248] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72
	[0088.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72
	[0088.249] lstrlenW (lpString=".doc") returned 4
	[0088.249] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.249] lstrlenW (lpString=".docx") returned 5
	[0088.249] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.249] lstrlenW (lpString=".pdf") returned 4
	[0088.249] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.249] lstrlenW (lpString=".xls") returned 4
	[0088.249] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.249] lstrlenW (lpString=".xlsx") returned 5
	[0088.249] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.249] lstrlenW (lpString=".ppt") returned 4
	[0088.249] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72
	[0088.249] lstrlenW (lpString=".zip") returned 4
	[0088.249] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.249] lstrlenW (lpString=".rar") returned 4
	[0088.249] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.249] lstrlenW (lpString=".bz2") returned 4
	[0088.249] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.249] lstrlenW (lpString=".7z") returned 3
	[0088.249] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72
	[0088.249] lstrlenW (lpString=".dbf") returned 4
	[0088.249] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72
	[0088.249] lstrlenW (lpString=".1cd") returned 4
	[0088.249] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72
	[0088.250] lstrlenW (lpString=".jpg") returned 4
	[0088.250] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.250] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0088.250] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0088.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0088.250] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=3584) returned 1
	[0088.250] CloseHandle (hObject=0x1a4) returned 1
	[0088.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20
	[0088.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui") returned 72
	[0088.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui") returned 72
	[0088.251] lstrlenW (lpString=".doc") returned 4
	[0088.251] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.251] lstrlenW (lpString=".docx") returned 5
	[0088.251] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.251] lstrlenW (lpString=".pdf") returned 4
	[0088.251] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.251] lstrlenW (lpString=".xls") returned 4
	[0088.251] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.252] lstrlenW (lpString=".xlsx") returned 5
	[0088.252] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.252] lstrlenW (lpString=".ppt") returned 4
	[0088.252] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui") returned 72
	[0088.252] lstrlenW (lpString=".zip") returned 4
	[0088.252] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.252] lstrlenW (lpString=".rar") returned 4
	[0088.252] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.252] lstrlenW (lpString=".bz2") returned 4
	[0088.252] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.252] lstrlenW (lpString=".7z") returned 3
	[0088.252] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui") returned 72
	[0088.252] lstrlenW (lpString=".dbf") returned 4
	[0088.252] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0088.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0088.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0089.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.070] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.070] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0090.155] GetLastError () returned 0x0
	[0090.155] ReadFile (in: hFile=0x160, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x19b80, lpOverlapped=0x0) returned 1
	[0090.177] WriteFile (in: hFile=0x198, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x19b90, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x19b90, lpOverlapped=0x0) returned 1
	[0090.179] ReadFile (in: hFile=0x160, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.180] WriteFile (in: hFile=0x198, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0090.180] SetEndOfFile (hFile=0x198) returned 1
	[0090.180] CloseHandle (hObject=0x198) returned 1
	[0090.180] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.180] SetEndOfFile (hFile=0x160) returned 1
	[0090.182] CloseHandle (hObject=0x160) returned 1
	[0090.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.182] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 1
	[0090.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74
	[0090.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74
	[0090.182] lstrlenW (lpString=".doc") returned 4
	[0090.182] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0090.182] lstrlenW (lpString=".docx") returned 5
	[0090.182] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1
	[0090.183] lstrlenW (lpString=".pdf") returned 4
	[0090.183] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0090.183] lstrlenW (lpString=".xls") returned 4
	[0090.183] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0090.183] lstrlenW (lpString=".xlsx") returned 5
	[0090.183] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1
	[0090.183] lstrlenW (lpString=".ppt") returned 4
	[0090.183] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0090.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74
	[0090.183] lstrlenW (lpString=".zip") returned 4
	[0090.183] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0090.183] lstrlenW (lpString=".rar") returned 4
	[0090.183] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0090.183] lstrlenW (lpString=".bz2") returned 4
	[0090.183] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0090.183] lstrlenW (lpString=".7z") returned 3
	[0090.183] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0090.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74
	[0090.183] lstrlenW (lpString=".dbf") returned 4
	[0090.183] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0090.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74
	[0090.183] lstrlenW (lpString=".1cd") returned 4
	[0090.183] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0090.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74
	[0090.183] lstrlenW (lpString=".jpg") returned 4
	[0090.183] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0090.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74
	[0090.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74
	[0090.183] lstrlenW (lpString=".doc") returned 4
	[0090.183] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0090.183] lstrlenW (lpString=".docx") returned 5
	[0090.184] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1
	[0090.184] lstrlenW (lpString=".pdf") returned 4
	[0090.184] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0090.184] lstrlenW (lpString=".xls") returned 4
	[0090.184] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0090.184] lstrlenW (lpString=".xlsx") returned 5
	[0090.184] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1
	[0090.184] lstrlenW (lpString=".ppt") returned 4
	[0090.184] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0090.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74
	[0090.184] lstrlenW (lpString=".zip") returned 4
	[0090.184] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0090.184] lstrlenW (lpString=".rar") returned 4
	[0090.184] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0090.184] lstrlenW (lpString=".bz2") returned 4
	[0090.184] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0090.184] lstrlenW (lpString=".7z") returned 3
	[0090.184] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0090.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74
	[0090.184] lstrlenW (lpString=".dbf") returned 4
	[0090.184] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0090.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74
	[0090.184] lstrlenW (lpString=".1cd") returned 4
	[0090.184] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0090.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74
	[0090.184] lstrlenW (lpString=".jpg") returned 4
	[0090.184] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0090.184] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0090.185] lstrlenW (lpString="ACEREP.DLL") returned 10
	[0090.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.300] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=691616) returned 1
	[0090.300] CloseHandle (hObject=0x188) returned 1
	[0090.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 0x20
	[0090.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.529] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.529] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0090.581] GetLastError () returned 0x0
	[0090.581] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xa8da0, lpOverlapped=0x0) returned 1
	[0090.601] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xa8db0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xa8db0, lpOverlapped=0x0) returned 1
	[0090.615] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.615] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0090.615] SetEndOfFile (hFile=0x19c) returned 1
	[0090.616] CloseHandle (hObject=0x19c) returned 1
	[0090.617] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.617] SetEndOfFile (hFile=0x188) returned 1
	[0090.634] CloseHandle (hObject=0x188) returned 1
	[0090.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.639] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 1
	[0090.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66
	[0090.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66
	[0090.644] lstrlenW (lpString=".doc") returned 4
	[0090.644] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0090.644] lstrlenW (lpString=".docx") returned 5
	[0090.644] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1
	[0090.644] lstrlenW (lpString=".pdf") returned 4
	[0090.644] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0090.644] lstrlenW (lpString=".xls") returned 4
	[0090.644] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0090.644] lstrlenW (lpString=".xlsx") returned 5
	[0090.644] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1
	[0090.644] lstrlenW (lpString=".ppt") returned 4
	[0090.644] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0090.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66
	[0090.644] lstrlenW (lpString=".zip") returned 4
	[0090.645] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0090.645] lstrlenW (lpString=".rar") returned 4
	[0090.645] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0090.645] lstrlenW (lpString=".bz2") returned 4
	[0090.645] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0090.645] lstrlenW (lpString=".7z") returned 3
	[0090.645] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0090.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66
	[0090.645] lstrlenW (lpString=".dbf") returned 4
	[0090.645] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0090.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66
	[0090.645] lstrlenW (lpString=".1cd") returned 4
	[0090.645] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0090.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66
	[0090.645] lstrlenW (lpString=".jpg") returned 4
	[0090.645] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0090.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66
	[0090.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66
	[0090.645] lstrlenW (lpString=".doc") returned 4
	[0090.645] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0090.645] lstrlenW (lpString=".docx") returned 5
	[0090.645] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1
	[0090.645] lstrlenW (lpString=".pdf") returned 4
	[0090.645] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0090.645] lstrlenW (lpString=".xls") returned 4
	[0090.645] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0090.645] lstrlenW (lpString=".xlsx") returned 5
	[0090.645] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1
	[0090.645] lstrlenW (lpString=".ppt") returned 4
	[0090.645] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0090.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66
	[0090.645] lstrlenW (lpString=".zip") returned 4
	[0090.645] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0090.646] lstrlenW (lpString=".rar") returned 4
	[0090.646] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0090.646] lstrlenW (lpString=".bz2") returned 4
	[0090.646] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0090.646] lstrlenW (lpString=".7z") returned 3
	[0090.646] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0090.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66
	[0090.646] lstrlenW (lpString=".dbf") returned 4
	[0090.646] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0090.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66
	[0090.646] lstrlenW (lpString=".1cd") returned 4
	[0090.646] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0090.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66
	[0090.646] lstrlenW (lpString=".jpg") returned 4
	[0090.646] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0090.646] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0090.646] lstrlenW (lpString="ACEXBE.DLL") returned 10
	[0090.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0090.667] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=502168) returned 1
	[0090.667] CloseHandle (hObject=0x194) returned 1
	[0090.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 0x20
	[0090.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0090.703] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.703] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0090.706] GetLastError () returned 0x0
	[0090.707] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x7a998, lpOverlapped=0x0) returned 1
	[0090.904] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7a9a0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x7a9a0, lpOverlapped=0x0) returned 1
	[0090.915] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.915] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0090.915] SetEndOfFile (hFile=0x1c8) returned 1
	[0090.939] CloseHandle (hObject=0x1c8) returned 1
	[0090.941] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.941] SetEndOfFile (hFile=0x19c) returned 1
	[0090.947] CloseHandle (hObject=0x19c) returned 1
	[0090.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.950] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 1
	[0090.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66
	[0090.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66
	[0090.953] lstrlenW (lpString=".doc") returned 4
	[0090.953] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0090.953] lstrlenW (lpString=".docx") returned 5
	[0090.953] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1
	[0090.953] lstrlenW (lpString=".pdf") returned 4
	[0090.953] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0090.953] lstrlenW (lpString=".xls") returned 4
	[0090.953] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0090.954] lstrlenW (lpString=".xlsx") returned 5
	[0090.954] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1
	[0090.954] lstrlenW (lpString=".ppt") returned 4
	[0090.954] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0090.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66
	[0090.954] lstrlenW (lpString=".zip") returned 4
	[0090.954] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0090.954] lstrlenW (lpString=".rar") returned 4
	[0090.954] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0090.954] lstrlenW (lpString=".bz2") returned 4
	[0090.954] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0090.954] lstrlenW (lpString=".7z") returned 3
	[0090.954] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0090.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66
	[0090.954] lstrlenW (lpString=".dbf") returned 4
	[0090.954] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0090.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66
	[0090.954] lstrlenW (lpString=".1cd") returned 4
	[0090.954] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0090.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66
	[0090.954] lstrlenW (lpString=".jpg") returned 4
	[0090.954] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0090.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66
	[0090.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66
	[0090.954] lstrlenW (lpString=".doc") returned 4
	[0090.954] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0090.954] lstrlenW (lpString=".docx") returned 5
	[0090.954] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1
	[0090.954] lstrlenW (lpString=".pdf") returned 4
	[0090.954] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0090.954] lstrlenW (lpString=".xls") returned 4
	[0090.955] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0090.955] lstrlenW (lpString=".xlsx") returned 5
	[0090.955] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1
	[0090.955] lstrlenW (lpString=".ppt") returned 4
	[0090.955] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0090.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66
	[0090.955] lstrlenW (lpString=".zip") returned 4
	[0090.955] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0090.955] lstrlenW (lpString=".rar") returned 4
	[0090.955] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0090.955] lstrlenW (lpString=".bz2") returned 4
	[0090.955] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0090.955] lstrlenW (lpString=".7z") returned 3
	[0090.955] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0090.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66
	[0090.955] lstrlenW (lpString=".dbf") returned 4
	[0090.955] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0090.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66
	[0090.955] lstrlenW (lpString=".1cd") returned 4
	[0090.955] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0090.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66
	[0090.955] lstrlenW (lpString=".jpg") returned 4
	[0090.955] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0090.955] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0090.955] lstrlenW (lpString="CsiSoap.dll") returned 11
	[0090.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0090.966] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1784192) returned 1
	[0090.966] CloseHandle (hObject=0x1b8) returned 1
	[0090.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll")) returned 0x20
	[0090.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0090.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0090.988] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0090.988] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0090.988] ReadFile (in: hFile=0x1c0, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0091.433] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0091.433] ReadFile (in: hFile=0x1c0, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0091.518] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0091.518] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0091.518] ReadFile (in: hFile=0x1c0, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0091.686] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.686] WriteFile (in: hFile=0x1c0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0091.718] SetEndOfFile (hFile=0x1c0) returned 1
	[0091.751] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f60070
	[0091.756] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.756] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.764] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.764] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.767] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.767] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.771] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f60070 | out: hHeap=0x5e0000) returned 1
	[0091.771] CloseHandle (hObject=0x1c0) returned 1
	[0091.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0091.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67
	[0091.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67
	[0091.776] lstrlenW (lpString=".doc") returned 4
	[0091.776] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0091.776] lstrlenW (lpString=".docx") returned 5
	[0091.776] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0091.776] lstrlenW (lpString=".pdf") returned 4
	[0091.776] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0091.776] lstrlenW (lpString=".xls") returned 4
	[0091.776] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0091.776] lstrlenW (lpString=".xlsx") returned 5
	[0091.776] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0091.776] lstrlenW (lpString=".ppt") returned 4
	[0091.776] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0091.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67
	[0091.776] lstrlenW (lpString=".zip") returned 4
	[0091.776] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0091.776] lstrlenW (lpString=".rar") returned 4
	[0091.776] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0091.776] lstrlenW (lpString=".bz2") returned 4
	[0091.776] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0091.776] lstrlenW (lpString=".7z") returned 3
	[0091.776] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0091.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67
	[0091.776] lstrlenW (lpString=".dbf") returned 4
	[0091.776] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0091.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67
	[0091.777] lstrlenW (lpString=".1cd") returned 4
	[0091.777] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0091.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67
	[0091.777] lstrlenW (lpString=".jpg") returned 4
	[0091.777] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0091.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67
	[0091.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67
	[0091.777] lstrlenW (lpString=".doc") returned 4
	[0091.777] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0091.777] lstrlenW (lpString=".docx") returned 5
	[0091.777] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0091.777] lstrlenW (lpString=".pdf") returned 4
	[0091.777] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0091.777] lstrlenW (lpString=".xls") returned 4
	[0091.777] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0091.777] lstrlenW (lpString=".xlsx") returned 5
	[0091.777] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0091.777] lstrlenW (lpString=".ppt") returned 4
	[0091.777] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0091.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67
	[0091.777] lstrlenW (lpString=".zip") returned 4
	[0091.777] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0091.777] lstrlenW (lpString=".rar") returned 4
	[0091.777] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0091.777] lstrlenW (lpString=".bz2") returned 4
	[0091.778] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0091.778] lstrlenW (lpString=".7z") returned 3
	[0091.778] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0091.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67
	[0091.778] lstrlenW (lpString=".dbf") returned 4
	[0091.778] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0091.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67
	[0091.778] lstrlenW (lpString=".1cd") returned 4
	[0091.778] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0091.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67
	[0091.778] lstrlenW (lpString=".jpg") returned 4
	[0091.778] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0091.778] lstrcmpiW (lpString1=".EXE", lpString2=".adobe") returned 1
	[0091.778] lstrlenW (lpString="LICLUA.EXE") returned 10
	[0091.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0091.830] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=204168) returned 1
	[0091.830] CloseHandle (hObject=0x1c0) returned 1
	[0091.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 0x20
	[0091.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0091.995] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.995] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0092.043] GetLastError () returned 0x0
	[0092.043] ReadFile (in: hFile=0x1b0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x31d88, lpOverlapped=0x0) returned 1
	[0092.086] WriteFile (in: hFile=0x174, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x31d90, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x31d90, lpOverlapped=0x0) returned 1
	[0092.090] ReadFile (in: hFile=0x1b0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.090] WriteFile (in: hFile=0x174, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0092.090] SetEndOfFile (hFile=0x174) returned 1
	[0092.100] CloseHandle (hObject=0x174) returned 1
	[0092.114] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.114] SetEndOfFile (hFile=0x1b0) returned 1
	[0092.146] CloseHandle (hObject=0x1b0) returned 1
	[0092.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.162] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 1
	[0092.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66
	[0092.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66
	[0092.175] lstrlenW (lpString=".doc") returned 4
	[0092.175] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0092.175] lstrlenW (lpString=".docx") returned 5
	[0092.175] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1
	[0092.175] lstrlenW (lpString=".pdf") returned 4
	[0092.175] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0092.175] lstrlenW (lpString=".xls") returned 4
	[0092.175] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0092.175] lstrlenW (lpString=".xlsx") returned 5
	[0092.175] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1
	[0092.175] lstrlenW (lpString=".ppt") returned 4
	[0092.175] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0092.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66
	[0092.175] lstrlenW (lpString=".zip") returned 4
	[0092.175] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0092.175] lstrlenW (lpString=".rar") returned 4
	[0092.175] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0092.175] lstrlenW (lpString=".bz2") returned 4
	[0092.175] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0092.176] lstrlenW (lpString=".7z") returned 3
	[0092.176] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0092.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66
	[0092.176] lstrlenW (lpString=".dbf") returned 4
	[0092.176] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0092.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66
	[0092.176] lstrlenW (lpString=".1cd") returned 4
	[0092.176] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0092.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66
	[0092.176] lstrlenW (lpString=".jpg") returned 4
	[0092.176] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0092.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66
	[0092.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66
	[0092.176] lstrlenW (lpString=".doc") returned 4
	[0092.176] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0092.176] lstrlenW (lpString=".docx") returned 5
	[0092.177] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1
	[0092.177] lstrlenW (lpString=".pdf") returned 4
	[0092.177] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0092.177] lstrlenW (lpString=".xls") returned 4
	[0092.177] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0092.177] lstrlenW (lpString=".xlsx") returned 5
	[0092.177] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1
	[0092.177] lstrlenW (lpString=".ppt") returned 4
	[0092.177] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0092.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66
	[0092.177] lstrlenW (lpString=".zip") returned 4
	[0092.177] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0092.177] lstrlenW (lpString=".rar") returned 4
	[0092.178] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0092.178] lstrlenW (lpString=".bz2") returned 4
	[0092.178] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0092.178] lstrlenW (lpString=".7z") returned 3
	[0092.178] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0092.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66
	[0092.178] lstrlenW (lpString=".dbf") returned 4
	[0092.178] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0092.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66
	[0092.178] lstrlenW (lpString=".1cd") returned 4
	[0092.178] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0092.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66
	[0092.178] lstrlenW (lpString=".jpg") returned 4
	[0092.178] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0092.178] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0092.178] lstrlenW (lpString="MSORES.DLL") returned 10
	[0092.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0092.271] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=72521600) returned 1
	[0092.271] CloseHandle (hObject=0x184) returned 1
	[0092.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll")) returned 0x20
	[0092.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0092.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0092.327] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0092.327] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.327] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.340] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.340] ReadFile (in: hFile=0x1a0, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.450] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0092.450] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.450] ReadFile (in: hFile=0x1a0, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.534] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.534] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0092.555] SetEndOfFile (hFile=0x1a0) returned 1
	[0092.555] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f60070
	[0092.608] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0092.608] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0092.609] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0092.609] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0092.609] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0092.609] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0092.612] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f60070 | out: hHeap=0x5e0000) returned 1
	[0092.654] CloseHandle (hObject=0x1a0) returned 1
	[0092.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66
	[0092.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66
	[0092.654] lstrlenW (lpString=".doc") returned 4
	[0092.654] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.655] lstrlenW (lpString=".docx") returned 5
	[0092.655] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0092.655] lstrlenW (lpString=".pdf") returned 4
	[0092.655] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.655] lstrlenW (lpString=".xls") returned 4
	[0092.655] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.655] lstrlenW (lpString=".xlsx") returned 5
	[0092.655] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0092.655] lstrlenW (lpString=".ppt") returned 4
	[0092.655] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66
	[0092.655] lstrlenW (lpString=".zip") returned 4
	[0092.655] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.655] lstrlenW (lpString=".rar") returned 4
	[0092.655] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.655] lstrlenW (lpString=".bz2") returned 4
	[0092.655] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.655] lstrlenW (lpString=".7z") returned 3
	[0092.655] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66
	[0092.655] lstrlenW (lpString=".dbf") returned 4
	[0092.655] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66
	[0092.655] lstrlenW (lpString=".1cd") returned 4
	[0092.655] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66
	[0092.655] lstrlenW (lpString=".jpg") returned 4
	[0092.655] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66
	[0092.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66
	[0092.655] lstrlenW (lpString=".doc") returned 4
	[0092.655] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.656] lstrlenW (lpString=".docx") returned 5
	[0092.656] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0092.656] lstrlenW (lpString=".pdf") returned 4
	[0092.656] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.656] lstrlenW (lpString=".xls") returned 4
	[0092.656] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.656] lstrlenW (lpString=".xlsx") returned 5
	[0092.656] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0092.656] lstrlenW (lpString=".ppt") returned 4
	[0092.656] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66
	[0092.656] lstrlenW (lpString=".zip") returned 4
	[0092.656] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.656] lstrlenW (lpString=".rar") returned 4
	[0092.656] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.656] lstrlenW (lpString=".bz2") returned 4
	[0092.656] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.656] lstrlenW (lpString=".7z") returned 3
	[0092.656] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66
	[0092.656] lstrlenW (lpString=".dbf") returned 4
	[0092.656] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66
	[0092.656] lstrlenW (lpString=".1cd") returned 4
	[0092.656] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66
	[0092.656] lstrlenW (lpString=".jpg") returned 4
	[0092.656] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.656] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0092.657] lstrlenW (lpString="MUOPTIN.DLL") returned 11
	[0092.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0092.735] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=24976) returned 1
	[0092.735] CloseHandle (hObject=0x170) returned 1
	[0092.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 0x20
	[0092.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0092.760] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.760] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0092.772] GetLastError () returned 0x0
	[0092.772] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x6190, lpOverlapped=0x0) returned 1
	[0092.799] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x61a0, lpOverlapped=0x0) returned 1
	[0092.801] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.801] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0092.801] SetEndOfFile (hFile=0x1b8) returned 1
	[0092.801] CloseHandle (hObject=0x1b8) returned 1
	[0092.801] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.801] SetEndOfFile (hFile=0x198) returned 1
	[0092.802] CloseHandle (hObject=0x198) returned 1
	[0092.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.802] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 1
	[0092.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67
	[0092.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67
	[0092.803] lstrlenW (lpString=".doc") returned 4
	[0092.803] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.803] lstrlenW (lpString=".docx") returned 5
	[0092.803] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1
	[0092.803] lstrlenW (lpString=".pdf") returned 4
	[0092.803] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.803] lstrlenW (lpString=".xls") returned 4
	[0092.803] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.803] lstrlenW (lpString=".xlsx") returned 5
	[0092.803] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1
	[0092.803] lstrlenW (lpString=".ppt") returned 4
	[0092.803] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67
	[0092.803] lstrlenW (lpString=".zip") returned 4
	[0092.803] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.803] lstrlenW (lpString=".rar") returned 4
	[0092.803] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.803] lstrlenW (lpString=".bz2") returned 4
	[0092.803] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.803] lstrlenW (lpString=".7z") returned 3
	[0092.803] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67
	[0092.803] lstrlenW (lpString=".dbf") returned 4
	[0092.803] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67
	[0092.804] lstrlenW (lpString=".1cd") returned 4
	[0092.804] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67
	[0092.804] lstrlenW (lpString=".jpg") returned 4
	[0092.804] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67
	[0092.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67
	[0092.804] lstrlenW (lpString=".doc") returned 4
	[0092.804] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.804] lstrlenW (lpString=".docx") returned 5
	[0092.804] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1
	[0092.804] lstrlenW (lpString=".pdf") returned 4
	[0092.804] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.804] lstrlenW (lpString=".xls") returned 4
	[0092.804] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.804] lstrlenW (lpString=".xlsx") returned 5
	[0092.804] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1
	[0092.804] lstrlenW (lpString=".ppt") returned 4
	[0092.804] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67
	[0092.804] lstrlenW (lpString=".zip") returned 4
	[0092.804] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.804] lstrlenW (lpString=".rar") returned 4
	[0092.804] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.804] lstrlenW (lpString=".bz2") returned 4
	[0092.804] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.805] lstrlenW (lpString=".7z") returned 3
	[0092.805] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67
	[0092.805] lstrlenW (lpString=".dbf") returned 4
	[0092.805] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67
	[0092.805] lstrlenW (lpString=".1cd") returned 4
	[0092.805] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67
	[0092.805] lstrlenW (lpString=".jpg") returned 4
	[0092.805] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.805] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0092.805] lstrlenW (lpString="OSETUPUI.DLL") returned 12
	[0092.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0092.884] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=191872) returned 1
	[0092.884] CloseHandle (hObject=0x1a4) returned 1
	[0092.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 0x20
	[0092.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0092.910] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.910] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0092.938] GetLastError () returned 0x0
	[0092.938] ReadFile (in: hFile=0x160, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x2ed80, lpOverlapped=0x0) returned 1
	[0093.000] WriteFile (in: hFile=0x190, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2ed90, lpOverlapped=0x0) returned 1
	[0093.006] ReadFile (in: hFile=0x160, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.006] WriteFile (in: hFile=0x190, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0093.006] SetEndOfFile (hFile=0x190) returned 1
	[0093.006] CloseHandle (hObject=0x190) returned 1
	[0093.007] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.007] SetEndOfFile (hFile=0x160) returned 1
	[0093.009] CloseHandle (hObject=0x160) returned 1
	[0093.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.010] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 1
	[0093.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105
	[0093.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105
	[0093.010] lstrlenW (lpString=".doc") returned 4
	[0093.010] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.010] lstrlenW (lpString=".docx") returned 5
	[0093.010] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0093.010] lstrlenW (lpString=".pdf") returned 4
	[0093.010] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.010] lstrlenW (lpString=".xls") returned 4
	[0093.010] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.010] lstrlenW (lpString=".xlsx") returned 5
	[0093.011] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0093.011] lstrlenW (lpString=".ppt") returned 4
	[0093.011] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105
	[0093.011] lstrlenW (lpString=".zip") returned 4
	[0093.011] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.011] lstrlenW (lpString=".rar") returned 4
	[0093.011] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.011] lstrlenW (lpString=".bz2") returned 4
	[0093.011] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.011] lstrlenW (lpString=".7z") returned 3
	[0093.011] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105
	[0093.011] lstrlenW (lpString=".dbf") returned 4
	[0093.011] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105
	[0093.011] lstrlenW (lpString=".1cd") returned 4
	[0093.011] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105
	[0093.011] lstrlenW (lpString=".jpg") returned 4
	[0093.011] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105
	[0093.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105
	[0093.011] lstrlenW (lpString=".doc") returned 4
	[0093.011] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.012] lstrlenW (lpString=".docx") returned 5
	[0093.012] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0093.012] lstrlenW (lpString=".pdf") returned 4
	[0093.012] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.012] lstrlenW (lpString=".xls") returned 4
	[0093.012] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.012] lstrlenW (lpString=".xlsx") returned 5
	[0093.012] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0093.012] lstrlenW (lpString=".ppt") returned 4
	[0093.012] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105
	[0093.012] lstrlenW (lpString=".zip") returned 4
	[0093.012] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.012] lstrlenW (lpString=".rar") returned 4
	[0093.012] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.012] lstrlenW (lpString=".bz2") returned 4
	[0093.012] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.012] lstrlenW (lpString=".7z") returned 3
	[0093.012] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105
	[0093.012] lstrlenW (lpString=".dbf") returned 4
	[0093.012] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105
	[0093.012] lstrlenW (lpString=".1cd") returned 4
	[0093.012] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105
	[0093.013] lstrlenW (lpString=".jpg") returned 4
	[0093.013] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.013] lstrcmpiW (lpString1=".xrm-ms", lpString2=".adobe") returned 1
	[0093.013] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24
	[0093.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.058] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=715834) returned 1
	[0093.058] CloseHandle (hObject=0x190) returned 1
	[0093.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20
	[0093.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0093.085] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.085] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0093.101] GetLastError () returned 0x0
	[0093.101] ReadFile (in: hFile=0x160, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xaec3a, lpOverlapped=0x0) returned 1
	[0093.431] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xaec40, lpOverlapped=0x0) returned 1
	[0093.447] ReadFile (in: hFile=0x160, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.447] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x104, lpOverlapped=0x0) returned 1
	[0093.447] SetEndOfFile (hFile=0x1a0) returned 1
	[0093.447] CloseHandle (hObject=0x1a0) returned 1
	[0093.447] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.448] SetEndOfFile (hFile=0x160) returned 1
	[0093.454] CloseHandle (hObject=0x160) returned 1
	[0093.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.454] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1
	[0093.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0093.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0093.454] lstrlenW (lpString=".doc") returned 4
	[0093.454] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0093.454] lstrlenW (lpString=".docx") returned 5
	[0093.454] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0093.454] lstrlenW (lpString=".pdf") returned 4
	[0093.454] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0093.454] lstrlenW (lpString=".xls") returned 4
	[0093.454] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0093.455] lstrlenW (lpString=".xlsx") returned 5
	[0093.455] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0093.455] lstrlenW (lpString=".ppt") returned 4
	[0093.455] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0093.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0093.455] lstrlenW (lpString=".zip") returned 4
	[0093.455] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0093.455] lstrlenW (lpString=".rar") returned 4
	[0093.455] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0093.455] lstrlenW (lpString=".bz2") returned 4
	[0093.455] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0093.455] lstrlenW (lpString=".7z") returned 3
	[0093.455] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0093.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0093.455] lstrlenW (lpString=".dbf") returned 4
	[0093.455] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0093.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0093.455] lstrlenW (lpString=".1cd") returned 4
	[0093.455] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0093.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0093.455] lstrlenW (lpString=".jpg") returned 4
	[0093.455] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0093.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0093.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0093.455] lstrlenW (lpString=".doc") returned 4
	[0093.455] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0093.455] lstrlenW (lpString=".docx") returned 5
	[0093.455] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0093.455] lstrlenW (lpString=".pdf") returned 4
	[0093.455] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0093.455] lstrlenW (lpString=".xls") returned 4
	[0093.455] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0093.456] lstrlenW (lpString=".xlsx") returned 5
	[0093.456] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0093.456] lstrlenW (lpString=".ppt") returned 4
	[0093.456] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0093.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0093.456] lstrlenW (lpString=".zip") returned 4
	[0093.456] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0093.456] lstrlenW (lpString=".rar") returned 4
	[0093.456] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0093.456] lstrlenW (lpString=".bz2") returned 4
	[0093.456] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0093.456] lstrlenW (lpString=".7z") returned 3
	[0093.456] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0093.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0093.456] lstrlenW (lpString=".dbf") returned 4
	[0093.456] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0093.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0093.456] lstrlenW (lpString=".1cd") returned 4
	[0093.456] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0093.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0093.456] lstrlenW (lpString=".jpg") returned 4
	[0093.456] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0093.456] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0093.456] lstrlenW (lpString="OPTINPS.DLL") returned 11
	[0093.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0093.505] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=18336) returned 1
	[0093.505] CloseHandle (hObject=0x198) returned 1
	[0093.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll")) returned 0x20
	[0093.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0093.526] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.526] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0093.531] GetLastError () returned 0x0
	[0093.531] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x47a0, lpOverlapped=0x0) returned 1
	[0093.532] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x47b0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x47b0, lpOverlapped=0x0) returned 1
	[0093.534] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.534] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0093.534] SetEndOfFile (hFile=0x1c4) returned 1
	[0093.541] CloseHandle (hObject=0x1c4) returned 1
	[0093.544] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.544] SetEndOfFile (hFile=0x198) returned 1
	[0093.550] CloseHandle (hObject=0x198) returned 1
	[0093.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.550] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll")) returned 1
	[0093.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67
	[0093.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67
	[0093.551] lstrlenW (lpString=".doc") returned 4
	[0093.551] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.551] lstrlenW (lpString=".docx") returned 5
	[0093.551] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0093.551] lstrlenW (lpString=".pdf") returned 4
	[0093.551] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.551] lstrlenW (lpString=".xls") returned 4
	[0093.551] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.551] lstrlenW (lpString=".xlsx") returned 5
	[0093.551] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0093.551] lstrlenW (lpString=".ppt") returned 4
	[0093.551] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67
	[0093.551] lstrlenW (lpString=".zip") returned 4
	[0093.551] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.551] lstrlenW (lpString=".rar") returned 4
	[0093.551] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.551] lstrlenW (lpString=".bz2") returned 4
	[0093.551] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.551] lstrlenW (lpString=".7z") returned 3
	[0093.551] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67
	[0093.551] lstrlenW (lpString=".dbf") returned 4
	[0093.551] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67
	[0093.551] lstrlenW (lpString=".1cd") returned 4
	[0093.551] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67
	[0093.551] lstrlenW (lpString=".jpg") returned 4
	[0093.551] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67
	[0093.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67
	[0093.552] lstrlenW (lpString=".doc") returned 4
	[0093.552] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.552] lstrlenW (lpString=".docx") returned 5
	[0093.552] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0093.552] lstrlenW (lpString=".pdf") returned 4
	[0093.552] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.552] lstrlenW (lpString=".xls") returned 4
	[0093.552] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.552] lstrlenW (lpString=".xlsx") returned 5
	[0093.552] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0093.552] lstrlenW (lpString=".ppt") returned 4
	[0093.552] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67
	[0093.552] lstrlenW (lpString=".zip") returned 4
	[0093.552] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.552] lstrlenW (lpString=".rar") returned 4
	[0093.552] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.552] lstrlenW (lpString=".bz2") returned 4
	[0093.552] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.552] lstrlenW (lpString=".7z") returned 3
	[0093.552] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67
	[0093.552] lstrlenW (lpString=".dbf") returned 4
	[0093.552] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67
	[0093.552] lstrlenW (lpString=".1cd") returned 4
	[0093.552] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67
	[0093.552] lstrlenW (lpString=".jpg") returned 4
	[0093.552] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.553] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0093.553] lstrlenW (lpString="PRJRES.DLL") returned 10
	[0093.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0093.635] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=3943312) returned 1
	[0093.635] CloseHandle (hObject=0x1a0) returned 1
	[0093.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll")) returned 0x20
	[0093.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0093.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0093.710] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0093.710] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.710] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0093.762] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x140e85, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.762] ReadFile (in: hFile=0x1c4, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0093.888] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.888] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x382b90, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.888] ReadFile (in: hFile=0x1c4, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0093.993] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.994] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0094.019] SetEndOfFile (hFile=0x1c4) returned 1
	[0094.019] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x4001020
	[0094.019] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0094.019] WriteFile (in: hFile=0x1c4, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0094.021] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x140e85, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0094.021] WriteFile (in: hFile=0x1c4, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0094.023] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x382b90, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0094.023] WriteFile (in: hFile=0x1c4, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0094.025] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x4001020 | out: hHeap=0x5e0000) returned 1
	[0094.025] CloseHandle (hObject=0x1c4) returned 1
	[0094.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66
	[0094.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66
	[0094.025] lstrlenW (lpString=".doc") returned 4
	[0094.025] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.025] lstrlenW (lpString=".docx") returned 5
	[0094.025] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0094.025] lstrlenW (lpString=".pdf") returned 4
	[0094.026] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.026] lstrlenW (lpString=".xls") returned 4
	[0094.026] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.026] lstrlenW (lpString=".xlsx") returned 5
	[0094.026] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0094.026] lstrlenW (lpString=".ppt") returned 4
	[0094.026] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66
	[0094.026] lstrlenW (lpString=".zip") returned 4
	[0094.026] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.026] lstrlenW (lpString=".rar") returned 4
	[0094.026] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.026] lstrlenW (lpString=".bz2") returned 4
	[0094.026] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.026] lstrlenW (lpString=".7z") returned 3
	[0094.026] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66
	[0094.026] lstrlenW (lpString=".dbf") returned 4
	[0094.026] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66
	[0094.026] lstrlenW (lpString=".1cd") returned 4
	[0094.026] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66
	[0094.055] lstrlenW (lpString=".jpg") returned 4
	[0094.055] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66
	[0094.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66
	[0094.055] lstrlenW (lpString=".doc") returned 4
	[0094.055] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.055] lstrlenW (lpString=".docx") returned 5
	[0094.055] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0094.055] lstrlenW (lpString=".pdf") returned 4
	[0094.055] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.055] lstrlenW (lpString=".xls") returned 4
	[0094.055] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.055] lstrlenW (lpString=".xlsx") returned 5
	[0094.055] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0094.055] lstrlenW (lpString=".ppt") returned 4
	[0094.055] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66
	[0094.055] lstrlenW (lpString=".zip") returned 4
	[0094.055] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.055] lstrlenW (lpString=".rar") returned 4
	[0094.055] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.055] lstrlenW (lpString=".bz2") returned 4
	[0094.055] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.055] lstrlenW (lpString=".7z") returned 3
	[0094.056] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66
	[0094.056] lstrlenW (lpString=".dbf") returned 4
	[0094.056] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66
	[0094.056] lstrlenW (lpString=".1cd") returned 4
	[0094.056] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66
	[0094.056] lstrlenW (lpString=".jpg") returned 4
	[0094.056] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.056] lstrcmpiW (lpString1=".MOF", lpString2=".adobe") returned 1
	[0094.056] lstrlenW (lpString="OSPPWMI.MOF") returned 11
	[0094.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0094.056] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=47710) returned 1
	[0094.056] CloseHandle (hObject=0x1c4) returned 1
	[0094.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 0x20
	[0094.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0094.058] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.058] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0094.058] GetLastError () returned 0x0
	[0094.058] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xba5e, lpOverlapped=0x0) returned 1
	[0094.121] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xba60, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xba60, lpOverlapped=0x0) returned 1
	[0094.123] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.123] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0094.123] SetEndOfFile (hFile=0x188) returned 1
	[0094.123] CloseHandle (hObject=0x188) returned 1
	[0094.124] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.124] SetEndOfFile (hFile=0x1c4) returned 1
	[0094.125] CloseHandle (hObject=0x1c4) returned 1
	[0094.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.125] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 1
	[0094.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91
	[0094.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91
	[0094.125] lstrlenW (lpString=".doc") returned 4
	[0094.125] lstrcmpiW (lpString1=".doc", lpString2=".MOF") returned -1
	[0094.125] lstrlenW (lpString=".docx") returned 5
	[0094.125] lstrcmpiW (lpString1=".docx", lpString2="I.MOF") returned -1
	[0094.125] lstrlenW (lpString=".pdf") returned 4
	[0094.125] lstrcmpiW (lpString1=".pdf", lpString2=".MOF") returned 1
	[0094.125] lstrlenW (lpString=".xls") returned 4
	[0094.125] lstrcmpiW (lpString1=".xls", lpString2=".MOF") returned 1
	[0094.125] lstrlenW (lpString=".xlsx") returned 5
	[0094.125] lstrcmpiW (lpString1=".xlsx", lpString2="I.MOF") returned -1
	[0094.126] lstrlenW (lpString=".ppt") returned 4
	[0094.126] lstrcmpiW (lpString1=".ppt", lpString2=".MOF") returned 1
	[0094.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91
	[0094.126] lstrlenW (lpString=".zip") returned 4
	[0094.126] lstrcmpiW (lpString1=".zip", lpString2=".MOF") returned 1
	[0094.126] lstrlenW (lpString=".rar") returned 4
	[0094.126] lstrcmpiW (lpString1=".rar", lpString2=".MOF") returned 1
	[0094.126] lstrlenW (lpString=".bz2") returned 4
	[0094.126] lstrcmpiW (lpString1=".bz2", lpString2=".MOF") returned -1
	[0094.126] lstrlenW (lpString=".7z") returned 3
	[0094.126] lstrcmpiW (lpString1=".7z", lpString2="MOF") returned -1
	[0094.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91
	[0094.126] lstrlenW (lpString=".dbf") returned 4
	[0094.126] lstrcmpiW (lpString1=".dbf", lpString2=".MOF") returned -1
	[0094.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91
	[0094.126] lstrlenW (lpString=".1cd") returned 4
	[0094.126] lstrcmpiW (lpString1=".1cd", lpString2=".MOF") returned -1
	[0094.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91
	[0094.126] lstrlenW (lpString=".jpg") returned 4
	[0094.126] lstrcmpiW (lpString1=".jpg", lpString2=".MOF") returned -1
	[0094.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91
	[0094.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91
	[0094.126] lstrlenW (lpString=".doc") returned 4
	[0094.126] lstrcmpiW (lpString1=".doc", lpString2=".MOF") returned -1
	[0094.126] lstrlenW (lpString=".docx") returned 5
	[0094.126] lstrcmpiW (lpString1=".docx", lpString2="I.MOF") returned -1
	[0094.126] lstrlenW (lpString=".pdf") returned 4
	[0094.126] lstrcmpiW (lpString1=".pdf", lpString2=".MOF") returned 1
	[0094.126] lstrlenW (lpString=".xls") returned 4
	[0094.126] lstrcmpiW (lpString1=".xls", lpString2=".MOF") returned 1
	[0094.126] lstrlenW (lpString=".xlsx") returned 5
	[0094.126] lstrcmpiW (lpString1=".xlsx", lpString2="I.MOF") returned -1
	[0094.126] lstrlenW (lpString=".ppt") returned 4
	[0094.127] lstrcmpiW (lpString1=".ppt", lpString2=".MOF") returned 1
	[0094.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91
	[0094.127] lstrlenW (lpString=".zip") returned 4
	[0094.127] lstrcmpiW (lpString1=".zip", lpString2=".MOF") returned 1
	[0094.127] lstrlenW (lpString=".rar") returned 4
	[0094.127] lstrcmpiW (lpString1=".rar", lpString2=".MOF") returned 1
	[0094.127] lstrlenW (lpString=".bz2") returned 4
	[0094.127] lstrcmpiW (lpString1=".bz2", lpString2=".MOF") returned -1
	[0094.127] lstrlenW (lpString=".7z") returned 3
	[0094.127] lstrcmpiW (lpString1=".7z", lpString2="MOF") returned -1
	[0094.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91
	[0094.127] lstrlenW (lpString=".dbf") returned 4
	[0094.127] lstrcmpiW (lpString1=".dbf", lpString2=".MOF") returned -1
	[0094.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91
	[0094.127] lstrlenW (lpString=".1cd") returned 4
	[0094.127] lstrcmpiW (lpString1=".1cd", lpString2=".MOF") returned -1
	[0094.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91
	[0094.127] lstrlenW (lpString=".jpg") returned 4
	[0094.127] lstrcmpiW (lpString1=".jpg", lpString2=".MOF") returned -1
	[0094.127] lstrcmpiW (lpString1=".LEX", lpString2=".adobe") returned 1
	[0094.127] lstrlenW (lpString="MSWDS_EN.LEX") returned 12
	[0094.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0094.215] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=444027) returned 1
	[0094.216] CloseHandle (hObject=0x1c4) returned 1
	[0094.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex")) returned 0x20
	[0094.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0094.241] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.241] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0094.283] GetLastError () returned 0x0
	[0094.283] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x6c67b, lpOverlapped=0x0) returned 1
	[0094.391] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6c680, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x6c680, lpOverlapped=0x0) returned 1
	[0094.398] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.398] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0094.399] SetEndOfFile (hFile=0x1a4) returned 1
	[0094.399] CloseHandle (hObject=0x1a4) returned 1
	[0094.399] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.399] SetEndOfFile (hFile=0x1a0) returned 1
	[0094.405] CloseHandle (hObject=0x1a0) returned 1
	[0094.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.406] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex")) returned 1
	[0094.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65
	[0094.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65
	[0094.406] lstrlenW (lpString=".doc") returned 4
	[0094.406] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1
	[0094.406] lstrlenW (lpString=".docx") returned 5
	[0094.406] lstrcmpiW (lpString1=".docx", lpString2="N.LEX") returned -1
	[0094.406] lstrlenW (lpString=".pdf") returned 4
	[0094.406] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1
	[0094.406] lstrlenW (lpString=".xls") returned 4
	[0094.406] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1
	[0094.406] lstrlenW (lpString=".xlsx") returned 5
	[0094.406] lstrcmpiW (lpString1=".xlsx", lpString2="N.LEX") returned -1
	[0094.406] lstrlenW (lpString=".ppt") returned 4
	[0094.406] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1
	[0094.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65
	[0094.406] lstrlenW (lpString=".zip") returned 4
	[0094.406] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1
	[0094.406] lstrlenW (lpString=".rar") returned 4
	[0094.407] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1
	[0094.407] lstrlenW (lpString=".bz2") returned 4
	[0094.407] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1
	[0094.407] lstrlenW (lpString=".7z") returned 3
	[0094.407] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1
	[0094.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65
	[0094.407] lstrlenW (lpString=".dbf") returned 4
	[0094.407] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1
	[0094.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65
	[0094.407] lstrlenW (lpString=".1cd") returned 4
	[0094.407] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1
	[0094.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65
	[0094.407] lstrlenW (lpString=".jpg") returned 4
	[0094.407] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1
	[0094.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65
	[0094.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65
	[0094.407] lstrlenW (lpString=".doc") returned 4
	[0094.407] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1
	[0094.407] lstrlenW (lpString=".docx") returned 5
	[0094.407] lstrcmpiW (lpString1=".docx", lpString2="N.LEX") returned -1
	[0094.407] lstrlenW (lpString=".pdf") returned 4
	[0094.407] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1
	[0094.407] lstrlenW (lpString=".xls") returned 4
	[0094.407] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1
	[0094.407] lstrlenW (lpString=".xlsx") returned 5
	[0094.407] lstrcmpiW (lpString1=".xlsx", lpString2="N.LEX") returned -1
	[0094.407] lstrlenW (lpString=".ppt") returned 4
	[0094.407] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1
	[0094.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65
	[0094.407] lstrlenW (lpString=".zip") returned 4
	[0094.407] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1
	[0094.407] lstrlenW (lpString=".rar") returned 4
	[0094.408] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1
	[0094.408] lstrlenW (lpString=".bz2") returned 4
	[0094.408] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1
	[0094.408] lstrlenW (lpString=".7z") returned 3
	[0094.408] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1
	[0094.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65
	[0094.408] lstrlenW (lpString=".dbf") returned 4
	[0094.408] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1
	[0094.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65
	[0094.408] lstrlenW (lpString=".1cd") returned 4
	[0094.408] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1
	[0094.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65
	[0094.408] lstrlenW (lpString=".jpg") returned 4
	[0094.408] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1
	[0094.408] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0094.408] lstrlenW (lpString="FPLACE.DLL") returned 10
	[0094.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0094.422] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=181120) returned 1
	[0094.422] CloseHandle (hObject=0x184) returned 1
	[0094.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll")) returned 0x20
	[0094.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0094.477] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.477] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0094.495] GetLastError () returned 0x0
	[0094.495] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x2c380, lpOverlapped=0x0) returned 1
	[0094.534] WriteFile (in: hFile=0x190, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2c390, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2c390, lpOverlapped=0x0) returned 1
	[0094.538] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.538] WriteFile (in: hFile=0x190, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0094.538] SetEndOfFile (hFile=0x190) returned 1
	[0094.541] CloseHandle (hObject=0x190) returned 1
	[0094.541] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.541] SetEndOfFile (hFile=0x1a4) returned 1
	[0094.549] CloseHandle (hObject=0x1a4) returned 1
	[0094.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.550] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll")) returned 1
	[0094.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67
	[0094.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67
	[0094.553] lstrlenW (lpString=".doc") returned 4
	[0094.553] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.553] lstrlenW (lpString=".docx") returned 5
	[0094.553] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1
	[0094.553] lstrlenW (lpString=".pdf") returned 4
	[0094.553] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.553] lstrlenW (lpString=".xls") returned 4
	[0094.553] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.553] lstrlenW (lpString=".xlsx") returned 5
	[0094.553] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1
	[0094.553] lstrlenW (lpString=".ppt") returned 4
	[0094.553] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67
	[0094.553] lstrlenW (lpString=".zip") returned 4
	[0094.553] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.553] lstrlenW (lpString=".rar") returned 4
	[0094.553] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.553] lstrlenW (lpString=".bz2") returned 4
	[0094.553] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.553] lstrlenW (lpString=".7z") returned 3
	[0094.553] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67
	[0094.553] lstrlenW (lpString=".dbf") returned 4
	[0094.553] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67
	[0094.553] lstrlenW (lpString=".1cd") returned 4
	[0094.553] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67
	[0094.554] lstrlenW (lpString=".jpg") returned 4
	[0094.554] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67
	[0094.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67
	[0094.554] lstrlenW (lpString=".doc") returned 4
	[0094.554] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.554] lstrlenW (lpString=".docx") returned 5
	[0094.554] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1
	[0094.554] lstrlenW (lpString=".pdf") returned 4
	[0094.554] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.554] lstrlenW (lpString=".xls") returned 4
	[0094.554] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.554] lstrlenW (lpString=".xlsx") returned 5
	[0094.554] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1
	[0094.554] lstrlenW (lpString=".ppt") returned 4
	[0094.554] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67
	[0094.554] lstrlenW (lpString=".zip") returned 4
	[0094.554] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.554] lstrlenW (lpString=".rar") returned 4
	[0094.554] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.554] lstrlenW (lpString=".bz2") returned 4
	[0094.554] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.555] lstrlenW (lpString=".7z") returned 3
	[0094.555] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67
	[0094.555] lstrlenW (lpString=".dbf") returned 4
	[0094.555] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67
	[0094.555] lstrlenW (lpString=".1cd") returned 4
	[0094.555] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67
	[0094.555] lstrlenW (lpString=".jpg") returned 4
	[0094.555] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.555] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0094.555] lstrlenW (lpString="METCONV.DLL") returned 11
	[0094.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0094.576] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=110976) returned 1
	[0094.576] CloseHandle (hObject=0x1a8) returned 1
	[0094.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll")) returned 0x20
	[0094.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0094.617] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.617] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0094.640] GetLastError () returned 0x0
	[0094.641] ReadFile (in: hFile=0x1b8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1b180, lpOverlapped=0x0) returned 1
	[0094.651] WriteFile (in: hFile=0x194, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1b190, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1b190, lpOverlapped=0x0) returned 1
	[0094.654] ReadFile (in: hFile=0x1b8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.654] WriteFile (in: hFile=0x194, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0094.654] SetEndOfFile (hFile=0x194) returned 1
	[0094.662] CloseHandle (hObject=0x194) returned 1
	[0094.664] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.664] SetEndOfFile (hFile=0x1b8) returned 1
	[0094.670] CloseHandle (hObject=0x1b8) returned 1
	[0094.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.674] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll")) returned 1
	[0094.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68
	[0094.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68
	[0094.678] lstrlenW (lpString=".doc") returned 4
	[0094.678] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.678] lstrlenW (lpString=".docx") returned 5
	[0094.678] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1
	[0094.678] lstrlenW (lpString=".pdf") returned 4
	[0094.678] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.678] lstrlenW (lpString=".xls") returned 4
	[0094.678] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.678] lstrlenW (lpString=".xlsx") returned 5
	[0094.678] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1
	[0094.678] lstrlenW (lpString=".ppt") returned 4
	[0094.678] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68
	[0094.678] lstrlenW (lpString=".zip") returned 4
	[0094.678] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.678] lstrlenW (lpString=".rar") returned 4
	[0094.678] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.678] lstrlenW (lpString=".bz2") returned 4
	[0094.678] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.678] lstrlenW (lpString=".7z") returned 3
	[0094.678] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68
	[0094.678] lstrlenW (lpString=".dbf") returned 4
	[0094.678] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68
	[0094.678] lstrlenW (lpString=".1cd") returned 4
	[0094.678] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68
	[0094.678] lstrlenW (lpString=".jpg") returned 4
	[0094.678] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68
	[0094.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68
	[0094.679] lstrlenW (lpString=".doc") returned 4
	[0094.679] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.679] lstrlenW (lpString=".docx") returned 5
	[0094.679] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1
	[0094.679] lstrlenW (lpString=".pdf") returned 4
	[0094.679] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.679] lstrlenW (lpString=".xls") returned 4
	[0094.679] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.679] lstrlenW (lpString=".xlsx") returned 5
	[0094.679] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1
	[0094.679] lstrlenW (lpString=".ppt") returned 4
	[0094.680] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68
	[0094.680] lstrlenW (lpString=".zip") returned 4
	[0094.680] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.680] lstrlenW (lpString=".rar") returned 4
	[0094.680] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.680] lstrlenW (lpString=".bz2") returned 4
	[0094.680] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.680] lstrlenW (lpString=".7z") returned 3
	[0094.680] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68
	[0094.680] lstrlenW (lpString=".dbf") returned 4
	[0094.680] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68
	[0094.680] lstrlenW (lpString=".1cd") returned 4
	[0094.680] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68
	[0094.680] lstrlenW (lpString=".jpg") returned 4
	[0094.680] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.681] lstrcmpiW (lpString1=".EXE", lpString2=".adobe") returned 1
	[0094.681] lstrlenW (lpString="OSE.EXE") returned 7
	[0094.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0094.682] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=174440) returned 1
	[0094.682] CloseHandle (hObject=0x194) returned 1
	[0094.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20
	[0094.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0094.683] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.683] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0094.684] GetLastError () returned 0x0
	[0094.684] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x2a968, lpOverlapped=0x0) returned 1
	[0094.699] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2a970, lpOverlapped=0x0) returned 1
	[0094.703] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.703] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0094.703] SetEndOfFile (hFile=0x1a0) returned 1
	[0094.703] CloseHandle (hObject=0x1a0) returned 1
	[0094.704] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.704] SetEndOfFile (hFile=0x194) returned 1
	[0094.706] CloseHandle (hObject=0x194) returned 1
	[0094.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.706] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1
	[0094.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68
	[0094.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68
	[0094.707] lstrlenW (lpString=".doc") returned 4
	[0094.707] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0094.707] lstrlenW (lpString=".docx") returned 5
	[0094.707] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1
	[0094.707] lstrlenW (lpString=".pdf") returned 4
	[0094.707] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0094.707] lstrlenW (lpString=".xls") returned 4
	[0094.707] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0094.707] lstrlenW (lpString=".xlsx") returned 5
	[0094.707] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1
	[0094.707] lstrlenW (lpString=".ppt") returned 4
	[0094.707] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0094.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68
	[0094.707] lstrlenW (lpString=".zip") returned 4
	[0094.707] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0094.707] lstrlenW (lpString=".rar") returned 4
	[0094.707] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0094.707] lstrlenW (lpString=".bz2") returned 4
	[0094.707] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0094.707] lstrlenW (lpString=".7z") returned 3
	[0094.707] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0094.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68
	[0094.707] lstrlenW (lpString=".dbf") returned 4
	[0094.708] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0094.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68
	[0094.708] lstrlenW (lpString=".1cd") returned 4
	[0094.708] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0094.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68
	[0094.708] lstrlenW (lpString=".jpg") returned 4
	[0094.708] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0094.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68
	[0094.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68
	[0094.708] lstrlenW (lpString=".doc") returned 4
	[0094.708] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0094.708] lstrlenW (lpString=".docx") returned 5
	[0094.708] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1
	[0094.708] lstrlenW (lpString=".pdf") returned 4
	[0094.708] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0094.708] lstrlenW (lpString=".xls") returned 4
	[0094.708] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0094.708] lstrlenW (lpString=".xlsx") returned 5
	[0094.708] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1
	[0094.708] lstrlenW (lpString=".ppt") returned 4
	[0094.708] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0094.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68
	[0094.708] lstrlenW (lpString=".zip") returned 4
	[0094.708] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0094.708] lstrlenW (lpString=".rar") returned 4
	[0094.708] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0094.709] lstrlenW (lpString=".bz2") returned 4
	[0094.709] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0094.709] lstrlenW (lpString=".7z") returned 3
	[0094.709] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0094.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68
	[0094.709] lstrlenW (lpString=".dbf") returned 4
	[0094.709] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0094.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68
	[0094.709] lstrlenW (lpString=".1cd") returned 4
	[0094.709] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0094.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68
	[0094.709] lstrlenW (lpString=".jpg") returned 4
	[0094.709] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0094.709] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0094.709] lstrlenW (lpString="MSCONV97.DLL") returned 12
	[0094.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0094.710] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=146808) returned 1
	[0094.710] CloseHandle (hObject=0x194) returned 1
	[0094.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll")) returned 0x20
	[0094.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0094.711] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.711] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0094.716] GetLastError () returned 0x0
	[0094.716] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x23d78, lpOverlapped=0x0) returned 1
	[0094.734] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x23d80, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x23d80, lpOverlapped=0x0) returned 1
	[0094.738] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.738] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0094.738] SetEndOfFile (hFile=0x1b8) returned 1
	[0094.738] CloseHandle (hObject=0x1b8) returned 1
	[0094.738] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.739] SetEndOfFile (hFile=0x194) returned 1
	[0094.740] CloseHandle (hObject=0x194) returned 1
	[0094.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.741] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll")) returned 1
	[0094.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68
	[0094.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68
	[0094.741] lstrlenW (lpString=".doc") returned 4
	[0094.741] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.741] lstrlenW (lpString=".docx") returned 5
	[0094.741] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1
	[0094.741] lstrlenW (lpString=".pdf") returned 4
	[0094.741] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.741] lstrlenW (lpString=".xls") returned 4
	[0094.741] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.741] lstrlenW (lpString=".xlsx") returned 5
	[0094.741] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1
	[0094.741] lstrlenW (lpString=".ppt") returned 4
	[0094.741] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68
	[0094.742] lstrlenW (lpString=".zip") returned 4
	[0094.742] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.742] lstrlenW (lpString=".rar") returned 4
	[0094.742] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.742] lstrlenW (lpString=".bz2") returned 4
	[0094.742] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.742] lstrlenW (lpString=".7z") returned 3
	[0094.742] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68
	[0094.742] lstrlenW (lpString=".dbf") returned 4
	[0094.742] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68
	[0094.742] lstrlenW (lpString=".1cd") returned 4
	[0094.742] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68
	[0094.742] lstrlenW (lpString=".jpg") returned 4
	[0094.742] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68
	[0094.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68
	[0094.742] lstrlenW (lpString=".doc") returned 4
	[0094.742] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.742] lstrlenW (lpString=".docx") returned 5
	[0094.742] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1
	[0094.742] lstrlenW (lpString=".pdf") returned 4
	[0094.742] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.742] lstrlenW (lpString=".xls") returned 4
	[0094.742] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.743] lstrlenW (lpString=".xlsx") returned 5
	[0094.743] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1
	[0094.743] lstrlenW (lpString=".ppt") returned 4
	[0094.743] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68
	[0094.743] lstrlenW (lpString=".zip") returned 4
	[0094.743] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.743] lstrlenW (lpString=".rar") returned 4
	[0094.743] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.743] lstrlenW (lpString=".bz2") returned 4
	[0094.743] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.743] lstrlenW (lpString=".7z") returned 3
	[0094.743] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68
	[0094.743] lstrlenW (lpString=".dbf") returned 4
	[0094.743] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68
	[0094.743] lstrlenW (lpString=".1cd") returned 4
	[0094.743] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68
	[0094.743] lstrlenW (lpString=".jpg") returned 4
	[0094.743] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.743] lstrcmpiW (lpString1=".CNV", lpString2=".adobe") returned 1
	[0094.744] lstrlenW (lpString="RECOVR32.CNV") returned 12
	[0094.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0094.744] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=36712) returned 1
	[0094.744] CloseHandle (hObject=0x194) returned 1
	[0094.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv")) returned 0x20
	[0094.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0094.745] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.745] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0094.746] GetLastError () returned 0x0
	[0094.746] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x8f68, lpOverlapped=0x0) returned 1
	[0094.749] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x8f70, lpOverlapped=0x0) returned 1
	[0094.751] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.751] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0094.751] SetEndOfFile (hFile=0x1b8) returned 1
	[0094.751] CloseHandle (hObject=0x1b8) returned 1
	[0094.751] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.752] SetEndOfFile (hFile=0x194) returned 1
	[0094.753] CloseHandle (hObject=0x194) returned 1
	[0094.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.753] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv")) returned 1
	[0094.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68
	[0094.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68
	[0094.753] lstrlenW (lpString=".doc") returned 4
	[0094.753] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1
	[0094.753] lstrlenW (lpString=".docx") returned 5
	[0094.754] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1
	[0094.754] lstrlenW (lpString=".pdf") returned 4
	[0094.754] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1
	[0094.754] lstrlenW (lpString=".xls") returned 4
	[0094.754] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1
	[0094.754] lstrlenW (lpString=".xlsx") returned 5
	[0094.754] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1
	[0094.754] lstrlenW (lpString=".ppt") returned 4
	[0094.754] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1
	[0094.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68
	[0094.754] lstrlenW (lpString=".zip") returned 4
	[0094.754] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1
	[0094.754] lstrlenW (lpString=".rar") returned 4
	[0094.754] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1
	[0094.754] lstrlenW (lpString=".bz2") returned 4
	[0094.754] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1
	[0094.754] lstrlenW (lpString=".7z") returned 3
	[0094.754] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1
	[0094.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68
	[0094.754] lstrlenW (lpString=".dbf") returned 4
	[0094.754] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1
	[0094.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68
	[0094.754] lstrlenW (lpString=".1cd") returned 4
	[0094.754] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1
	[0094.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68
	[0094.754] lstrlenW (lpString=".jpg") returned 4
	[0094.754] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1
	[0094.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68
	[0094.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68
	[0094.755] lstrlenW (lpString=".doc") returned 4
	[0094.755] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1
	[0094.755] lstrlenW (lpString=".docx") returned 5
	[0094.755] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1
	[0094.755] lstrlenW (lpString=".pdf") returned 4
	[0094.755] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1
	[0094.755] lstrlenW (lpString=".xls") returned 4
	[0094.755] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1
	[0094.755] lstrlenW (lpString=".xlsx") returned 5
	[0094.755] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1
	[0094.755] lstrlenW (lpString=".ppt") returned 4
	[0094.755] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1
	[0094.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68
	[0094.755] lstrlenW (lpString=".zip") returned 4
	[0094.755] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1
	[0094.755] lstrlenW (lpString=".rar") returned 4
	[0094.755] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1
	[0094.755] lstrlenW (lpString=".bz2") returned 4
	[0094.755] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1
	[0094.755] lstrlenW (lpString=".7z") returned 3
	[0094.755] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1
	[0094.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68
	[0094.755] lstrlenW (lpString=".dbf") returned 4
	[0094.755] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1
	[0094.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68
	[0094.755] lstrlenW (lpString=".1cd") returned 4
	[0094.755] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1
	[0094.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68
	[0094.756] lstrlenW (lpString=".jpg") returned 4
	[0094.756] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1
	[0094.756] lstrcmpiW (lpString1=".cnv", lpString2=".adobe") returned 1
	[0094.756] lstrlenW (lpString="Wks9Pxy.cnv") returned 11
	[0094.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0094.757] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=57248) returned 1
	[0094.757] CloseHandle (hObject=0x194) returned 1
	[0094.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 0x20
	[0094.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0094.759] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.759] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0094.760] GetLastError () returned 0x0
	[0094.760] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xdfa0, lpOverlapped=0x0) returned 1
	[0094.842] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xdfb0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xdfb0, lpOverlapped=0x0) returned 1
	[0094.845] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.845] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0094.845] SetEndOfFile (hFile=0x1b8) returned 1
	[0094.845] CloseHandle (hObject=0x1b8) returned 1
	[0094.846] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.846] SetEndOfFile (hFile=0x194) returned 1
	[0094.847] CloseHandle (hObject=0x194) returned 1
	[0094.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.847] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 1
	[0094.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67
	[0094.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67
	[0094.848] lstrlenW (lpString=".doc") returned 4
	[0094.848] lstrcmpiW (lpString1=".doc", lpString2=".cnv") returned 1
	[0094.848] lstrlenW (lpString=".docx") returned 5
	[0094.848] lstrcmpiW (lpString1=".docx", lpString2="y.cnv") returned -1
	[0094.848] lstrlenW (lpString=".pdf") returned 4
	[0094.848] lstrcmpiW (lpString1=".pdf", lpString2=".cnv") returned 1
	[0094.848] lstrlenW (lpString=".xls") returned 4
	[0094.848] lstrcmpiW (lpString1=".xls", lpString2=".cnv") returned 1
	[0094.848] lstrlenW (lpString=".xlsx") returned 5
	[0094.848] lstrcmpiW (lpString1=".xlsx", lpString2="y.cnv") returned -1
	[0094.848] lstrlenW (lpString=".ppt") returned 4
	[0094.848] lstrcmpiW (lpString1=".ppt", lpString2=".cnv") returned 1
	[0094.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67
	[0094.848] lstrlenW (lpString=".zip") returned 4
	[0094.848] lstrcmpiW (lpString1=".zip", lpString2=".cnv") returned 1
	[0094.848] lstrlenW (lpString=".rar") returned 4
	[0094.848] lstrcmpiW (lpString1=".rar", lpString2=".cnv") returned 1
	[0094.848] lstrlenW (lpString=".bz2") returned 4
	[0094.848] lstrcmpiW (lpString1=".bz2", lpString2=".cnv") returned -1
	[0094.848] lstrlenW (lpString=".7z") returned 3
	[0094.848] lstrcmpiW (lpString1=".7z", lpString2="cnv") returned -1
	[0094.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67
	[0094.849] lstrlenW (lpString=".dbf") returned 4
	[0094.849] lstrcmpiW (lpString1=".dbf", lpString2=".cnv") returned 1
	[0094.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67
	[0094.849] lstrlenW (lpString=".1cd") returned 4
	[0094.849] lstrcmpiW (lpString1=".1cd", lpString2=".cnv") returned -1
	[0094.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67
	[0094.849] lstrlenW (lpString=".jpg") returned 4
	[0094.849] lstrcmpiW (lpString1=".jpg", lpString2=".cnv") returned 1
	[0094.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67
	[0094.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67
	[0094.849] lstrlenW (lpString=".doc") returned 4
	[0094.849] lstrcmpiW (lpString1=".doc", lpString2=".cnv") returned 1
	[0094.849] lstrlenW (lpString=".docx") returned 5
	[0094.849] lstrcmpiW (lpString1=".docx", lpString2="y.cnv") returned -1
	[0094.849] lstrlenW (lpString=".pdf") returned 4
	[0094.849] lstrcmpiW (lpString1=".pdf", lpString2=".cnv") returned 1
	[0094.849] lstrlenW (lpString=".xls") returned 4
	[0094.849] lstrcmpiW (lpString1=".xls", lpString2=".cnv") returned 1
	[0094.849] lstrlenW (lpString=".xlsx") returned 5
	[0094.849] lstrcmpiW (lpString1=".xlsx", lpString2="y.cnv") returned -1
	[0094.849] lstrlenW (lpString=".ppt") returned 4
	[0094.849] lstrcmpiW (lpString1=".ppt", lpString2=".cnv") returned 1
	[0094.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67
	[0094.849] lstrlenW (lpString=".zip") returned 4
	[0094.849] lstrcmpiW (lpString1=".zip", lpString2=".cnv") returned 1
	[0094.849] lstrlenW (lpString=".rar") returned 4
	[0094.849] lstrcmpiW (lpString1=".rar", lpString2=".cnv") returned 1
	[0094.850] lstrlenW (lpString=".bz2") returned 4
	[0094.850] lstrcmpiW (lpString1=".bz2", lpString2=".cnv") returned -1
	[0094.850] lstrlenW (lpString=".7z") returned 3
	[0094.850] lstrcmpiW (lpString1=".7z", lpString2="cnv") returned -1
	[0094.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67
	[0094.850] lstrlenW (lpString=".dbf") returned 4
	[0094.850] lstrcmpiW (lpString1=".dbf", lpString2=".cnv") returned 1
	[0094.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67
	[0094.850] lstrlenW (lpString=".1cd") returned 4
	[0094.850] lstrcmpiW (lpString1=".1cd", lpString2=".cnv") returned -1
	[0094.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67
	[0094.850] lstrlenW (lpString=".jpg") returned 4
	[0094.850] lstrcmpiW (lpString1=".jpg", lpString2=".cnv") returned 1
	[0094.850] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0094.850] lstrlenW (lpString="AFTRNOON.ELM") returned 12
	[0094.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0094.923] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=58766) returned 1
	[0094.923] CloseHandle (hObject=0x1a0) returned 1
	[0094.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 0x20
	[0094.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.051] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.051] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0095.164] GetLastError () returned 0x0
	[0095.164] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xe58e, lpOverlapped=0x0) returned 1
	[0095.186] WriteFile (in: hFile=0x1cc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe590, lpOverlapped=0x0) returned 1
	[0095.188] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.188] WriteFile (in: hFile=0x1cc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.188] SetEndOfFile (hFile=0x1cc) returned 1
	[0095.188] CloseHandle (hObject=0x1cc) returned 1
	[0095.189] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.189] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.190] CloseHandle (hObject=0x1a8) returned 1
	[0095.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.190] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 1
	[0095.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77
	[0095.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77
	[0095.191] lstrlenW (lpString=".doc") returned 4
	[0095.191] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.191] lstrlenW (lpString=".docx") returned 5
	[0095.191] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1
	[0095.191] lstrlenW (lpString=".pdf") returned 4
	[0095.191] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.191] lstrlenW (lpString=".xls") returned 4
	[0095.191] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.191] lstrlenW (lpString=".xlsx") returned 5
	[0095.191] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1
	[0095.191] lstrlenW (lpString=".ppt") returned 4
	[0095.191] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77
	[0095.191] lstrlenW (lpString=".zip") returned 4
	[0095.191] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.191] lstrlenW (lpString=".rar") returned 4
	[0095.191] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.191] lstrlenW (lpString=".bz2") returned 4
	[0095.192] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.192] lstrlenW (lpString=".7z") returned 3
	[0095.192] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77
	[0095.192] lstrlenW (lpString=".dbf") returned 4
	[0095.192] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77
	[0095.192] lstrlenW (lpString=".1cd") returned 4
	[0095.192] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77
	[0095.192] lstrlenW (lpString=".jpg") returned 4
	[0095.192] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77
	[0095.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77
	[0095.192] lstrlenW (lpString=".doc") returned 4
	[0095.192] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.192] lstrlenW (lpString=".docx") returned 5
	[0095.192] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1
	[0095.192] lstrlenW (lpString=".pdf") returned 4
	[0095.192] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.192] lstrlenW (lpString=".xls") returned 4
	[0095.192] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.192] lstrlenW (lpString=".xlsx") returned 5
	[0095.192] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1
	[0095.192] lstrlenW (lpString=".ppt") returned 4
	[0095.192] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77
	[0095.192] lstrlenW (lpString=".zip") returned 4
	[0095.192] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.193] lstrlenW (lpString=".rar") returned 4
	[0095.193] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.193] lstrlenW (lpString=".bz2") returned 4
	[0095.193] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.193] lstrlenW (lpString=".7z") returned 3
	[0095.193] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77
	[0095.193] lstrlenW (lpString=".dbf") returned 4
	[0095.193] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77
	[0095.193] lstrlenW (lpString=".1cd") returned 4
	[0095.193] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77
	[0095.193] lstrlenW (lpString=".jpg") returned 4
	[0095.193] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.193] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.193] lstrlenW (lpString="CANYON.INF") returned 10
	[0095.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0095.226] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=465) returned 1
	[0095.227] CloseHandle (hObject=0x198) returned 1
	[0095.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf")) returned 0x20
	[0095.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0095.227] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.227] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.228] GetLastError () returned 0x0
	[0095.228] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1d1, lpOverlapped=0x0) returned 1
	[0095.229] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1e0, lpOverlapped=0x0) returned 1
	[0095.230] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.230] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0095.230] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.230] CloseHandle (hObject=0x1c8) returned 1
	[0095.231] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.231] SetEndOfFile (hFile=0x198) returned 1
	[0095.231] CloseHandle (hObject=0x198) returned 1
	[0095.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.232] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf")) returned 1
	[0095.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73
	[0095.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73
	[0095.232] lstrlenW (lpString=".doc") returned 4
	[0095.232] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.232] lstrlenW (lpString=".docx") returned 5
	[0095.232] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1
	[0095.232] lstrlenW (lpString=".pdf") returned 4
	[0095.232] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.232] lstrlenW (lpString=".xls") returned 4
	[0095.232] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.232] lstrlenW (lpString=".xlsx") returned 5
	[0095.232] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1
	[0095.232] lstrlenW (lpString=".ppt") returned 4
	[0095.232] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73
	[0095.232] lstrlenW (lpString=".zip") returned 4
	[0095.232] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.232] lstrlenW (lpString=".rar") returned 4
	[0095.232] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.232] lstrlenW (lpString=".bz2") returned 4
	[0095.232] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.233] lstrlenW (lpString=".7z") returned 3
	[0095.233] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73
	[0095.233] lstrlenW (lpString=".dbf") returned 4
	[0095.233] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73
	[0095.233] lstrlenW (lpString=".1cd") returned 4
	[0095.233] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73
	[0095.233] lstrlenW (lpString=".jpg") returned 4
	[0095.233] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73
	[0095.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73
	[0095.233] lstrlenW (lpString=".doc") returned 4
	[0095.233] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.233] lstrlenW (lpString=".docx") returned 5
	[0095.233] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1
	[0095.233] lstrlenW (lpString=".pdf") returned 4
	[0095.233] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.233] lstrlenW (lpString=".xls") returned 4
	[0095.233] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.233] lstrlenW (lpString=".xlsx") returned 5
	[0095.233] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1
	[0095.233] lstrlenW (lpString=".ppt") returned 4
	[0095.233] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73
	[0095.233] lstrlenW (lpString=".zip") returned 4
	[0095.233] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.233] lstrlenW (lpString=".rar") returned 4
	[0095.233] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.233] lstrlenW (lpString=".bz2") returned 4
	[0095.233] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.233] lstrlenW (lpString=".7z") returned 3
	[0095.234] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73
	[0095.234] lstrlenW (lpString=".dbf") returned 4
	[0095.234] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73
	[0095.234] lstrlenW (lpString=".1cd") returned 4
	[0095.234] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73
	[0095.234] lstrlenW (lpString=".jpg") returned 4
	[0095.234] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.234] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.234] lstrlenW (lpString="CASCADE.INF") returned 11
	[0095.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0095.234] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=610) returned 1
	[0095.234] CloseHandle (hObject=0x198) returned 1
	[0095.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf")) returned 0x20
	[0095.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0095.235] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.235] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.236] GetLastError () returned 0x0
	[0095.236] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x262, lpOverlapped=0x0) returned 1
	[0095.236] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x270, lpOverlapped=0x0) returned 1
	[0095.237] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.237] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.238] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.238] CloseHandle (hObject=0x1c8) returned 1
	[0095.238] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.238] SetEndOfFile (hFile=0x198) returned 1
	[0095.239] CloseHandle (hObject=0x198) returned 1
	[0095.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.239] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf")) returned 1
	[0095.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75
	[0095.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75
	[0095.239] lstrlenW (lpString=".doc") returned 4
	[0095.239] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.240] lstrlenW (lpString=".docx") returned 5
	[0095.240] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.240] lstrlenW (lpString=".pdf") returned 4
	[0095.240] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.240] lstrlenW (lpString=".xls") returned 4
	[0095.240] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.240] lstrlenW (lpString=".xlsx") returned 5
	[0095.240] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.240] lstrlenW (lpString=".ppt") returned 4
	[0095.240] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75
	[0095.240] lstrlenW (lpString=".zip") returned 4
	[0095.240] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.240] lstrlenW (lpString=".rar") returned 4
	[0095.240] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.240] lstrlenW (lpString=".bz2") returned 4
	[0095.240] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.240] lstrlenW (lpString=".7z") returned 3
	[0095.240] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75
	[0095.240] lstrlenW (lpString=".dbf") returned 4
	[0095.240] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75
	[0095.240] lstrlenW (lpString=".1cd") returned 4
	[0095.240] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75
	[0095.240] lstrlenW (lpString=".jpg") returned 4
	[0095.240] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75
	[0095.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75
	[0095.241] lstrlenW (lpString=".doc") returned 4
	[0095.241] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.241] lstrlenW (lpString=".docx") returned 5
	[0095.241] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.241] lstrlenW (lpString=".pdf") returned 4
	[0095.241] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.241] lstrlenW (lpString=".xls") returned 4
	[0095.241] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.241] lstrlenW (lpString=".xlsx") returned 5
	[0095.241] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.241] lstrlenW (lpString=".ppt") returned 4
	[0095.241] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75
	[0095.241] lstrlenW (lpString=".zip") returned 4
	[0095.241] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.241] lstrlenW (lpString=".rar") returned 4
	[0095.241] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.241] lstrlenW (lpString=".bz2") returned 4
	[0095.241] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.241] lstrlenW (lpString=".7z") returned 3
	[0095.241] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75
	[0095.241] lstrlenW (lpString=".dbf") returned 4
	[0095.241] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75
	[0095.241] lstrlenW (lpString=".1cd") returned 4
	[0095.241] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75
	[0095.241] lstrlenW (lpString=".jpg") returned 4
	[0095.241] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.242] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.242] lstrlenW (lpString="COMPASS.ELM") returned 11
	[0095.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.256] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=54803) returned 1
	[0095.256] CloseHandle (hObject=0x1a0) returned 1
	[0095.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm")) returned 0x20
	[0095.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.276] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.276] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.309] GetLastError () returned 0x0
	[0095.309] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xd613, lpOverlapped=0x0) returned 1
	[0095.335] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xd620, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xd620, lpOverlapped=0x0) returned 1
	[0095.336] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.337] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.337] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.337] CloseHandle (hObject=0x1a8) returned 1
	[0095.337] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.337] SetEndOfFile (hFile=0x188) returned 1
	[0095.338] CloseHandle (hObject=0x188) returned 1
	[0095.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.338] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm")) returned 1
	[0095.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75
	[0095.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75
	[0095.339] lstrlenW (lpString=".doc") returned 4
	[0095.339] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.339] lstrlenW (lpString=".docx") returned 5
	[0095.339] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1
	[0095.339] lstrlenW (lpString=".pdf") returned 4
	[0095.339] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.339] lstrlenW (lpString=".xls") returned 4
	[0095.339] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.339] lstrlenW (lpString=".xlsx") returned 5
	[0095.339] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1
	[0095.339] lstrlenW (lpString=".ppt") returned 4
	[0095.339] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75
	[0095.339] lstrlenW (lpString=".zip") returned 4
	[0095.339] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.339] lstrlenW (lpString=".rar") returned 4
	[0095.339] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.339] lstrlenW (lpString=".bz2") returned 4
	[0095.339] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.339] lstrlenW (lpString=".7z") returned 3
	[0095.339] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75
	[0095.339] lstrlenW (lpString=".dbf") returned 4
	[0095.339] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75
	[0095.339] lstrlenW (lpString=".1cd") returned 4
	[0095.340] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75
	[0095.340] lstrlenW (lpString=".jpg") returned 4
	[0095.340] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75
	[0095.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75
	[0095.340] lstrlenW (lpString=".doc") returned 4
	[0095.340] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.340] lstrlenW (lpString=".docx") returned 5
	[0095.340] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1
	[0095.340] lstrlenW (lpString=".pdf") returned 4
	[0095.340] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.340] lstrlenW (lpString=".xls") returned 4
	[0095.340] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.340] lstrlenW (lpString=".xlsx") returned 5
	[0095.340] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1
	[0095.340] lstrlenW (lpString=".ppt") returned 4
	[0095.340] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75
	[0095.340] lstrlenW (lpString=".zip") returned 4
	[0095.340] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.340] lstrlenW (lpString=".rar") returned 4
	[0095.340] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.340] lstrlenW (lpString=".bz2") returned 4
	[0095.340] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.340] lstrlenW (lpString=".7z") returned 3
	[0095.340] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75
	[0095.340] lstrlenW (lpString=".dbf") returned 4
	[0095.341] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75
	[0095.341] lstrlenW (lpString=".1cd") returned 4
	[0095.341] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75
	[0095.341] lstrlenW (lpString=".jpg") returned 4
	[0095.341] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.341] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.341] lstrlenW (lpString="DEEPBLUE.INF") returned 12
	[0095.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.342] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=569) returned 1
	[0095.342] CloseHandle (hObject=0x188) returned 1
	[0095.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf")) returned 0x20
	[0095.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.342] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.342] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.343] GetLastError () returned 0x0
	[0095.343] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x239, lpOverlapped=0x0) returned 1
	[0095.344] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x240, lpOverlapped=0x0) returned 1
	[0095.345] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.345] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.345] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.345] CloseHandle (hObject=0x1a8) returned 1
	[0095.345] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.345] SetEndOfFile (hFile=0x188) returned 1
	[0095.346] CloseHandle (hObject=0x188) returned 1
	[0095.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.346] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf")) returned 1
	[0095.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77
	[0095.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77
	[0095.347] lstrlenW (lpString=".doc") returned 4
	[0095.347] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.347] lstrlenW (lpString=".docx") returned 5
	[0095.347] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.347] lstrlenW (lpString=".pdf") returned 4
	[0095.347] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.347] lstrlenW (lpString=".xls") returned 4
	[0095.347] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.347] lstrlenW (lpString=".xlsx") returned 5
	[0095.347] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.347] lstrlenW (lpString=".ppt") returned 4
	[0095.347] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77
	[0095.347] lstrlenW (lpString=".zip") returned 4
	[0095.347] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.347] lstrlenW (lpString=".rar") returned 4
	[0095.347] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.347] lstrlenW (lpString=".bz2") returned 4
	[0095.347] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.347] lstrlenW (lpString=".7z") returned 3
	[0095.347] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77
	[0095.347] lstrlenW (lpString=".dbf") returned 4
	[0095.347] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77
	[0095.347] lstrlenW (lpString=".1cd") returned 4
	[0095.347] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77
	[0095.347] lstrlenW (lpString=".jpg") returned 4
	[0095.347] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77
	[0095.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77
	[0095.347] lstrlenW (lpString=".doc") returned 4
	[0095.348] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.348] lstrlenW (lpString=".docx") returned 5
	[0095.348] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.348] lstrlenW (lpString=".pdf") returned 4
	[0095.348] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.348] lstrlenW (lpString=".xls") returned 4
	[0095.348] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.348] lstrlenW (lpString=".xlsx") returned 5
	[0095.348] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.348] lstrlenW (lpString=".ppt") returned 4
	[0095.348] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77
	[0095.348] lstrlenW (lpString=".zip") returned 4
	[0095.348] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.348] lstrlenW (lpString=".rar") returned 4
	[0095.348] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.348] lstrlenW (lpString=".bz2") returned 4
	[0095.348] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.348] lstrlenW (lpString=".7z") returned 3
	[0095.348] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77
	[0095.348] lstrlenW (lpString=".dbf") returned 4
	[0095.348] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77
	[0095.348] lstrlenW (lpString=".1cd") returned 4
	[0095.348] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77
	[0095.348] lstrlenW (lpString=".jpg") returned 4
	[0095.348] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.348] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.349] lstrlenW (lpString="ECHO.ELM") returned 8
	[0095.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.350] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=45262) returned 1
	[0095.350] CloseHandle (hObject=0x188) returned 1
	[0095.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm")) returned 0x20
	[0095.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.351] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.351] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.351] GetLastError () returned 0x0
	[0095.351] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xb0ce, lpOverlapped=0x0) returned 1
	[0095.368] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xb0d0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xb0d0, lpOverlapped=0x0) returned 1
	[0095.369] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.369] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0095.369] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.370] CloseHandle (hObject=0x1a8) returned 1
	[0095.370] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.370] SetEndOfFile (hFile=0x188) returned 1
	[0095.371] CloseHandle (hObject=0x188) returned 1
	[0095.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.371] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm")) returned 1
	[0095.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69
	[0095.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69
	[0095.372] lstrlenW (lpString=".doc") returned 4
	[0095.372] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.372] lstrlenW (lpString=".docx") returned 5
	[0095.372] lstrcmpiW (lpString1=".docx", lpString2="O.ELM") returned -1
	[0095.372] lstrlenW (lpString=".pdf") returned 4
	[0095.372] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.372] lstrlenW (lpString=".xls") returned 4
	[0095.372] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.372] lstrlenW (lpString=".xlsx") returned 5
	[0095.372] lstrcmpiW (lpString1=".xlsx", lpString2="O.ELM") returned -1
	[0095.372] lstrlenW (lpString=".ppt") returned 4
	[0095.372] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69
	[0095.372] lstrlenW (lpString=".zip") returned 4
	[0095.372] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.372] lstrlenW (lpString=".rar") returned 4
	[0095.372] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.372] lstrlenW (lpString=".bz2") returned 4
	[0095.372] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.372] lstrlenW (lpString=".7z") returned 3
	[0095.372] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69
	[0095.372] lstrlenW (lpString=".dbf") returned 4
	[0095.372] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69
	[0095.372] lstrlenW (lpString=".1cd") returned 4
	[0095.372] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69
	[0095.372] lstrlenW (lpString=".jpg") returned 4
	[0095.372] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69
	[0095.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69
	[0095.373] lstrlenW (lpString=".doc") returned 4
	[0095.373] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.373] lstrlenW (lpString=".docx") returned 5
	[0095.373] lstrcmpiW (lpString1=".docx", lpString2="O.ELM") returned -1
	[0095.373] lstrlenW (lpString=".pdf") returned 4
	[0095.373] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.373] lstrlenW (lpString=".xls") returned 4
	[0095.373] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.373] lstrlenW (lpString=".xlsx") returned 5
	[0095.373] lstrcmpiW (lpString1=".xlsx", lpString2="O.ELM") returned -1
	[0095.373] lstrlenW (lpString=".ppt") returned 4
	[0095.373] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69
	[0095.373] lstrlenW (lpString=".zip") returned 4
	[0095.373] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.373] lstrlenW (lpString=".rar") returned 4
	[0095.373] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.373] lstrlenW (lpString=".bz2") returned 4
	[0095.373] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.373] lstrlenW (lpString=".7z") returned 3
	[0095.373] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69
	[0095.373] lstrlenW (lpString=".dbf") returned 4
	[0095.373] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69
	[0095.373] lstrlenW (lpString=".1cd") returned 4
	[0095.373] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69
	[0095.373] lstrlenW (lpString=".jpg") returned 4
	[0095.373] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.374] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.374] lstrlenW (lpString="ECLIPSE.INF") returned 11
	[0095.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.437] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=595) returned 1
	[0095.437] CloseHandle (hObject=0x1a0) returned 1
	[0095.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf")) returned 0x20
	[0095.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.437] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.438] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.438] GetLastError () returned 0x0
	[0095.438] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x253, lpOverlapped=0x0) returned 1
	[0095.439] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x260, lpOverlapped=0x0) returned 1
	[0095.440] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.440] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.440] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.440] CloseHandle (hObject=0x1c8) returned 1
	[0095.441] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.441] SetEndOfFile (hFile=0x1a0) returned 1
	[0095.442] CloseHandle (hObject=0x1a0) returned 1
	[0095.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.442] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf")) returned 1
	[0095.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75
	[0095.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75
	[0095.442] lstrlenW (lpString=".doc") returned 4
	[0095.442] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.442] lstrlenW (lpString=".docx") returned 5
	[0095.442] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.442] lstrlenW (lpString=".pdf") returned 4
	[0095.442] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.442] lstrlenW (lpString=".xls") returned 4
	[0095.442] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.442] lstrlenW (lpString=".xlsx") returned 5
	[0095.443] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.443] lstrlenW (lpString=".ppt") returned 4
	[0095.443] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75
	[0095.443] lstrlenW (lpString=".zip") returned 4
	[0095.443] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.443] lstrlenW (lpString=".rar") returned 4
	[0095.443] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.443] lstrlenW (lpString=".bz2") returned 4
	[0095.443] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.443] lstrlenW (lpString=".7z") returned 3
	[0095.443] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75
	[0095.443] lstrlenW (lpString=".dbf") returned 4
	[0095.443] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75
	[0095.443] lstrlenW (lpString=".1cd") returned 4
	[0095.443] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75
	[0095.443] lstrlenW (lpString=".jpg") returned 4
	[0095.443] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75
	[0095.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75
	[0095.443] lstrlenW (lpString=".doc") returned 4
	[0095.443] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.443] lstrlenW (lpString=".docx") returned 5
	[0095.443] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.444] lstrlenW (lpString=".pdf") returned 4
	[0095.444] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.444] lstrlenW (lpString=".xls") returned 4
	[0095.444] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.444] lstrlenW (lpString=".xlsx") returned 5
	[0095.444] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.444] lstrlenW (lpString=".ppt") returned 4
	[0095.444] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75
	[0095.444] lstrlenW (lpString=".zip") returned 4
	[0095.444] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.444] lstrlenW (lpString=".rar") returned 4
	[0095.444] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.444] lstrlenW (lpString=".bz2") returned 4
	[0095.444] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.444] lstrlenW (lpString=".7z") returned 3
	[0095.444] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75
	[0095.444] lstrlenW (lpString=".dbf") returned 4
	[0095.444] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75
	[0095.444] lstrlenW (lpString=".1cd") returned 4
	[0095.444] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75
	[0095.444] lstrlenW (lpString=".jpg") returned 4
	[0095.444] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.444] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.444] lstrlenW (lpString="EXPEDITN.INF") returned 12
	[0095.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.472] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=597) returned 1
	[0095.472] CloseHandle (hObject=0x1a0) returned 1
	[0095.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf")) returned 0x20
	[0095.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.472] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.472] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.473] GetLastError () returned 0x0
	[0095.473] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x255, lpOverlapped=0x0) returned 1
	[0095.474] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x260, lpOverlapped=0x0) returned 1
	[0095.475] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.475] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.475] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.475] CloseHandle (hObject=0x1c8) returned 1
	[0095.475] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.476] SetEndOfFile (hFile=0x1a0) returned 1
	[0095.476] CloseHandle (hObject=0x1a0) returned 1
	[0095.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.477] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf")) returned 1
	[0095.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77
	[0095.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77
	[0095.477] lstrlenW (lpString=".doc") returned 4
	[0095.477] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.477] lstrlenW (lpString=".docx") returned 5
	[0095.477] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1
	[0095.477] lstrlenW (lpString=".pdf") returned 4
	[0095.477] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.477] lstrlenW (lpString=".xls") returned 4
	[0095.477] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.477] lstrlenW (lpString=".xlsx") returned 5
	[0095.477] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1
	[0095.477] lstrlenW (lpString=".ppt") returned 4
	[0095.477] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77
	[0095.477] lstrlenW (lpString=".zip") returned 4
	[0095.477] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.477] lstrlenW (lpString=".rar") returned 4
	[0095.477] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.478] lstrlenW (lpString=".bz2") returned 4
	[0095.478] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.478] lstrlenW (lpString=".7z") returned 3
	[0095.478] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77
	[0095.478] lstrlenW (lpString=".dbf") returned 4
	[0095.478] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77
	[0095.478] lstrlenW (lpString=".1cd") returned 4
	[0095.478] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77
	[0095.478] lstrlenW (lpString=".jpg") returned 4
	[0095.478] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77
	[0095.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77
	[0095.478] lstrlenW (lpString=".doc") returned 4
	[0095.478] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.478] lstrlenW (lpString=".docx") returned 5
	[0095.478] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1
	[0095.478] lstrlenW (lpString=".pdf") returned 4
	[0095.478] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.478] lstrlenW (lpString=".xls") returned 4
	[0095.478] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.478] lstrlenW (lpString=".xlsx") returned 5
	[0095.478] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1
	[0095.478] lstrlenW (lpString=".ppt") returned 4
	[0095.478] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77
	[0095.478] lstrlenW (lpString=".zip") returned 4
	[0095.478] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.478] lstrlenW (lpString=".rar") returned 4
	[0095.478] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.478] lstrlenW (lpString=".bz2") returned 4
	[0095.479] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.479] lstrlenW (lpString=".7z") returned 3
	[0095.479] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77
	[0095.479] lstrlenW (lpString=".dbf") returned 4
	[0095.479] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77
	[0095.479] lstrlenW (lpString=".1cd") returned 4
	[0095.479] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77
	[0095.479] lstrlenW (lpString=".jpg") returned 4
	[0095.479] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.479] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.479] lstrlenW (lpString="INDUST.INF") returned 10
	[0095.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.491] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=549) returned 1
	[0095.491] CloseHandle (hObject=0x188) returned 1
	[0095.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf")) returned 0x20
	[0095.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.491] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.492] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.492] GetLastError () returned 0x0
	[0095.492] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x225, lpOverlapped=0x0) returned 1
	[0095.493] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x230, lpOverlapped=0x0) returned 1
	[0095.494] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.494] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0095.494] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.494] CloseHandle (hObject=0x1a8) returned 1
	[0095.495] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.495] SetEndOfFile (hFile=0x188) returned 1
	[0095.495] CloseHandle (hObject=0x188) returned 1
	[0095.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.496] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf")) returned 1
	[0095.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73
	[0095.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73
	[0095.496] lstrlenW (lpString=".doc") returned 4
	[0095.496] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.496] lstrlenW (lpString=".docx") returned 5
	[0095.496] lstrcmpiW (lpString1=".docx", lpString2="T.INF") returned -1
	[0095.496] lstrlenW (lpString=".pdf") returned 4
	[0095.496] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.496] lstrlenW (lpString=".xls") returned 4
	[0095.496] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.496] lstrlenW (lpString=".xlsx") returned 5
	[0095.496] lstrcmpiW (lpString1=".xlsx", lpString2="T.INF") returned -1
	[0095.496] lstrlenW (lpString=".ppt") returned 4
	[0095.496] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73
	[0095.496] lstrlenW (lpString=".zip") returned 4
	[0095.496] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.496] lstrlenW (lpString=".rar") returned 4
	[0095.496] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.496] lstrlenW (lpString=".bz2") returned 4
	[0095.496] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.497] lstrlenW (lpString=".7z") returned 3
	[0095.497] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73
	[0095.497] lstrlenW (lpString=".dbf") returned 4
	[0095.497] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73
	[0095.497] lstrlenW (lpString=".1cd") returned 4
	[0095.497] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73
	[0095.497] lstrlenW (lpString=".jpg") returned 4
	[0095.497] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73
	[0095.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73
	[0095.497] lstrlenW (lpString=".doc") returned 4
	[0095.497] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.497] lstrlenW (lpString=".docx") returned 5
	[0095.497] lstrcmpiW (lpString1=".docx", lpString2="T.INF") returned -1
	[0095.497] lstrlenW (lpString=".pdf") returned 4
	[0095.497] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.497] lstrlenW (lpString=".xls") returned 4
	[0095.497] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.497] lstrlenW (lpString=".xlsx") returned 5
	[0095.497] lstrcmpiW (lpString1=".xlsx", lpString2="T.INF") returned -1
	[0095.497] lstrlenW (lpString=".ppt") returned 4
	[0095.497] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73
	[0095.497] lstrlenW (lpString=".zip") returned 4
	[0095.497] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.497] lstrlenW (lpString=".rar") returned 4
	[0095.497] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.497] lstrlenW (lpString=".bz2") returned 4
	[0095.497] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.498] lstrlenW (lpString=".7z") returned 3
	[0095.498] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73
	[0095.498] lstrlenW (lpString=".dbf") returned 4
	[0095.498] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73
	[0095.498] lstrlenW (lpString=".1cd") returned 4
	[0095.498] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73
	[0095.498] lstrlenW (lpString=".jpg") returned 4
	[0095.498] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.498] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.498] lstrlenW (lpString="IRIS.INF") returned 8
	[0095.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.504] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=462) returned 1
	[0095.504] CloseHandle (hObject=0x188) returned 1
	[0095.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf")) returned 0x20
	[0095.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.529] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.529] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.543] GetLastError () returned 0x0
	[0095.544] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1ce, lpOverlapped=0x0) returned 1
	[0095.544] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1d0, lpOverlapped=0x0) returned 1
	[0095.545] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.545] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0095.546] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.546] CloseHandle (hObject=0x1c8) returned 1
	[0095.546] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.546] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.547] CloseHandle (hObject=0x1a8) returned 1
	[0095.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.547] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf")) returned 1
	[0095.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69
	[0095.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69
	[0095.547] lstrlenW (lpString=".doc") returned 4
	[0095.547] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.547] lstrlenW (lpString=".docx") returned 5
	[0095.547] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0095.547] lstrlenW (lpString=".pdf") returned 4
	[0095.547] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.547] lstrlenW (lpString=".xls") returned 4
	[0095.547] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.547] lstrlenW (lpString=".xlsx") returned 5
	[0095.548] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0095.548] lstrlenW (lpString=".ppt") returned 4
	[0095.548] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69
	[0095.548] lstrlenW (lpString=".zip") returned 4
	[0095.548] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.548] lstrlenW (lpString=".rar") returned 4
	[0095.548] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.548] lstrlenW (lpString=".bz2") returned 4
	[0095.548] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.548] lstrlenW (lpString=".7z") returned 3
	[0095.548] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69
	[0095.548] lstrlenW (lpString=".dbf") returned 4
	[0095.548] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69
	[0095.548] lstrlenW (lpString=".1cd") returned 4
	[0095.548] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69
	[0095.548] lstrlenW (lpString=".jpg") returned 4
	[0095.548] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69
	[0095.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69
	[0095.548] lstrlenW (lpString=".doc") returned 4
	[0095.548] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.548] lstrlenW (lpString=".docx") returned 5
	[0095.548] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0095.548] lstrlenW (lpString=".pdf") returned 4
	[0095.548] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.548] lstrlenW (lpString=".xls") returned 4
	[0095.548] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.548] lstrlenW (lpString=".xlsx") returned 5
	[0095.548] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0095.549] lstrlenW (lpString=".ppt") returned 4
	[0095.549] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69
	[0095.549] lstrlenW (lpString=".zip") returned 4
	[0095.549] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.549] lstrlenW (lpString=".rar") returned 4
	[0095.549] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.549] lstrlenW (lpString=".bz2") returned 4
	[0095.549] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.549] lstrlenW (lpString=".7z") returned 3
	[0095.549] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69
	[0095.549] lstrlenW (lpString=".dbf") returned 4
	[0095.549] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69
	[0095.549] lstrlenW (lpString=".1cd") returned 4
	[0095.549] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69
	[0095.549] lstrlenW (lpString=".jpg") returned 4
	[0095.549] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.549] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.549] lstrlenW (lpString="LAYERS.ELM") returned 10
	[0095.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.550] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=59203) returned 1
	[0095.550] CloseHandle (hObject=0x1a8) returned 1
	[0095.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm")) returned 0x20
	[0095.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.550] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.551] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.551] GetLastError () returned 0x0
	[0095.551] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xe743, lpOverlapped=0x0) returned 1
	[0095.562] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe750, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe750, lpOverlapped=0x0) returned 1
	[0095.564] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.564] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0095.564] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.564] CloseHandle (hObject=0x1c8) returned 1
	[0095.564] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.564] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.566] CloseHandle (hObject=0x1a8) returned 1
	[0095.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.566] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm")) returned 1
	[0095.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73
	[0095.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73
	[0095.568] lstrlenW (lpString=".doc") returned 4
	[0095.568] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.568] lstrlenW (lpString=".docx") returned 5
	[0095.568] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1
	[0095.568] lstrlenW (lpString=".pdf") returned 4
	[0095.568] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.568] lstrlenW (lpString=".xls") returned 4
	[0095.569] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.569] lstrlenW (lpString=".xlsx") returned 5
	[0095.569] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1
	[0095.569] lstrlenW (lpString=".ppt") returned 4
	[0095.569] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73
	[0095.569] lstrlenW (lpString=".zip") returned 4
	[0095.569] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.569] lstrlenW (lpString=".rar") returned 4
	[0095.569] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.569] lstrlenW (lpString=".bz2") returned 4
	[0095.569] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.569] lstrlenW (lpString=".7z") returned 3
	[0095.569] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73
	[0095.569] lstrlenW (lpString=".dbf") returned 4
	[0095.569] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73
	[0095.569] lstrlenW (lpString=".1cd") returned 4
	[0095.569] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73
	[0095.569] lstrlenW (lpString=".jpg") returned 4
	[0095.569] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73
	[0095.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73
	[0095.569] lstrlenW (lpString=".doc") returned 4
	[0095.569] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.569] lstrlenW (lpString=".docx") returned 5
	[0095.569] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1
	[0095.569] lstrlenW (lpString=".pdf") returned 4
	[0095.569] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.569] lstrlenW (lpString=".xls") returned 4
	[0095.570] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.570] lstrlenW (lpString=".xlsx") returned 5
	[0095.570] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1
	[0095.570] lstrlenW (lpString=".ppt") returned 4
	[0095.570] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73
	[0095.570] lstrlenW (lpString=".zip") returned 4
	[0095.570] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.570] lstrlenW (lpString=".rar") returned 4
	[0095.570] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.570] lstrlenW (lpString=".bz2") returned 4
	[0095.570] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.570] lstrlenW (lpString=".7z") returned 3
	[0095.570] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73
	[0095.570] lstrlenW (lpString=".dbf") returned 4
	[0095.570] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73
	[0095.570] lstrlenW (lpString=".1cd") returned 4
	[0095.570] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73
	[0095.570] lstrlenW (lpString=".jpg") returned 4
	[0095.570] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.570] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.570] lstrlenW (lpString="LEVEL.ELM") returned 9
	[0095.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.571] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=58092) returned 1
	[0095.571] CloseHandle (hObject=0x1a0) returned 1
	[0095.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm")) returned 0x20
	[0095.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.572] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.572] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.572] GetLastError () returned 0x0
	[0095.572] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xe2ec, lpOverlapped=0x0) returned 1
	[0095.595] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe2f0, lpOverlapped=0x0) returned 1
	[0095.596] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.596] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0095.596] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.597] CloseHandle (hObject=0x1a8) returned 1
	[0095.597] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.597] SetEndOfFile (hFile=0x1a0) returned 1
	[0095.598] CloseHandle (hObject=0x1a0) returned 1
	[0095.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.598] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm")) returned 1
	[0095.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71
	[0095.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71
	[0095.599] lstrlenW (lpString=".doc") returned 4
	[0095.599] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.599] lstrlenW (lpString=".docx") returned 5
	[0095.599] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1
	[0095.599] lstrlenW (lpString=".pdf") returned 4
	[0095.599] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.599] lstrlenW (lpString=".xls") returned 4
	[0095.599] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.599] lstrlenW (lpString=".xlsx") returned 5
	[0095.599] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1
	[0095.599] lstrlenW (lpString=".ppt") returned 4
	[0095.599] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71
	[0095.599] lstrlenW (lpString=".zip") returned 4
	[0095.599] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.599] lstrlenW (lpString=".rar") returned 4
	[0095.599] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.599] lstrlenW (lpString=".bz2") returned 4
	[0095.599] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.599] lstrlenW (lpString=".7z") returned 3
	[0095.599] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71
	[0095.599] lstrlenW (lpString=".dbf") returned 4
	[0095.599] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71
	[0095.599] lstrlenW (lpString=".1cd") returned 4
	[0095.599] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71
	[0095.599] lstrlenW (lpString=".jpg") returned 4
	[0095.599] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71
	[0095.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71
	[0095.599] lstrlenW (lpString=".doc") returned 4
	[0095.600] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.600] lstrlenW (lpString=".docx") returned 5
	[0095.600] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1
	[0095.600] lstrlenW (lpString=".pdf") returned 4
	[0095.600] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.600] lstrlenW (lpString=".xls") returned 4
	[0095.600] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.600] lstrlenW (lpString=".xlsx") returned 5
	[0095.600] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1
	[0095.600] lstrlenW (lpString=".ppt") returned 4
	[0095.600] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71
	[0095.600] lstrlenW (lpString=".zip") returned 4
	[0095.600] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.600] lstrlenW (lpString=".rar") returned 4
	[0095.600] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.600] lstrlenW (lpString=".bz2") returned 4
	[0095.600] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.600] lstrlenW (lpString=".7z") returned 3
	[0095.600] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71
	[0095.600] lstrlenW (lpString=".dbf") returned 4
	[0095.600] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71
	[0095.600] lstrlenW (lpString=".1cd") returned 4
	[0095.600] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71
	[0095.600] lstrlenW (lpString=".jpg") returned 4
	[0095.600] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.600] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.600] lstrlenW (lpString="NETWORK.INF") returned 11
	[0095.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.612] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=585) returned 1
	[0095.612] CloseHandle (hObject=0x1a0) returned 1
	[0095.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf")) returned 0x20
	[0095.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.613] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.613] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.614] GetLastError () returned 0x0
	[0095.614] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x249, lpOverlapped=0x0) returned 1
	[0095.615] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x250, lpOverlapped=0x0) returned 1
	[0095.616] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.616] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.616] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.616] CloseHandle (hObject=0x1a8) returned 1
	[0095.616] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.616] SetEndOfFile (hFile=0x1a0) returned 1
	[0095.617] CloseHandle (hObject=0x1a0) returned 1
	[0095.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.617] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf")) returned 1
	[0095.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75
	[0095.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75
	[0095.618] lstrlenW (lpString=".doc") returned 4
	[0095.618] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.618] lstrlenW (lpString=".docx") returned 5
	[0095.618] lstrcmpiW (lpString1=".docx", lpString2="K.INF") returned -1
	[0095.618] lstrlenW (lpString=".pdf") returned 4
	[0095.618] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.618] lstrlenW (lpString=".xls") returned 4
	[0095.618] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.618] lstrlenW (lpString=".xlsx") returned 5
	[0095.618] lstrcmpiW (lpString1=".xlsx", lpString2="K.INF") returned -1
	[0095.618] lstrlenW (lpString=".ppt") returned 4
	[0095.618] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75
	[0095.618] lstrlenW (lpString=".zip") returned 4
	[0095.618] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.618] lstrlenW (lpString=".rar") returned 4
	[0095.618] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.618] lstrlenW (lpString=".bz2") returned 4
	[0095.618] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.618] lstrlenW (lpString=".7z") returned 3
	[0095.618] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75
	[0095.618] lstrlenW (lpString=".dbf") returned 4
	[0095.618] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75
	[0095.618] lstrlenW (lpString=".1cd") returned 4
	[0095.618] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75
	[0095.618] lstrlenW (lpString=".jpg") returned 4
	[0095.619] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75
	[0095.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75
	[0095.619] lstrlenW (lpString=".doc") returned 4
	[0095.619] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.619] lstrlenW (lpString=".docx") returned 5
	[0095.619] lstrcmpiW (lpString1=".docx", lpString2="K.INF") returned -1
	[0095.619] lstrlenW (lpString=".pdf") returned 4
	[0095.619] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.619] lstrlenW (lpString=".xls") returned 4
	[0095.619] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.619] lstrlenW (lpString=".xlsx") returned 5
	[0095.619] lstrcmpiW (lpString1=".xlsx", lpString2="K.INF") returned -1
	[0095.619] lstrlenW (lpString=".ppt") returned 4
	[0095.619] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75
	[0095.619] lstrlenW (lpString=".zip") returned 4
	[0095.619] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.619] lstrlenW (lpString=".rar") returned 4
	[0095.619] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.619] lstrlenW (lpString=".bz2") returned 4
	[0095.619] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.619] lstrlenW (lpString=".7z") returned 3
	[0095.619] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75
	[0095.619] lstrlenW (lpString=".dbf") returned 4
	[0095.619] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75
	[0095.619] lstrlenW (lpString=".1cd") returned 4
	[0095.619] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75
	[0095.619] lstrlenW (lpString=".jpg") returned 4
	[0095.619] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.620] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.620] lstrlenW (lpString="PAPYRUS.INF") returned 11
	[0095.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.633] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=500) returned 1
	[0095.633] CloseHandle (hObject=0x1a0) returned 1
	[0095.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf")) returned 0x20
	[0095.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.634] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.634] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.635] GetLastError () returned 0x0
	[0095.635] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1f4, lpOverlapped=0x0) returned 1
	[0095.636] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x200, lpOverlapped=0x0) returned 1
	[0095.637] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.637] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.637] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.637] CloseHandle (hObject=0x1a8) returned 1
	[0095.638] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.638] SetEndOfFile (hFile=0x1a0) returned 1
	[0095.638] CloseHandle (hObject=0x1a0) returned 1
	[0095.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.639] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf")) returned 1
	[0095.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75
	[0095.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75
	[0095.639] lstrlenW (lpString=".doc") returned 4
	[0095.639] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.639] lstrlenW (lpString=".docx") returned 5
	[0095.639] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0095.639] lstrlenW (lpString=".pdf") returned 4
	[0095.639] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.639] lstrlenW (lpString=".xls") returned 4
	[0095.639] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.639] lstrlenW (lpString=".xlsx") returned 5
	[0095.639] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0095.639] lstrlenW (lpString=".ppt") returned 4
	[0095.639] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75
	[0095.639] lstrlenW (lpString=".zip") returned 4
	[0095.639] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.639] lstrlenW (lpString=".rar") returned 4
	[0095.639] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.639] lstrlenW (lpString=".bz2") returned 4
	[0095.639] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.639] lstrlenW (lpString=".7z") returned 3
	[0095.639] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75
	[0095.640] lstrlenW (lpString=".dbf") returned 4
	[0095.640] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75
	[0095.640] lstrlenW (lpString=".1cd") returned 4
	[0095.640] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75
	[0095.640] lstrlenW (lpString=".jpg") returned 4
	[0095.640] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75
	[0095.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75
	[0095.640] lstrlenW (lpString=".doc") returned 4
	[0095.640] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.640] lstrlenW (lpString=".docx") returned 5
	[0095.640] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0095.640] lstrlenW (lpString=".pdf") returned 4
	[0095.640] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.640] lstrlenW (lpString=".xls") returned 4
	[0095.640] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.640] lstrlenW (lpString=".xlsx") returned 5
	[0095.640] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0095.640] lstrlenW (lpString=".ppt") returned 4
	[0095.640] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75
	[0095.640] lstrlenW (lpString=".zip") returned 4
	[0095.640] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.640] lstrlenW (lpString=".rar") returned 4
	[0095.640] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.640] lstrlenW (lpString=".bz2") returned 4
	[0095.640] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.640] lstrlenW (lpString=".7z") returned 3
	[0095.640] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75
	[0095.640] lstrlenW (lpString=".dbf") returned 4
	[0095.640] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75
	[0095.641] lstrlenW (lpString=".1cd") returned 4
	[0095.641] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75
	[0095.641] lstrlenW (lpString=".jpg") returned 4
	[0095.641] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.641] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.641] lstrlenW (lpString="PIXEL.INF") returned 9
	[0095.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.641] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=539) returned 1
	[0095.641] CloseHandle (hObject=0x1a0) returned 1
	[0095.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf")) returned 0x20
	[0095.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.642] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.642] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.642] GetLastError () returned 0x0
	[0095.642] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x21b, lpOverlapped=0x0) returned 1
	[0095.643] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x220, lpOverlapped=0x0) returned 1
	[0095.644] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.644] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0095.644] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.644] CloseHandle (hObject=0x1a8) returned 1
	[0095.645] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.645] SetEndOfFile (hFile=0x1a0) returned 1
	[0095.645] CloseHandle (hObject=0x1a0) returned 1
	[0095.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.646] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf")) returned 1
	[0095.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71
	[0095.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71
	[0095.646] lstrlenW (lpString=".doc") returned 4
	[0095.646] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.646] lstrlenW (lpString=".docx") returned 5
	[0095.646] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1
	[0095.646] lstrlenW (lpString=".pdf") returned 4
	[0095.646] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.646] lstrlenW (lpString=".xls") returned 4
	[0095.646] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.646] lstrlenW (lpString=".xlsx") returned 5
	[0095.646] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1
	[0095.646] lstrlenW (lpString=".ppt") returned 4
	[0095.646] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71
	[0095.646] lstrlenW (lpString=".zip") returned 4
	[0095.646] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.647] lstrlenW (lpString=".rar") returned 4
	[0095.647] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.647] lstrlenW (lpString=".bz2") returned 4
	[0095.647] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.647] lstrlenW (lpString=".7z") returned 3
	[0095.647] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71
	[0095.647] lstrlenW (lpString=".dbf") returned 4
	[0095.647] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71
	[0095.647] lstrlenW (lpString=".1cd") returned 4
	[0095.647] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71
	[0095.647] lstrlenW (lpString=".jpg") returned 4
	[0095.647] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71
	[0095.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71
	[0095.647] lstrlenW (lpString=".doc") returned 4
	[0095.647] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.647] lstrlenW (lpString=".docx") returned 5
	[0095.647] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1
	[0095.647] lstrlenW (lpString=".pdf") returned 4
	[0095.647] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.647] lstrlenW (lpString=".xls") returned 4
	[0095.647] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.647] lstrlenW (lpString=".xlsx") returned 5
	[0095.647] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1
	[0095.647] lstrlenW (lpString=".ppt") returned 4
	[0095.647] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71
	[0095.647] lstrlenW (lpString=".zip") returned 4
	[0095.647] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.647] lstrlenW (lpString=".rar") returned 4
	[0095.648] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.648] lstrlenW (lpString=".bz2") returned 4
	[0095.648] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.648] lstrlenW (lpString=".7z") returned 3
	[0095.648] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71
	[0095.648] lstrlenW (lpString=".dbf") returned 4
	[0095.648] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71
	[0095.648] lstrlenW (lpString=".1cd") returned 4
	[0095.648] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71
	[0095.648] lstrlenW (lpString=".jpg") returned 4
	[0095.648] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.648] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.648] lstrlenW (lpString="PROFILE.ELM") returned 11
	[0095.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0095.702] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=45582) returned 1
	[0095.702] CloseHandle (hObject=0x160) returned 1
	[0095.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm")) returned 0x20
	[0095.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.732] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.733] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0095.739] GetLastError () returned 0x0
	[0095.739] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xb20e, lpOverlapped=0x0) returned 1
	[0095.755] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xb210, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xb210, lpOverlapped=0x0) returned 1
	[0095.756] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.756] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.757] SetEndOfFile (hFile=0x1a4) returned 1
	[0095.757] CloseHandle (hObject=0x1a4) returned 1
	[0095.757] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.757] SetEndOfFile (hFile=0x190) returned 1
	[0095.758] CloseHandle (hObject=0x190) returned 1
	[0095.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.759] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm")) returned 1
	[0095.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75
	[0095.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75
	[0095.759] lstrlenW (lpString=".doc") returned 4
	[0095.759] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.759] lstrlenW (lpString=".docx") returned 5
	[0095.759] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.759] lstrlenW (lpString=".pdf") returned 4
	[0095.759] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.759] lstrlenW (lpString=".xls") returned 4
	[0095.759] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.759] lstrlenW (lpString=".xlsx") returned 5
	[0095.759] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.759] lstrlenW (lpString=".ppt") returned 4
	[0095.759] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75
	[0095.759] lstrlenW (lpString=".zip") returned 4
	[0095.759] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.759] lstrlenW (lpString=".rar") returned 4
	[0095.759] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.759] lstrlenW (lpString=".bz2") returned 4
	[0095.759] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.759] lstrlenW (lpString=".7z") returned 3
	[0095.759] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75
	[0095.760] lstrlenW (lpString=".dbf") returned 4
	[0095.760] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75
	[0095.760] lstrlenW (lpString=".1cd") returned 4
	[0095.760] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75
	[0095.760] lstrlenW (lpString=".jpg") returned 4
	[0095.760] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75
	[0095.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75
	[0095.760] lstrlenW (lpString=".doc") returned 4
	[0095.760] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.760] lstrlenW (lpString=".docx") returned 5
	[0095.760] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.760] lstrlenW (lpString=".pdf") returned 4
	[0095.760] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.760] lstrlenW (lpString=".xls") returned 4
	[0095.760] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.760] lstrlenW (lpString=".xlsx") returned 5
	[0095.760] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.760] lstrlenW (lpString=".ppt") returned 4
	[0095.760] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75
	[0095.760] lstrlenW (lpString=".zip") returned 4
	[0095.760] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.760] lstrlenW (lpString=".rar") returned 4
	[0095.760] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.760] lstrlenW (lpString=".bz2") returned 4
	[0095.760] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.760] lstrlenW (lpString=".7z") returned 3
	[0095.760] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75
	[0095.760] lstrlenW (lpString=".dbf") returned 4
	[0095.761] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75
	[0095.761] lstrlenW (lpString=".1cd") returned 4
	[0095.761] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75
	[0095.761] lstrlenW (lpString=".jpg") returned 4
	[0095.761] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.761] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.761] lstrlenW (lpString="RADIAL.INF") returned 10
	[0095.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.762] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=586) returned 1
	[0095.762] CloseHandle (hObject=0x190) returned 1
	[0095.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf")) returned 0x20
	[0095.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.763] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.763] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0095.763] GetLastError () returned 0x0
	[0095.763] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x24a, lpOverlapped=0x0) returned 1
	[0095.764] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x250, lpOverlapped=0x0) returned 1
	[0095.766] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.766] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0095.766] SetEndOfFile (hFile=0x1a4) returned 1
	[0095.766] CloseHandle (hObject=0x1a4) returned 1
	[0095.766] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.767] SetEndOfFile (hFile=0x190) returned 1
	[0095.767] CloseHandle (hObject=0x190) returned 1
	[0095.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.768] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf")) returned 1
	[0095.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73
	[0095.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73
	[0095.768] lstrlenW (lpString=".doc") returned 4
	[0095.768] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.768] lstrlenW (lpString=".docx") returned 5
	[0095.768] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1
	[0095.769] lstrlenW (lpString=".pdf") returned 4
	[0095.769] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.769] lstrlenW (lpString=".xls") returned 4
	[0095.769] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.769] lstrlenW (lpString=".xlsx") returned 5
	[0095.769] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1
	[0095.769] lstrlenW (lpString=".ppt") returned 4
	[0095.769] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73
	[0095.769] lstrlenW (lpString=".zip") returned 4
	[0095.769] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.769] lstrlenW (lpString=".rar") returned 4
	[0095.769] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.769] lstrlenW (lpString=".bz2") returned 4
	[0095.769] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.769] lstrlenW (lpString=".7z") returned 3
	[0095.769] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73
	[0095.769] lstrlenW (lpString=".dbf") returned 4
	[0095.769] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73
	[0095.769] lstrlenW (lpString=".1cd") returned 4
	[0095.769] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73
	[0095.769] lstrlenW (lpString=".jpg") returned 4
	[0095.769] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73
	[0095.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73
	[0095.770] lstrlenW (lpString=".doc") returned 4
	[0095.770] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.770] lstrlenW (lpString=".docx") returned 5
	[0095.770] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1
	[0095.770] lstrlenW (lpString=".pdf") returned 4
	[0095.770] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.770] lstrlenW (lpString=".xls") returned 4
	[0095.770] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.770] lstrlenW (lpString=".xlsx") returned 5
	[0095.770] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1
	[0095.770] lstrlenW (lpString=".ppt") returned 4
	[0095.770] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73
	[0095.770] lstrlenW (lpString=".zip") returned 4
	[0095.770] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.770] lstrlenW (lpString=".rar") returned 4
	[0095.770] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.770] lstrlenW (lpString=".bz2") returned 4
	[0095.770] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.770] lstrlenW (lpString=".7z") returned 3
	[0095.770] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73
	[0095.770] lstrlenW (lpString=".dbf") returned 4
	[0095.770] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73
	[0095.771] lstrlenW (lpString=".1cd") returned 4
	[0095.771] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73
	[0095.771] lstrlenW (lpString=".jpg") returned 4
	[0095.771] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.771] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.771] lstrlenW (lpString="REFINED.ELM") returned 11
	[0095.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.772] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=45838) returned 1
	[0095.772] CloseHandle (hObject=0x190) returned 1
	[0095.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm")) returned 0x20
	[0095.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.772] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.773] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0095.773] GetLastError () returned 0x0
	[0095.773] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xb30e, lpOverlapped=0x0) returned 1
	[0095.797] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xb310, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xb310, lpOverlapped=0x0) returned 1
	[0095.799] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.799] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.799] SetEndOfFile (hFile=0x1a4) returned 1
	[0095.800] CloseHandle (hObject=0x1a4) returned 1
	[0095.800] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.800] SetEndOfFile (hFile=0x190) returned 1
	[0095.801] CloseHandle (hObject=0x190) returned 1
	[0095.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.802] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm")) returned 1
	[0095.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75
	[0095.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75
	[0095.802] lstrlenW (lpString=".doc") returned 4
	[0095.802] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.802] lstrlenW (lpString=".docx") returned 5
	[0095.802] lstrcmpiW (lpString1=".docx", lpString2="D.ELM") returned -1
	[0095.802] lstrlenW (lpString=".pdf") returned 4
	[0095.802] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.802] lstrlenW (lpString=".xls") returned 4
	[0095.802] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.802] lstrlenW (lpString=".xlsx") returned 5
	[0095.802] lstrcmpiW (lpString1=".xlsx", lpString2="D.ELM") returned -1
	[0095.802] lstrlenW (lpString=".ppt") returned 4
	[0095.802] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75
	[0095.802] lstrlenW (lpString=".zip") returned 4
	[0095.802] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.803] lstrlenW (lpString=".rar") returned 4
	[0095.803] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.803] lstrlenW (lpString=".bz2") returned 4
	[0095.803] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.803] lstrlenW (lpString=".7z") returned 3
	[0095.803] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75
	[0095.803] lstrlenW (lpString=".dbf") returned 4
	[0095.803] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75
	[0095.803] lstrlenW (lpString=".1cd") returned 4
	[0095.803] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75
	[0095.803] lstrlenW (lpString=".jpg") returned 4
	[0095.803] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75
	[0095.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75
	[0095.803] lstrlenW (lpString=".doc") returned 4
	[0095.803] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.803] lstrlenW (lpString=".docx") returned 5
	[0095.803] lstrcmpiW (lpString1=".docx", lpString2="D.ELM") returned -1
	[0095.803] lstrlenW (lpString=".pdf") returned 4
	[0095.803] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.804] lstrlenW (lpString=".xls") returned 4
	[0095.804] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.804] lstrlenW (lpString=".xlsx") returned 5
	[0095.804] lstrcmpiW (lpString1=".xlsx", lpString2="D.ELM") returned -1
	[0095.804] lstrlenW (lpString=".ppt") returned 4
	[0095.804] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75
	[0095.804] lstrlenW (lpString=".zip") returned 4
	[0095.804] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.804] lstrlenW (lpString=".rar") returned 4
	[0095.804] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.804] lstrlenW (lpString=".bz2") returned 4
	[0095.804] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.804] lstrlenW (lpString=".7z") returned 3
	[0095.804] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75
	[0095.804] lstrlenW (lpString=".dbf") returned 4
	[0095.804] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75
	[0095.804] lstrlenW (lpString=".1cd") returned 4
	[0095.804] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75
	[0095.805] lstrlenW (lpString=".jpg") returned 4
	[0095.805] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.805] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.805] lstrlenW (lpString="RICEPAPR.INF") returned 12
	[0095.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.814] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=569) returned 1
	[0095.814] CloseHandle (hObject=0x190) returned 1
	[0095.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf")) returned 0x20
	[0095.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.934] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.934] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0095.945] GetLastError () returned 0x0
	[0095.945] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x239, lpOverlapped=0x0) returned 1
	[0095.946] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x240, lpOverlapped=0x0) returned 1
	[0095.948] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.948] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.948] SetEndOfFile (hFile=0x1a4) returned 1
	[0095.948] CloseHandle (hObject=0x1a4) returned 1
	[0095.948] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.948] SetEndOfFile (hFile=0x190) returned 1
	[0095.949] CloseHandle (hObject=0x190) returned 1
	[0095.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.949] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf")) returned 1
	[0095.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77
	[0095.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77
	[0095.950] lstrlenW (lpString=".doc") returned 4
	[0095.950] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.950] lstrlenW (lpString=".docx") returned 5
	[0095.950] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1
	[0095.950] lstrlenW (lpString=".pdf") returned 4
	[0095.950] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.950] lstrlenW (lpString=".xls") returned 4
	[0095.950] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.950] lstrlenW (lpString=".xlsx") returned 5
	[0095.950] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1
	[0095.950] lstrlenW (lpString=".ppt") returned 4
	[0095.950] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77
	[0095.950] lstrlenW (lpString=".zip") returned 4
	[0095.950] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.950] lstrlenW (lpString=".rar") returned 4
	[0095.950] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.950] lstrlenW (lpString=".bz2") returned 4
	[0095.950] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.950] lstrlenW (lpString=".7z") returned 3
	[0095.950] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77
	[0095.950] lstrlenW (lpString=".dbf") returned 4
	[0095.950] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77
	[0095.950] lstrlenW (lpString=".1cd") returned 4
	[0095.950] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77
	[0095.950] lstrlenW (lpString=".jpg") returned 4
	[0095.951] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77
	[0095.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77
	[0095.951] lstrlenW (lpString=".doc") returned 4
	[0095.951] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.951] lstrlenW (lpString=".docx") returned 5
	[0095.951] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1
	[0095.951] lstrlenW (lpString=".pdf") returned 4
	[0095.951] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.951] lstrlenW (lpString=".xls") returned 4
	[0095.951] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.951] lstrlenW (lpString=".xlsx") returned 5
	[0095.951] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1
	[0095.951] lstrlenW (lpString=".ppt") returned 4
	[0095.951] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77
	[0095.951] lstrlenW (lpString=".zip") returned 4
	[0095.951] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.951] lstrlenW (lpString=".rar") returned 4
	[0095.951] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.951] lstrlenW (lpString=".bz2") returned 4
	[0095.951] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.951] lstrlenW (lpString=".7z") returned 3
	[0095.951] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77
	[0095.951] lstrlenW (lpString=".dbf") returned 4
	[0095.952] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77
	[0095.952] lstrlenW (lpString=".1cd") returned 4
	[0095.952] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77
	[0095.952] lstrlenW (lpString=".jpg") returned 4
	[0095.952] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.952] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.952] lstrlenW (lpString="SKY.ELM") returned 7
	[0095.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.954] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=82237) returned 1
	[0095.954] CloseHandle (hObject=0x190) returned 1
	[0095.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm")) returned 0x20
	[0095.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.955] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.955] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0095.956] GetLastError () returned 0x0
	[0095.956] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1413d, lpOverlapped=0x0) returned 1
	[0095.961] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x14140, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x14140, lpOverlapped=0x0) returned 1
	[0095.965] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.965] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0095.965] SetEndOfFile (hFile=0x1a4) returned 1
	[0095.966] CloseHandle (hObject=0x1a4) returned 1
	[0095.966] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.966] SetEndOfFile (hFile=0x190) returned 1
	[0095.967] CloseHandle (hObject=0x190) returned 1
	[0095.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.968] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm")) returned 1
	[0095.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67
	[0095.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67
	[0095.968] lstrlenW (lpString=".doc") returned 4
	[0095.968] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.968] lstrlenW (lpString=".docx") returned 5
	[0095.968] lstrcmpiW (lpString1=".docx", lpString2="Y.ELM") returned -1
	[0095.968] lstrlenW (lpString=".pdf") returned 4
	[0095.968] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.968] lstrlenW (lpString=".xls") returned 4
	[0095.969] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.969] lstrlenW (lpString=".xlsx") returned 5
	[0095.969] lstrcmpiW (lpString1=".xlsx", lpString2="Y.ELM") returned -1
	[0095.969] lstrlenW (lpString=".ppt") returned 4
	[0095.969] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67
	[0095.969] lstrlenW (lpString=".zip") returned 4
	[0095.969] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.969] lstrlenW (lpString=".rar") returned 4
	[0095.969] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.969] lstrlenW (lpString=".bz2") returned 4
	[0095.969] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.969] lstrlenW (lpString=".7z") returned 3
	[0095.969] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67
	[0095.969] lstrlenW (lpString=".dbf") returned 4
	[0095.969] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67
	[0095.969] lstrlenW (lpString=".1cd") returned 4
	[0095.969] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67
	[0095.969] lstrlenW (lpString=".jpg") returned 4
	[0095.969] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67
	[0095.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67
	[0095.970] lstrlenW (lpString=".doc") returned 4
	[0095.970] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.970] lstrlenW (lpString=".docx") returned 5
	[0095.970] lstrcmpiW (lpString1=".docx", lpString2="Y.ELM") returned -1
	[0095.970] lstrlenW (lpString=".pdf") returned 4
	[0095.970] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.970] lstrlenW (lpString=".xls") returned 4
	[0095.970] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.970] lstrlenW (lpString=".xlsx") returned 5
	[0095.970] lstrcmpiW (lpString1=".xlsx", lpString2="Y.ELM") returned -1
	[0095.970] lstrlenW (lpString=".ppt") returned 4
	[0095.970] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67
	[0095.970] lstrlenW (lpString=".zip") returned 4
	[0095.970] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.970] lstrlenW (lpString=".rar") returned 4
	[0095.970] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.970] lstrlenW (lpString=".bz2") returned 4
	[0095.970] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.970] lstrlenW (lpString=".7z") returned 3
	[0095.970] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67
	[0095.970] lstrlenW (lpString=".dbf") returned 4
	[0095.970] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67
	[0095.970] lstrlenW (lpString=".1cd") returned 4
	[0095.971] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67
	[0095.971] lstrlenW (lpString=".jpg") returned 4
	[0095.971] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.971] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.971] lstrlenW (lpString="SKY.INF") returned 7
	[0095.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.972] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=444) returned 1
	[0095.972] CloseHandle (hObject=0x190) returned 1
	[0095.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf")) returned 0x20
	[0095.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.972] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.973] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0095.973] GetLastError () returned 0x0
	[0095.973] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1bc, lpOverlapped=0x0) returned 1
	[0095.974] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1c0, lpOverlapped=0x0) returned 1
	[0095.976] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.976] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0095.976] SetEndOfFile (hFile=0x1a4) returned 1
	[0095.976] CloseHandle (hObject=0x1a4) returned 1
	[0095.976] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.976] SetEndOfFile (hFile=0x190) returned 1
	[0095.977] CloseHandle (hObject=0x190) returned 1
	[0095.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.978] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf")) returned 1
	[0095.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67
	[0095.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67
	[0095.978] lstrlenW (lpString=".doc") returned 4
	[0095.978] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.978] lstrlenW (lpString=".docx") returned 5
	[0095.978] lstrcmpiW (lpString1=".docx", lpString2="Y.INF") returned -1
	[0095.978] lstrlenW (lpString=".pdf") returned 4
	[0095.978] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.978] lstrlenW (lpString=".xls") returned 4
	[0095.978] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.978] lstrlenW (lpString=".xlsx") returned 5
	[0095.978] lstrcmpiW (lpString1=".xlsx", lpString2="Y.INF") returned -1
	[0095.978] lstrlenW (lpString=".ppt") returned 4
	[0095.978] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67
	[0095.978] lstrlenW (lpString=".zip") returned 4
	[0095.979] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.979] lstrlenW (lpString=".rar") returned 4
	[0095.979] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.979] lstrlenW (lpString=".bz2") returned 4
	[0095.979] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.979] lstrlenW (lpString=".7z") returned 3
	[0095.979] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67
	[0095.979] lstrlenW (lpString=".dbf") returned 4
	[0095.979] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67
	[0095.979] lstrlenW (lpString=".1cd") returned 4
	[0095.979] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67
	[0095.979] lstrlenW (lpString=".jpg") returned 4
	[0095.979] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67
	[0095.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67
	[0095.979] lstrlenW (lpString=".doc") returned 4
	[0095.979] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.979] lstrlenW (lpString=".docx") returned 5
	[0095.979] lstrcmpiW (lpString1=".docx", lpString2="Y.INF") returned -1
	[0095.979] lstrlenW (lpString=".pdf") returned 4
	[0095.979] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.979] lstrlenW (lpString=".xls") returned 4
	[0095.979] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.979] lstrlenW (lpString=".xlsx") returned 5
	[0095.980] lstrcmpiW (lpString1=".xlsx", lpString2="Y.INF") returned -1
	[0095.980] lstrlenW (lpString=".ppt") returned 4
	[0095.980] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67
	[0095.980] lstrlenW (lpString=".zip") returned 4
	[0095.980] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.980] lstrlenW (lpString=".rar") returned 4
	[0095.980] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.980] lstrlenW (lpString=".bz2") returned 4
	[0095.980] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.980] lstrlenW (lpString=".7z") returned 3
	[0095.980] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67
	[0095.980] lstrlenW (lpString=".dbf") returned 4
	[0095.980] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67
	[0095.980] lstrlenW (lpString=".1cd") returned 4
	[0095.980] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67
	[0095.980] lstrlenW (lpString=".jpg") returned 4
	[0095.980] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.980] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.980] lstrlenW (lpString="SLATE.ELM") returned 9
	[0095.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.981] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=85056) returned 1
	[0095.981] CloseHandle (hObject=0x190) returned 1
	[0095.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm")) returned 0x20
	[0095.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.982] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.982] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0095.983] GetLastError () returned 0x0
	[0095.983] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x14c40, lpOverlapped=0x0) returned 1
	[0095.990] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x14c50, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x14c50, lpOverlapped=0x0) returned 1
	[0095.993] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.994] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0095.994] SetEndOfFile (hFile=0x1a4) returned 1
	[0095.994] CloseHandle (hObject=0x1a4) returned 1
	[0095.994] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.994] SetEndOfFile (hFile=0x190) returned 1
	[0095.996] CloseHandle (hObject=0x190) returned 1
	[0095.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.996] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm")) returned 1
	[0095.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71
	[0095.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71
	[0095.996] lstrlenW (lpString=".doc") returned 4
	[0095.997] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.997] lstrlenW (lpString=".docx") returned 5
	[0095.997] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.997] lstrlenW (lpString=".pdf") returned 4
	[0095.997] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.997] lstrlenW (lpString=".xls") returned 4
	[0095.997] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.997] lstrlenW (lpString=".xlsx") returned 5
	[0095.997] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.997] lstrlenW (lpString=".ppt") returned 4
	[0095.997] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71
	[0095.997] lstrlenW (lpString=".zip") returned 4
	[0095.997] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.997] lstrlenW (lpString=".rar") returned 4
	[0095.997] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.997] lstrlenW (lpString=".bz2") returned 4
	[0095.997] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.997] lstrlenW (lpString=".7z") returned 3
	[0095.997] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71
	[0095.997] lstrlenW (lpString=".dbf") returned 4
	[0095.997] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71
	[0095.997] lstrlenW (lpString=".1cd") returned 4
	[0095.997] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71
	[0095.998] lstrlenW (lpString=".jpg") returned 4
	[0095.998] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71
	[0095.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71
	[0095.998] lstrlenW (lpString=".doc") returned 4
	[0095.998] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.998] lstrlenW (lpString=".docx") returned 5
	[0095.998] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.998] lstrlenW (lpString=".pdf") returned 4
	[0095.998] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.998] lstrlenW (lpString=".xls") returned 4
	[0095.998] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.998] lstrlenW (lpString=".xlsx") returned 5
	[0095.998] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.998] lstrlenW (lpString=".ppt") returned 4
	[0095.998] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71
	[0095.998] lstrlenW (lpString=".zip") returned 4
	[0095.998] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.998] lstrlenW (lpString=".rar") returned 4
	[0095.998] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.998] lstrlenW (lpString=".bz2") returned 4
	[0095.998] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.998] lstrlenW (lpString=".7z") returned 3
	[0095.998] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71
	[0095.999] lstrlenW (lpString=".dbf") returned 4
	[0095.999] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71
	[0095.999] lstrlenW (lpString=".1cd") returned 4
	[0095.999] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71
	[0095.999] lstrlenW (lpString=".jpg") returned 4
	[0095.999] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.999] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.999] lstrlenW (lpString="SLATE.INF") returned 9
	[0095.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0096.000] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=500) returned 1
	[0096.000] CloseHandle (hObject=0x190) returned 1
	[0096.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf")) returned 0x20
	[0096.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0096.001] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.001] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0096.002] GetLastError () returned 0x0
	[0096.002] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1f4, lpOverlapped=0x0) returned 1
	[0096.003] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x200, lpOverlapped=0x0) returned 1
	[0096.004] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.004] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0096.004] SetEndOfFile (hFile=0x1a4) returned 1
	[0096.004] CloseHandle (hObject=0x1a4) returned 1
	[0096.004] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.004] SetEndOfFile (hFile=0x190) returned 1
	[0096.005] CloseHandle (hObject=0x190) returned 1
	[0096.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.005] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf")) returned 1
	[0096.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71
	[0096.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71
	[0096.006] lstrlenW (lpString=".doc") returned 4
	[0096.006] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.006] lstrlenW (lpString=".docx") returned 5
	[0096.006] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0096.006] lstrlenW (lpString=".pdf") returned 4
	[0096.006] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.006] lstrlenW (lpString=".xls") returned 4
	[0096.006] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.006] lstrlenW (lpString=".xlsx") returned 5
	[0096.006] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0096.006] lstrlenW (lpString=".ppt") returned 4
	[0096.006] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71
	[0096.006] lstrlenW (lpString=".zip") returned 4
	[0096.006] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.006] lstrlenW (lpString=".rar") returned 4
	[0096.006] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.006] lstrlenW (lpString=".bz2") returned 4
	[0096.006] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.006] lstrlenW (lpString=".7z") returned 3
	[0096.006] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71
	[0096.006] lstrlenW (lpString=".dbf") returned 4
	[0096.007] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71
	[0096.007] lstrlenW (lpString=".1cd") returned 4
	[0096.007] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71
	[0096.007] lstrlenW (lpString=".jpg") returned 4
	[0096.007] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71
	[0096.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71
	[0096.007] lstrlenW (lpString=".doc") returned 4
	[0096.007] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.007] lstrlenW (lpString=".docx") returned 5
	[0096.007] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0096.007] lstrlenW (lpString=".pdf") returned 4
	[0096.007] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.007] lstrlenW (lpString=".xls") returned 4
	[0096.007] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.007] lstrlenW (lpString=".xlsx") returned 5
	[0096.007] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0096.007] lstrlenW (lpString=".ppt") returned 4
	[0096.007] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71
	[0096.007] lstrlenW (lpString=".zip") returned 4
	[0096.008] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.008] lstrlenW (lpString=".rar") returned 4
	[0096.008] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.008] lstrlenW (lpString=".bz2") returned 4
	[0096.008] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.008] lstrlenW (lpString=".7z") returned 3
	[0096.008] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71
	[0096.008] lstrlenW (lpString=".dbf") returned 4
	[0096.008] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71
	[0096.008] lstrlenW (lpString=".1cd") returned 4
	[0096.008] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71
	[0096.008] lstrlenW (lpString=".jpg") returned 4
	[0096.008] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.008] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0096.008] lstrlenW (lpString="SONORA.ELM") returned 10
	[0096.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0096.012] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=54687) returned 1
	[0096.012] CloseHandle (hObject=0x190) returned 1
	[0096.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm")) returned 0x20
	[0096.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0096.012] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.012] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0096.013] GetLastError () returned 0x0
	[0096.013] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xd59f, lpOverlapped=0x0) returned 1
	[0096.017] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xd5a0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xd5a0, lpOverlapped=0x0) returned 1
	[0096.019] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.019] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0096.019] SetEndOfFile (hFile=0x1a4) returned 1
	[0096.019] CloseHandle (hObject=0x1a4) returned 1
	[0096.020] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.020] SetEndOfFile (hFile=0x190) returned 1
	[0096.021] CloseHandle (hObject=0x190) returned 1
	[0096.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.022] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm")) returned 1
	[0096.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73
	[0096.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73
	[0096.022] lstrlenW (lpString=".doc") returned 4
	[0096.022] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.022] lstrlenW (lpString=".docx") returned 5
	[0096.022] lstrcmpiW (lpString1=".docx", lpString2="A.ELM") returned -1
	[0096.022] lstrlenW (lpString=".pdf") returned 4
	[0096.022] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.022] lstrlenW (lpString=".xls") returned 4
	[0096.022] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.022] lstrlenW (lpString=".xlsx") returned 5
	[0096.022] lstrcmpiW (lpString1=".xlsx", lpString2="A.ELM") returned -1
	[0096.022] lstrlenW (lpString=".ppt") returned 4
	[0096.023] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73
	[0096.023] lstrlenW (lpString=".zip") returned 4
	[0096.023] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.023] lstrlenW (lpString=".rar") returned 4
	[0096.023] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.023] lstrlenW (lpString=".bz2") returned 4
	[0096.023] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.023] lstrlenW (lpString=".7z") returned 3
	[0096.023] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73
	[0096.023] lstrlenW (lpString=".dbf") returned 4
	[0096.023] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73
	[0096.023] lstrlenW (lpString=".1cd") returned 4
	[0096.023] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73
	[0096.023] lstrlenW (lpString=".jpg") returned 4
	[0096.023] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73
	[0096.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73
	[0096.023] lstrlenW (lpString=".doc") returned 4
	[0096.023] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.023] lstrlenW (lpString=".docx") returned 5
	[0096.023] lstrcmpiW (lpString1=".docx", lpString2="A.ELM") returned -1
	[0096.024] lstrlenW (lpString=".pdf") returned 4
	[0096.024] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.024] lstrlenW (lpString=".xls") returned 4
	[0096.024] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.024] lstrlenW (lpString=".xlsx") returned 5
	[0096.024] lstrcmpiW (lpString1=".xlsx", lpString2="A.ELM") returned -1
	[0096.024] lstrlenW (lpString=".ppt") returned 4
	[0096.024] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73
	[0096.024] lstrlenW (lpString=".zip") returned 4
	[0096.024] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.024] lstrlenW (lpString=".rar") returned 4
	[0096.024] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.024] lstrlenW (lpString=".bz2") returned 4
	[0096.024] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.024] lstrlenW (lpString=".7z") returned 3
	[0096.024] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73
	[0096.024] lstrlenW (lpString=".dbf") returned 4
	[0096.024] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73
	[0096.024] lstrlenW (lpString=".1cd") returned 4
	[0096.024] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73
	[0096.024] lstrlenW (lpString=".jpg") returned 4
	[0096.024] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.025] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0096.025] lstrlenW (lpString="SONORA.INF") returned 10
	[0096.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0096.025] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=484) returned 1
	[0096.026] CloseHandle (hObject=0x190) returned 1
	[0096.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf")) returned 0x20
	[0096.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0096.027] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.027] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0096.027] GetLastError () returned 0x0
	[0096.028] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1e4, lpOverlapped=0x0) returned 1
	[0096.029] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1f0, lpOverlapped=0x0) returned 1
	[0096.030] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.030] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0096.030] SetEndOfFile (hFile=0x1a4) returned 1
	[0096.030] CloseHandle (hObject=0x1a4) returned 1
	[0096.031] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.031] SetEndOfFile (hFile=0x190) returned 1
	[0096.032] CloseHandle (hObject=0x190) returned 1
	[0096.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.032] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf")) returned 1
	[0096.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73
	[0096.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73
	[0096.033] lstrlenW (lpString=".doc") returned 4
	[0096.033] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.033] lstrlenW (lpString=".docx") returned 5
	[0096.033] lstrcmpiW (lpString1=".docx", lpString2="A.INF") returned -1
	[0096.033] lstrlenW (lpString=".pdf") returned 4
	[0096.033] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.033] lstrlenW (lpString=".xls") returned 4
	[0096.033] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.033] lstrlenW (lpString=".xlsx") returned 5
	[0096.033] lstrcmpiW (lpString1=".xlsx", lpString2="A.INF") returned -1
	[0096.033] lstrlenW (lpString=".ppt") returned 4
	[0096.033] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73
	[0096.033] lstrlenW (lpString=".zip") returned 4
	[0096.033] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.033] lstrlenW (lpString=".rar") returned 4
	[0096.033] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.033] lstrlenW (lpString=".bz2") returned 4
	[0096.033] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.033] lstrlenW (lpString=".7z") returned 3
	[0096.033] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73
	[0096.033] lstrlenW (lpString=".dbf") returned 4
	[0096.033] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73
	[0096.034] lstrlenW (lpString=".1cd") returned 4
	[0096.034] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73
	[0096.034] lstrlenW (lpString=".jpg") returned 4
	[0096.034] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73
	[0096.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73
	[0096.034] lstrlenW (lpString=".doc") returned 4
	[0096.034] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.034] lstrlenW (lpString=".docx") returned 5
	[0096.034] lstrcmpiW (lpString1=".docx", lpString2="A.INF") returned -1
	[0096.034] lstrlenW (lpString=".pdf") returned 4
	[0096.034] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.034] lstrlenW (lpString=".xls") returned 4
	[0096.034] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.034] lstrlenW (lpString=".xlsx") returned 5
	[0096.034] lstrcmpiW (lpString1=".xlsx", lpString2="A.INF") returned -1
	[0096.034] lstrlenW (lpString=".ppt") returned 4
	[0096.034] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73
	[0096.034] lstrlenW (lpString=".zip") returned 4
	[0096.034] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.034] lstrlenW (lpString=".rar") returned 4
	[0096.034] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.035] lstrlenW (lpString=".bz2") returned 4
	[0096.035] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.035] lstrlenW (lpString=".7z") returned 3
	[0096.035] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73
	[0096.035] lstrlenW (lpString=".dbf") returned 4
	[0096.035] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73
	[0096.035] lstrlenW (lpString=".1cd") returned 4
	[0096.035] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73
	[0096.035] lstrlenW (lpString=".jpg") returned 4
	[0096.035] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.035] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0096.035] lstrlenW (lpString="SPRING.ELM") returned 10
	[0096.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0096.057] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=68337) returned 1
	[0096.058] CloseHandle (hObject=0x160) returned 1
	[0096.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm")) returned 0x20
	[0096.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.123] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.123] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0096.203] GetLastError () returned 0x0
	[0096.203] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x10af1, lpOverlapped=0x0) returned 1
	[0096.216] WriteFile (in: hFile=0x160, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x10b00, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x10b00, lpOverlapped=0x0) returned 1
	[0096.218] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.219] WriteFile (in: hFile=0x160, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0096.219] SetEndOfFile (hFile=0x160) returned 1
	[0096.219] CloseHandle (hObject=0x160) returned 1
	[0096.219] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.219] SetEndOfFile (hFile=0x184) returned 1
	[0096.221] CloseHandle (hObject=0x184) returned 1
	[0096.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.221] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm")) returned 1
	[0096.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73
	[0096.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73
	[0096.222] lstrlenW (lpString=".doc") returned 4
	[0096.222] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.222] lstrlenW (lpString=".docx") returned 5
	[0096.222] lstrcmpiW (lpString1=".docx", lpString2="G.ELM") returned -1
	[0096.222] lstrlenW (lpString=".pdf") returned 4
	[0096.222] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.222] lstrlenW (lpString=".xls") returned 4
	[0096.222] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.222] lstrlenW (lpString=".xlsx") returned 5
	[0096.222] lstrcmpiW (lpString1=".xlsx", lpString2="G.ELM") returned -1
	[0096.222] lstrlenW (lpString=".ppt") returned 4
	[0096.222] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73
	[0096.222] lstrlenW (lpString=".zip") returned 4
	[0096.222] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.222] lstrlenW (lpString=".rar") returned 4
	[0096.222] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.222] lstrlenW (lpString=".bz2") returned 4
	[0096.222] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.222] lstrlenW (lpString=".7z") returned 3
	[0096.222] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73
	[0096.222] lstrlenW (lpString=".dbf") returned 4
	[0096.222] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73
	[0096.223] lstrlenW (lpString=".1cd") returned 4
	[0096.223] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73
	[0096.223] lstrlenW (lpString=".jpg") returned 4
	[0096.223] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73
	[0096.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73
	[0096.223] lstrlenW (lpString=".doc") returned 4
	[0096.223] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.223] lstrlenW (lpString=".docx") returned 5
	[0096.223] lstrcmpiW (lpString1=".docx", lpString2="G.ELM") returned -1
	[0096.223] lstrlenW (lpString=".pdf") returned 4
	[0096.223] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.223] lstrlenW (lpString=".xls") returned 4
	[0096.223] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.223] lstrlenW (lpString=".xlsx") returned 5
	[0096.223] lstrcmpiW (lpString1=".xlsx", lpString2="G.ELM") returned -1
	[0096.223] lstrlenW (lpString=".ppt") returned 4
	[0096.223] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73
	[0096.223] lstrlenW (lpString=".zip") returned 4
	[0096.223] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.223] lstrlenW (lpString=".rar") returned 4
	[0096.223] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.223] lstrlenW (lpString=".bz2") returned 4
	[0096.223] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.224] lstrlenW (lpString=".7z") returned 3
	[0096.224] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73
	[0096.224] lstrlenW (lpString=".dbf") returned 4
	[0096.224] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73
	[0096.224] lstrlenW (lpString=".1cd") returned 4
	[0096.224] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73
	[0096.224] lstrlenW (lpString=".jpg") returned 4
	[0096.224] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.224] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0096.224] lstrlenW (lpString="SUMIPNTG.INF") returned 12
	[0096.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0096.236] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=555) returned 1
	[0096.236] CloseHandle (hObject=0x1a8) returned 1
	[0096.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf")) returned 0x20
	[0096.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0096.274] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.274] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0096.279] GetLastError () returned 0x0
	[0096.279] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x22b, lpOverlapped=0x0) returned 1
	[0096.280] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x230, lpOverlapped=0x0) returned 1
	[0096.281] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.281] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0096.281] SetEndOfFile (hFile=0x1a0) returned 1
	[0096.282] CloseHandle (hObject=0x1a0) returned 1
	[0096.282] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.282] SetEndOfFile (hFile=0x1a4) returned 1
	[0096.283] CloseHandle (hObject=0x1a4) returned 1
	[0096.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.283] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf")) returned 1
	[0096.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77
	[0096.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77
	[0096.284] lstrlenW (lpString=".doc") returned 4
	[0096.284] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.284] lstrlenW (lpString=".docx") returned 5
	[0096.284] lstrcmpiW (lpString1=".docx", lpString2="G.INF") returned -1
	[0096.284] lstrlenW (lpString=".pdf") returned 4
	[0096.284] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.284] lstrlenW (lpString=".xls") returned 4
	[0096.284] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.284] lstrlenW (lpString=".xlsx") returned 5
	[0096.284] lstrcmpiW (lpString1=".xlsx", lpString2="G.INF") returned -1
	[0096.284] lstrlenW (lpString=".ppt") returned 4
	[0096.284] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77
	[0096.284] lstrlenW (lpString=".zip") returned 4
	[0096.284] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.284] lstrlenW (lpString=".rar") returned 4
	[0096.284] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.284] lstrlenW (lpString=".bz2") returned 4
	[0096.284] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.284] lstrlenW (lpString=".7z") returned 3
	[0096.284] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77
	[0096.285] lstrlenW (lpString=".dbf") returned 4
	[0096.285] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77
	[0096.285] lstrlenW (lpString=".1cd") returned 4
	[0096.285] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77
	[0096.285] lstrlenW (lpString=".jpg") returned 4
	[0096.285] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77
	[0096.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77
	[0096.285] lstrlenW (lpString=".doc") returned 4
	[0096.285] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.285] lstrlenW (lpString=".docx") returned 5
	[0096.285] lstrcmpiW (lpString1=".docx", lpString2="G.INF") returned -1
	[0096.285] lstrlenW (lpString=".pdf") returned 4
	[0096.285] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.285] lstrlenW (lpString=".xls") returned 4
	[0096.285] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.285] lstrlenW (lpString=".xlsx") returned 5
	[0096.285] lstrcmpiW (lpString1=".xlsx", lpString2="G.INF") returned -1
	[0096.285] lstrlenW (lpString=".ppt") returned 4
	[0096.285] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77
	[0096.286] lstrlenW (lpString=".zip") returned 4
	[0096.286] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.286] lstrlenW (lpString=".rar") returned 4
	[0096.286] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.286] lstrlenW (lpString=".bz2") returned 4
	[0096.286] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.286] lstrlenW (lpString=".7z") returned 3
	[0096.286] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77
	[0096.286] lstrlenW (lpString=".dbf") returned 4
	[0096.286] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77
	[0096.286] lstrlenW (lpString=".1cd") returned 4
	[0096.286] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77
	[0096.286] lstrlenW (lpString=".jpg") returned 4
	[0096.286] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.287] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0096.287] lstrlenW (lpString="THEMES.INF") returned 10
	[0096.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0096.287] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=7276) returned 1
	[0096.287] CloseHandle (hObject=0x1a4) returned 1
	[0096.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf")) returned 0x20
	[0096.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0096.288] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.288] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0096.288] GetLastError () returned 0x0
	[0096.289] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1c6c, lpOverlapped=0x0) returned 1
	[0096.290] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1c70, lpOverlapped=0x0) returned 1
	[0096.291] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.292] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0096.292] SetEndOfFile (hFile=0x1a0) returned 1
	[0096.292] CloseHandle (hObject=0x1a0) returned 1
	[0096.292] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.292] SetEndOfFile (hFile=0x1a4) returned 1
	[0096.293] CloseHandle (hObject=0x1a4) returned 1
	[0096.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.293] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf")) returned 1
	[0096.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66
	[0096.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66
	[0096.293] lstrlenW (lpString=".doc") returned 4
	[0096.293] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.294] lstrlenW (lpString=".docx") returned 5
	[0096.294] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0096.294] lstrlenW (lpString=".pdf") returned 4
	[0096.294] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.294] lstrlenW (lpString=".xls") returned 4
	[0096.294] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.294] lstrlenW (lpString=".xlsx") returned 5
	[0096.294] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0096.294] lstrlenW (lpString=".ppt") returned 4
	[0096.294] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66
	[0096.294] lstrlenW (lpString=".zip") returned 4
	[0096.294] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.294] lstrlenW (lpString=".rar") returned 4
	[0096.294] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.294] lstrlenW (lpString=".bz2") returned 4
	[0096.294] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.294] lstrlenW (lpString=".7z") returned 3
	[0096.294] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66
	[0096.294] lstrlenW (lpString=".dbf") returned 4
	[0096.294] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66
	[0096.294] lstrlenW (lpString=".1cd") returned 4
	[0096.294] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66
	[0096.294] lstrlenW (lpString=".jpg") returned 4
	[0096.294] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66
	[0096.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66
	[0096.294] lstrlenW (lpString=".doc") returned 4
	[0096.295] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.295] lstrlenW (lpString=".docx") returned 5
	[0096.295] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0096.295] lstrlenW (lpString=".pdf") returned 4
	[0096.295] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.295] lstrlenW (lpString=".xls") returned 4
	[0096.295] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.295] lstrlenW (lpString=".xlsx") returned 5
	[0096.295] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0096.295] lstrlenW (lpString=".ppt") returned 4
	[0096.295] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66
	[0096.295] lstrlenW (lpString=".zip") returned 4
	[0096.295] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.295] lstrlenW (lpString=".rar") returned 4
	[0096.295] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.295] lstrlenW (lpString=".bz2") returned 4
	[0096.295] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.295] lstrlenW (lpString=".7z") returned 3
	[0096.295] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66
	[0096.295] lstrlenW (lpString=".dbf") returned 4
	[0096.295] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66
	[0096.295] lstrlenW (lpString=".1cd") returned 4
	[0096.295] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66
	[0096.295] lstrlenW (lpString=".jpg") returned 4
	[0096.295] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.296] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0096.296] lstrlenW (lpString="WATER.ELM") returned 9
	[0096.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0096.297] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=65996) returned 1
	[0096.297] CloseHandle (hObject=0x1a0) returned 1
	[0096.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm")) returned 0x20
	[0096.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0096.298] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.298] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0096.299] GetLastError () returned 0x0
	[0096.299] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x101cc, lpOverlapped=0x0) returned 1
	[0096.302] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x101d0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x101d0, lpOverlapped=0x0) returned 1
	[0096.304] ReadFile (in: hFile=0x1a0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.304] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0096.304] SetEndOfFile (hFile=0x19c) returned 1
	[0096.304] CloseHandle (hObject=0x19c) returned 1
	[0096.305] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.305] SetEndOfFile (hFile=0x1a0) returned 1
	[0096.306] CloseHandle (hObject=0x1a0) returned 1
	[0096.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.306] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm")) returned 1
	[0096.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71
	[0096.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71
	[0096.306] lstrlenW (lpString=".doc") returned 4
	[0096.306] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.306] lstrlenW (lpString=".docx") returned 5
	[0096.306] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1
	[0096.306] lstrlenW (lpString=".pdf") returned 4
	[0096.306] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.307] lstrlenW (lpString=".xls") returned 4
	[0096.307] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.307] lstrlenW (lpString=".xlsx") returned 5
	[0096.307] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1
	[0096.307] lstrlenW (lpString=".ppt") returned 4
	[0096.307] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71
	[0096.307] lstrlenW (lpString=".zip") returned 4
	[0096.307] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.307] lstrlenW (lpString=".rar") returned 4
	[0096.307] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.307] lstrlenW (lpString=".bz2") returned 4
	[0096.307] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.307] lstrlenW (lpString=".7z") returned 3
	[0096.307] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71
	[0096.307] lstrlenW (lpString=".dbf") returned 4
	[0096.307] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71
	[0096.307] lstrlenW (lpString=".1cd") returned 4
	[0096.307] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71
	[0096.307] lstrlenW (lpString=".jpg") returned 4
	[0096.307] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71
	[0096.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71
	[0096.307] lstrlenW (lpString=".doc") returned 4
	[0096.307] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.307] lstrlenW (lpString=".docx") returned 5
	[0096.307] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1
	[0096.307] lstrlenW (lpString=".pdf") returned 4
	[0096.308] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.308] lstrlenW (lpString=".xls") returned 4
	[0096.308] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.308] lstrlenW (lpString=".xlsx") returned 5
	[0096.308] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1
	[0096.308] lstrlenW (lpString=".ppt") returned 4
	[0096.308] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71
	[0096.308] lstrlenW (lpString=".zip") returned 4
	[0096.308] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.308] lstrlenW (lpString=".rar") returned 4
	[0096.308] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.308] lstrlenW (lpString=".bz2") returned 4
	[0096.308] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.308] lstrlenW (lpString=".7z") returned 3
	[0096.308] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71
	[0096.308] lstrlenW (lpString=".dbf") returned 4
	[0096.308] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71
	[0096.308] lstrlenW (lpString=".1cd") returned 4
	[0096.308] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71
	[0096.308] lstrlenW (lpString=".jpg") returned 4
	[0096.308] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.308] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0096.309] lstrlenW (lpString="WATER.INF") returned 9
	[0096.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0096.321] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=417) returned 1
	[0096.321] CloseHandle (hObject=0x1b4) returned 1
	[0096.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf")) returned 0x20
	[0096.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0096.322] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.322] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0096.323] GetLastError () returned 0x0
	[0096.323] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1a1, lpOverlapped=0x0) returned 1
	[0096.324] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1b0, lpOverlapped=0x0) returned 1
	[0096.324] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.324] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0096.325] SetEndOfFile (hFile=0x188) returned 1
	[0096.325] CloseHandle (hObject=0x188) returned 1
	[0096.325] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.325] SetEndOfFile (hFile=0x1b4) returned 1
	[0096.326] CloseHandle (hObject=0x1b4) returned 1
	[0096.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.326] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf")) returned 1
	[0096.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71
	[0096.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71
	[0096.326] lstrlenW (lpString=".doc") returned 4
	[0096.326] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.326] lstrlenW (lpString=".docx") returned 5
	[0096.326] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1
	[0096.326] lstrlenW (lpString=".pdf") returned 4
	[0096.327] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.327] lstrlenW (lpString=".xls") returned 4
	[0096.327] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.327] lstrlenW (lpString=".xlsx") returned 5
	[0096.327] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1
	[0096.327] lstrlenW (lpString=".ppt") returned 4
	[0096.327] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71
	[0096.327] lstrlenW (lpString=".zip") returned 4
	[0096.327] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.327] lstrlenW (lpString=".rar") returned 4
	[0096.327] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.327] lstrlenW (lpString=".bz2") returned 4
	[0096.327] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.327] lstrlenW (lpString=".7z") returned 3
	[0096.327] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71
	[0096.327] lstrlenW (lpString=".dbf") returned 4
	[0096.327] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71
	[0096.327] lstrlenW (lpString=".1cd") returned 4
	[0096.327] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71
	[0096.327] lstrlenW (lpString=".jpg") returned 4
	[0096.327] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71
	[0096.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71
	[0096.327] lstrlenW (lpString=".doc") returned 4
	[0096.327] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.327] lstrlenW (lpString=".docx") returned 5
	[0096.327] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1
	[0096.328] lstrlenW (lpString=".pdf") returned 4
	[0096.328] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.328] lstrlenW (lpString=".xls") returned 4
	[0096.328] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.328] lstrlenW (lpString=".xlsx") returned 5
	[0096.328] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1
	[0096.328] lstrlenW (lpString=".ppt") returned 4
	[0096.328] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71
	[0096.328] lstrlenW (lpString=".zip") returned 4
	[0096.328] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.328] lstrlenW (lpString=".rar") returned 4
	[0096.328] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.328] lstrlenW (lpString=".bz2") returned 4
	[0096.328] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.328] lstrlenW (lpString=".7z") returned 3
	[0096.328] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71
	[0096.328] lstrlenW (lpString=".dbf") returned 4
	[0096.328] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71
	[0096.328] lstrlenW (lpString=".1cd") returned 4
	[0096.328] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71
	[0096.328] lstrlenW (lpString=".jpg") returned 4
	[0096.328] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.328] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0096.328] lstrlenW (lpString="WATERMAR.INF") returned 12
	[0096.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0096.333] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=683) returned 1
	[0096.333] CloseHandle (hObject=0x1b4) returned 1
	[0096.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf")) returned 0x20
	[0096.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0096.343] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.343] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0096.358] GetLastError () returned 0x0
	[0096.358] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x2ab, lpOverlapped=0x0) returned 1
	[0096.359] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2b0, lpOverlapped=0x0) returned 1
	[0096.360] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.360] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0096.360] SetEndOfFile (hFile=0x1c8) returned 1
	[0096.365] CloseHandle (hObject=0x1c8) returned 1
	[0096.367] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.367] SetEndOfFile (hFile=0x1b4) returned 1
	[0096.368] CloseHandle (hObject=0x1b4) returned 1
	[0096.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.369] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf")) returned 1
	[0096.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77
	[0096.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77
	[0096.369] lstrlenW (lpString=".doc") returned 4
	[0096.369] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.369] lstrlenW (lpString=".docx") returned 5
	[0096.369] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1
	[0096.369] lstrlenW (lpString=".pdf") returned 4
	[0096.369] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.369] lstrlenW (lpString=".xls") returned 4
	[0096.369] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.369] lstrlenW (lpString=".xlsx") returned 5
	[0096.369] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1
	[0096.369] lstrlenW (lpString=".ppt") returned 4
	[0096.369] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77
	[0096.369] lstrlenW (lpString=".zip") returned 4
	[0096.369] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.369] lstrlenW (lpString=".rar") returned 4
	[0096.369] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.369] lstrlenW (lpString=".bz2") returned 4
	[0096.369] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.369] lstrlenW (lpString=".7z") returned 3
	[0096.369] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77
	[0096.370] lstrlenW (lpString=".dbf") returned 4
	[0096.370] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77
	[0096.370] lstrlenW (lpString=".1cd") returned 4
	[0096.370] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77
	[0096.370] lstrlenW (lpString=".jpg") returned 4
	[0096.370] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77
	[0096.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77
	[0096.370] lstrlenW (lpString=".doc") returned 4
	[0096.370] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.370] lstrlenW (lpString=".docx") returned 5
	[0096.370] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1
	[0096.370] lstrlenW (lpString=".pdf") returned 4
	[0096.370] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.370] lstrlenW (lpString=".xls") returned 4
	[0096.370] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.370] lstrlenW (lpString=".xlsx") returned 5
	[0096.370] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1
	[0096.370] lstrlenW (lpString=".ppt") returned 4
	[0096.370] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77
	[0096.370] lstrlenW (lpString=".zip") returned 4
	[0096.370] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.370] lstrlenW (lpString=".rar") returned 4
	[0096.370] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.370] lstrlenW (lpString=".bz2") returned 4
	[0096.370] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.370] lstrlenW (lpString=".7z") returned 3
	[0096.370] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77
	[0096.370] lstrlenW (lpString=".dbf") returned 4
	[0096.370] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77
	[0096.370] lstrlenW (lpString=".1cd") returned 4
	[0096.371] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77
	[0096.371] lstrlenW (lpString=".jpg") returned 4
	[0096.371] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.371] lstrcmpiW (lpString1=".ITS", lpString2=".adobe") returned 1
	[0096.371] lstrlenW (lpString="MSB1ARFR.ITS") returned 12
	[0096.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0096.372] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1658904) returned 1
	[0096.373] CloseHandle (hObject=0x1b4) returned 1
	[0096.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its")) returned 0x20
	[0096.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.376] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0096.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0096.378] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0096.378] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0096.378] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.396] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0096.396] ReadFile (in: hFile=0x1b4, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.410] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.410] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x155018, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0096.410] ReadFile (in: hFile=0x1b4, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.451] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.451] WriteFile (in: hFile=0x1b4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0096.523] SetEndOfFile (hFile=0x1b4) returned 1
	[0096.524] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x4011028
	[0096.528] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0096.528] WriteFile (in: hFile=0x1b4, lpBuffer=0x4011028*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4011028*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0096.530] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0096.530] WriteFile (in: hFile=0x1b4, lpBuffer=0x4011028*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4011028*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0096.532] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x155018, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0096.532] WriteFile (in: hFile=0x1b4, lpBuffer=0x4011028*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4011028*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0096.534] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x4011028 | out: hHeap=0x5e0000) returned 1
	[0096.534] CloseHandle (hObject=0x1b4) returned 1
	[0096.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73
	[0096.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73
	[0096.535] lstrlenW (lpString=".doc") returned 4
	[0096.535] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1
	[0096.535] lstrlenW (lpString=".docx") returned 5
	[0096.535] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1
	[0096.535] lstrlenW (lpString=".pdf") returned 4
	[0096.535] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1
	[0096.535] lstrlenW (lpString=".xls") returned 4
	[0096.535] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1
	[0096.535] lstrlenW (lpString=".xlsx") returned 5
	[0096.535] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1
	[0096.535] lstrlenW (lpString=".ppt") returned 4
	[0096.535] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1
	[0096.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73
	[0096.535] lstrlenW (lpString=".zip") returned 4
	[0096.535] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1
	[0096.535] lstrlenW (lpString=".rar") returned 4
	[0096.535] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1
	[0096.535] lstrlenW (lpString=".bz2") returned 4
	[0096.535] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1
	[0096.535] lstrlenW (lpString=".7z") returned 3
	[0096.535] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1
	[0096.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73
	[0096.535] lstrlenW (lpString=".dbf") returned 4
	[0096.535] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1
	[0096.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73
	[0096.535] lstrlenW (lpString=".1cd") returned 4
	[0096.535] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1
	[0096.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73
	[0096.535] lstrlenW (lpString=".jpg") returned 4
	[0096.535] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1
	[0096.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73
	[0096.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73
	[0096.536] lstrlenW (lpString=".doc") returned 4
	[0096.536] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1
	[0096.536] lstrlenW (lpString=".docx") returned 5
	[0096.536] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1
	[0096.536] lstrlenW (lpString=".pdf") returned 4
	[0096.536] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1
	[0096.536] lstrlenW (lpString=".xls") returned 4
	[0096.536] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1
	[0096.536] lstrlenW (lpString=".xlsx") returned 5
	[0096.536] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1
	[0096.536] lstrlenW (lpString=".ppt") returned 4
	[0096.536] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1
	[0096.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73
	[0096.536] lstrlenW (lpString=".zip") returned 4
	[0096.536] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1
	[0096.536] lstrlenW (lpString=".rar") returned 4
	[0096.536] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1
	[0096.536] lstrlenW (lpString=".bz2") returned 4
	[0096.536] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1
	[0096.536] lstrlenW (lpString=".7z") returned 3
	[0096.536] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1
	[0096.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73
	[0096.536] lstrlenW (lpString=".dbf") returned 4
	[0096.537] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1
	[0096.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73
	[0096.537] lstrlenW (lpString=".1cd") returned 4
	[0096.537] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1
	[0096.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73
	[0096.537] lstrlenW (lpString=".jpg") returned 4
	[0096.537] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1
	[0096.537] lstrcmpiW (lpString1=".ITS", lpString2=".adobe") returned 1
	[0096.537] lstrlenW (lpString="MSB1ENFR.ITS") returned 12
	[0096.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0096.538] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=943322) returned 1
	[0096.538] CloseHandle (hObject=0x1b4) returned 1
	[0096.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its")) returned 0x20
	[0096.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0096.539] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.539] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0096.540] GetLastError () returned 0x0
	[0096.540] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xe64da, lpOverlapped=0x0) returned 1
	[0096.601] WriteFile (in: hFile=0x160, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe64e0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe64e0, lpOverlapped=0x0) returned 1
	[0096.621] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.621] WriteFile (in: hFile=0x160, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0096.621] SetEndOfFile (hFile=0x160) returned 1
	[0096.621] CloseHandle (hObject=0x160) returned 1
	[0096.622] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.622] SetEndOfFile (hFile=0x1b4) returned 1
	[0096.630] CloseHandle (hObject=0x1b4) returned 1
	[0096.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.630] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its")) returned 1
	[0096.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73
	[0096.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73
	[0096.630] lstrlenW (lpString=".doc") returned 4
	[0096.630] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1
	[0096.630] lstrlenW (lpString=".docx") returned 5
	[0096.630] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1
	[0096.630] lstrlenW (lpString=".pdf") returned 4
	[0096.630] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1
	[0096.631] lstrlenW (lpString=".xls") returned 4
	[0096.631] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1
	[0096.631] lstrlenW (lpString=".xlsx") returned 5
	[0096.631] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1
	[0096.631] lstrlenW (lpString=".ppt") returned 4
	[0096.631] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1
	[0096.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73
	[0096.631] lstrlenW (lpString=".zip") returned 4
	[0096.631] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1
	[0096.631] lstrlenW (lpString=".rar") returned 4
	[0096.631] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1
	[0096.631] lstrlenW (lpString=".bz2") returned 4
	[0096.631] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1
	[0096.631] lstrlenW (lpString=".7z") returned 3
	[0096.631] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1
	[0096.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73
	[0096.631] lstrlenW (lpString=".dbf") returned 4
	[0096.631] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1
	[0096.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73
	[0096.632] lstrlenW (lpString=".1cd") returned 4
	[0096.632] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1
	[0096.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73
	[0096.632] lstrlenW (lpString=".jpg") returned 4
	[0096.632] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1
	[0096.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73
	[0096.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73
	[0096.632] lstrlenW (lpString=".doc") returned 4
	[0096.632] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1
	[0096.632] lstrlenW (lpString=".docx") returned 5
	[0096.632] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1
	[0096.632] lstrlenW (lpString=".pdf") returned 4
	[0096.632] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1
	[0096.632] lstrlenW (lpString=".xls") returned 4
	[0096.632] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1
	[0096.632] lstrlenW (lpString=".xlsx") returned 5
	[0096.632] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1
	[0096.632] lstrlenW (lpString=".ppt") returned 4
	[0096.632] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1
	[0096.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73
	[0096.632] lstrlenW (lpString=".zip") returned 4
	[0096.632] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1
	[0096.632] lstrlenW (lpString=".rar") returned 4
	[0096.632] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1
	[0096.633] lstrlenW (lpString=".bz2") returned 4
	[0096.633] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1
	[0096.633] lstrlenW (lpString=".7z") returned 3
	[0096.633] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1
	[0096.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73
	[0096.633] lstrlenW (lpString=".dbf") returned 4
	[0096.633] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1
	[0096.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73
	[0096.633] lstrlenW (lpString=".1cd") returned 4
	[0096.633] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1
	[0096.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73
	[0096.633] lstrlenW (lpString=".jpg") returned 4
	[0096.633] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1
	[0096.633] lstrcmpiW (lpString1=".LEX", lpString2=".adobe") returned 1
	[0096.633] lstrlenW (lpString="WT61ES.LEX") returned 10
	[0096.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0096.634] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=678912) returned 1
	[0096.634] CloseHandle (hObject=0x1b4) returned 1
	[0096.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex")) returned 0x20
	[0096.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0096.634] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.635] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0096.636] GetLastError () returned 0x0
	[0096.636] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xa5c00, lpOverlapped=0x0) returned 1
	[0096.717] WriteFile (in: hFile=0x160, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xa5c10, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xa5c10, lpOverlapped=0x0) returned 1
	[0096.734] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.734] WriteFile (in: hFile=0x160, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0096.734] SetEndOfFile (hFile=0x160) returned 1
	[0096.734] CloseHandle (hObject=0x160) returned 1
	[0096.735] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.735] SetEndOfFile (hFile=0x1b4) returned 1
	[0096.741] CloseHandle (hObject=0x1b4) returned 1
	[0096.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.742] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex")) returned 1
	[0096.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71
	[0096.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71
	[0096.742] lstrlenW (lpString=".doc") returned 4
	[0096.742] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1
	[0096.742] lstrlenW (lpString=".docx") returned 5
	[0096.742] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1
	[0096.742] lstrlenW (lpString=".pdf") returned 4
	[0096.742] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1
	[0096.743] lstrlenW (lpString=".xls") returned 4
	[0096.743] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1
	[0096.743] lstrlenW (lpString=".xlsx") returned 5
	[0096.743] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1
	[0096.743] lstrlenW (lpString=".ppt") returned 4
	[0096.743] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1
	[0096.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71
	[0096.743] lstrlenW (lpString=".zip") returned 4
	[0096.743] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1
	[0096.743] lstrlenW (lpString=".rar") returned 4
	[0096.743] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1
	[0096.743] lstrlenW (lpString=".bz2") returned 4
	[0096.743] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1
	[0096.743] lstrlenW (lpString=".7z") returned 3
	[0096.743] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1
	[0096.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71
	[0096.743] lstrlenW (lpString=".dbf") returned 4
	[0096.743] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1
	[0096.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71
	[0096.743] lstrlenW (lpString=".1cd") returned 4
	[0096.743] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1
	[0096.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71
	[0096.743] lstrlenW (lpString=".jpg") returned 4
	[0096.743] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1
	[0096.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71
	[0096.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71
	[0096.743] lstrlenW (lpString=".doc") returned 4
	[0096.743] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1
	[0096.743] lstrlenW (lpString=".docx") returned 5
	[0096.743] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1
	[0096.743] lstrlenW (lpString=".pdf") returned 4
	[0096.744] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1
	[0096.744] lstrlenW (lpString=".xls") returned 4
	[0096.744] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1
	[0096.744] lstrlenW (lpString=".xlsx") returned 5
	[0096.744] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1
	[0096.744] lstrlenW (lpString=".ppt") returned 4
	[0096.744] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1
	[0096.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71
	[0096.744] lstrlenW (lpString=".zip") returned 4
	[0096.744] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1
	[0096.744] lstrlenW (lpString=".rar") returned 4
	[0096.744] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1
	[0096.744] lstrlenW (lpString=".bz2") returned 4
	[0096.744] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1
	[0096.744] lstrlenW (lpString=".7z") returned 3
	[0096.744] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1
	[0096.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71
	[0096.744] lstrlenW (lpString=".dbf") returned 4
	[0096.744] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1
	[0096.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71
	[0096.744] lstrlenW (lpString=".1cd") returned 4
	[0096.744] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1
	[0096.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71
	[0096.744] lstrlenW (lpString=".jpg") returned 4
	[0096.744] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1
	[0096.744] lstrcmpiW (lpString1=".ITS", lpString2=".adobe") returned 1
	[0096.744] lstrlenW (lpString="MSB1FRAR.ITS") returned 12
	[0096.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0096.745] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1469358) returned 1
	[0096.745] CloseHandle (hObject=0x1b4) returned 1
	[0096.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its")) returned 0x20
	[0096.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0096.746] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.746] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0096.746] GetLastError () returned 0x0
	[0096.746] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0096.844] WriteFile (in: hFile=0x1c0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0096.909] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x66bbe, lpOverlapped=0x0) returned 1
	[0096.935] WriteFile (in: hFile=0x1c0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x66bc0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x66bc0, lpOverlapped=0x0) returned 1
	[0096.951] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.951] WriteFile (in: hFile=0x1c0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0096.951] SetEndOfFile (hFile=0x1c0) returned 1
	[0096.951] CloseHandle (hObject=0x1c0) returned 1
	[0096.951] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.952] SetEndOfFile (hFile=0x1b4) returned 1
	[0096.956] CloseHandle (hObject=0x1b4) returned 1
	[0096.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.957] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its")) returned 1
	[0096.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73
	[0096.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73
	[0096.957] lstrlenW (lpString=".doc") returned 4
	[0096.957] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1
	[0096.957] lstrlenW (lpString=".docx") returned 5
	[0096.957] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1
	[0096.957] lstrlenW (lpString=".pdf") returned 4
	[0096.957] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1
	[0096.957] lstrlenW (lpString=".xls") returned 4
	[0096.957] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1
	[0096.957] lstrlenW (lpString=".xlsx") returned 5
	[0096.958] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1
	[0096.958] lstrlenW (lpString=".ppt") returned 4
	[0096.958] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1
	[0096.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73
	[0096.958] lstrlenW (lpString=".zip") returned 4
	[0096.958] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1
	[0096.958] lstrlenW (lpString=".rar") returned 4
	[0096.958] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1
	[0096.958] lstrlenW (lpString=".bz2") returned 4
	[0096.958] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1
	[0096.958] lstrlenW (lpString=".7z") returned 3
	[0096.958] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1
	[0096.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73
	[0096.958] lstrlenW (lpString=".dbf") returned 4
	[0096.958] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1
	[0096.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73
	[0096.958] lstrlenW (lpString=".1cd") returned 4
	[0096.958] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1
	[0096.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73
	[0096.958] lstrlenW (lpString=".jpg") returned 4
	[0096.958] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1
	[0096.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73
	[0096.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73
	[0096.958] lstrlenW (lpString=".doc") returned 4
	[0096.959] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1
	[0096.959] lstrlenW (lpString=".docx") returned 5
	[0096.959] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1
	[0096.959] lstrlenW (lpString=".pdf") returned 4
	[0096.959] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1
	[0096.959] lstrlenW (lpString=".xls") returned 4
	[0096.959] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1
	[0096.959] lstrlenW (lpString=".xlsx") returned 5
	[0096.959] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1
	[0096.959] lstrlenW (lpString=".ppt") returned 4
	[0096.959] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1
	[0096.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73
	[0096.978] lstrlenW (lpString=".zip") returned 4
	[0096.978] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1
	[0096.979] lstrlenW (lpString=".rar") returned 4
	[0096.979] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1
	[0096.979] lstrlenW (lpString=".bz2") returned 4
	[0096.979] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1
	[0096.979] lstrlenW (lpString=".7z") returned 3
	[0096.979] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1
	[0096.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73
	[0096.979] lstrlenW (lpString=".dbf") returned 4
	[0096.979] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1
	[0096.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73
	[0096.979] lstrlenW (lpString=".1cd") returned 4
	[0096.979] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1
	[0096.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73
	[0096.979] lstrlenW (lpString=".jpg") returned 4
	[0096.979] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1
	[0096.979] lstrcmpiW (lpString1=".LEX", lpString2=".adobe") returned 1
	[0096.979] lstrlenW (lpString="WT61FR.LEX") returned 10
	[0096.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0096.990] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=616960) returned 1
	[0096.990] CloseHandle (hObject=0x160) returned 1
	[0096.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex")) returned 0x20
	[0096.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0096.991] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.991] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0096.992] GetLastError () returned 0x0
	[0096.992] ReadFile (in: hFile=0x160, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x96a00, lpOverlapped=0x0) returned 1
	[0097.030] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x96a10, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x96a10, lpOverlapped=0x0) returned 1
	[0097.043] ReadFile (in: hFile=0x160, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.044] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0097.044] SetEndOfFile (hFile=0x1c8) returned 1
	[0097.044] CloseHandle (hObject=0x1c8) returned 1
	[0097.044] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.044] SetEndOfFile (hFile=0x160) returned 1
	[0097.050] CloseHandle (hObject=0x160) returned 1
	[0097.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.050] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex")) returned 1
	[0097.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71
	[0097.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71
	[0097.050] lstrlenW (lpString=".doc") returned 4
	[0097.050] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1
	[0097.050] lstrlenW (lpString=".docx") returned 5
	[0097.050] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1
	[0097.050] lstrlenW (lpString=".pdf") returned 4
	[0097.050] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1
	[0097.050] lstrlenW (lpString=".xls") returned 4
	[0097.050] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1
	[0097.051] lstrlenW (lpString=".xlsx") returned 5
	[0097.051] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1
	[0097.051] lstrlenW (lpString=".ppt") returned 4
	[0097.051] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1
	[0097.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71
	[0097.051] lstrlenW (lpString=".zip") returned 4
	[0097.051] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1
	[0097.051] lstrlenW (lpString=".rar") returned 4
	[0097.051] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1
	[0097.051] lstrlenW (lpString=".bz2") returned 4
	[0097.051] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1
	[0097.051] lstrlenW (lpString=".7z") returned 3
	[0097.051] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1
	[0097.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71
	[0097.051] lstrlenW (lpString=".dbf") returned 4
	[0097.051] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1
	[0097.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71
	[0097.051] lstrlenW (lpString=".1cd") returned 4
	[0097.051] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1
	[0097.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71
	[0097.051] lstrlenW (lpString=".jpg") returned 4
	[0097.051] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1
	[0097.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71
	[0097.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71
	[0097.051] lstrlenW (lpString=".doc") returned 4
	[0097.051] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1
	[0097.051] lstrlenW (lpString=".docx") returned 5
	[0097.051] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1
	[0097.051] lstrlenW (lpString=".pdf") returned 4
	[0097.051] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1
	[0097.051] lstrlenW (lpString=".xls") returned 4
	[0097.052] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1
	[0097.052] lstrlenW (lpString=".xlsx") returned 5
	[0097.052] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1
	[0097.052] lstrlenW (lpString=".ppt") returned 4
	[0097.052] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1
	[0097.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71
	[0097.052] lstrlenW (lpString=".zip") returned 4
	[0097.052] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1
	[0097.052] lstrlenW (lpString=".rar") returned 4
	[0097.052] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1
	[0097.052] lstrlenW (lpString=".bz2") returned 4
	[0097.052] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1
	[0097.052] lstrlenW (lpString=".7z") returned 3
	[0097.052] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1
	[0097.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71
	[0097.052] lstrlenW (lpString=".dbf") returned 4
	[0097.052] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1
	[0097.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71
	[0097.052] lstrlenW (lpString=".1cd") returned 4
	[0097.052] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1
	[0097.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71
	[0097.052] lstrlenW (lpString=".jpg") returned 4
	[0097.052] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1
	[0097.052] lstrcmpiW (lpString1=".LEX", lpString2=".adobe") returned 1
	[0097.052] lstrlenW (lpString="MSB1AR.LEX") returned 10
	[0097.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0097.129] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=2120459) returned 1
	[0097.129] CloseHandle (hObject=0x1a0) returned 1
	[0097.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex")) returned 0x20
	[0097.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0097.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0097.149] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0097.149] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0097.149] ReadFile (in: hFile=0x188, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0097.182] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0097.182] ReadFile (in: hFile=0x188, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0097.253] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.253] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1c5b0b, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0097.253] ReadFile (in: hFile=0x188, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0097.309] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.310] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0097.346] SetEndOfFile (hFile=0x188) returned 1
	[0097.347] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x4001020
	[0097.352] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0097.352] WriteFile (in: hFile=0x188, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0097.354] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0097.354] WriteFile (in: hFile=0x188, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0097.357] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1c5b0b, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0097.357] WriteFile (in: hFile=0x188, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0097.358] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x4001020 | out: hHeap=0x5e0000) returned 1
	[0097.358] CloseHandle (hObject=0x188) returned 1
	[0097.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66
	[0097.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66
	[0097.359] lstrlenW (lpString=".doc") returned 4
	[0097.359] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1
	[0097.359] lstrlenW (lpString=".docx") returned 5
	[0097.359] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1
	[0097.359] lstrlenW (lpString=".pdf") returned 4
	[0097.359] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1
	[0097.359] lstrlenW (lpString=".xls") returned 4
	[0097.359] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1
	[0097.359] lstrlenW (lpString=".xlsx") returned 5
	[0097.359] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1
	[0097.359] lstrlenW (lpString=".ppt") returned 4
	[0097.359] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1
	[0097.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66
	[0097.359] lstrlenW (lpString=".zip") returned 4
	[0097.359] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1
	[0097.359] lstrlenW (lpString=".rar") returned 4
	[0097.359] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1
	[0097.359] lstrlenW (lpString=".bz2") returned 4
	[0097.360] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1
	[0097.360] lstrlenW (lpString=".7z") returned 3
	[0097.360] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1
	[0097.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66
	[0097.360] lstrlenW (lpString=".dbf") returned 4
	[0097.360] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1
	[0097.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66
	[0097.360] lstrlenW (lpString=".1cd") returned 4
	[0097.360] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1
	[0097.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66
	[0097.360] lstrlenW (lpString=".jpg") returned 4
	[0097.360] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1
	[0097.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66
	[0097.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66
	[0097.360] lstrlenW (lpString=".doc") returned 4
	[0097.360] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1
	[0097.360] lstrlenW (lpString=".docx") returned 5
	[0097.360] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1
	[0097.360] lstrlenW (lpString=".pdf") returned 4
	[0097.360] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1
	[0097.360] lstrlenW (lpString=".xls") returned 4
	[0097.360] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1
	[0097.360] lstrlenW (lpString=".xlsx") returned 5
	[0097.360] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1
	[0097.360] lstrlenW (lpString=".ppt") returned 4
	[0097.360] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1
	[0097.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66
	[0097.361] lstrlenW (lpString=".zip") returned 4
	[0097.361] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1
	[0097.361] lstrlenW (lpString=".rar") returned 4
	[0097.361] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1
	[0097.361] lstrlenW (lpString=".bz2") returned 4
	[0097.361] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1
	[0097.361] lstrlenW (lpString=".7z") returned 3
	[0097.361] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1
	[0097.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66
	[0097.361] lstrlenW (lpString=".dbf") returned 4
	[0097.361] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1
	[0097.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66
	[0097.361] lstrlenW (lpString=".1cd") returned 4
	[0097.361] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1
	[0097.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66
	[0097.361] lstrlenW (lpString=".jpg") returned 4
	[0097.361] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1
	[0097.361] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0097.361] lstrlenW (lpString="VBE7.DLL") returned 8
	[0097.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0097.373] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=3675976) returned 1
	[0097.373] CloseHandle (hObject=0x1c0) returned 1
	[0097.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll")) returned 0x20
	[0097.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0097.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0097.374] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0097.374] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0097.374] ReadFile (in: hFile=0x1c0, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0097.417] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x12b26d, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0097.417] ReadFile (in: hFile=0x1c0, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0097.444] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.445] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x341748, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0097.445] ReadFile (in: hFile=0x1c0, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0097.515] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.515] WriteFile (in: hFile=0x1c0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc00fc, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc00fc, lpOverlapped=0x0) returned 1
	[0097.543] SetEndOfFile (hFile=0x1c0) returned 1
	[0097.544] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x4021030
	[0097.547] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0097.548] WriteFile (in: hFile=0x1c0, lpBuffer=0x4021030*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4021030*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0097.549] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x12b26d, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0097.549] WriteFile (in: hFile=0x1c0, lpBuffer=0x4021030*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4021030*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0097.554] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x341748, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0097.554] WriteFile (in: hFile=0x1c0, lpBuffer=0x4021030*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4021030*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0097.557] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x4021030 | out: hHeap=0x5e0000) returned 1
	[0097.557] CloseHandle (hObject=0x1c0) returned 1
	[0097.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64
	[0097.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64
	[0097.557] lstrlenW (lpString=".doc") returned 4
	[0097.557] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0097.557] lstrlenW (lpString=".docx") returned 5
	[0097.557] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1
	[0097.557] lstrlenW (lpString=".pdf") returned 4
	[0097.558] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0097.558] lstrlenW (lpString=".xls") returned 4
	[0097.558] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0097.558] lstrlenW (lpString=".xlsx") returned 5
	[0097.558] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1
	[0097.558] lstrlenW (lpString=".ppt") returned 4
	[0097.558] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0097.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64
	[0097.558] lstrlenW (lpString=".zip") returned 4
	[0097.558] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0097.558] lstrlenW (lpString=".rar") returned 4
	[0097.558] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0097.558] lstrlenW (lpString=".bz2") returned 4
	[0097.558] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0097.558] lstrlenW (lpString=".7z") returned 3
	[0097.558] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0097.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64
	[0097.558] lstrlenW (lpString=".dbf") returned 4
	[0097.558] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0097.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64
	[0097.558] lstrlenW (lpString=".1cd") returned 4
	[0097.559] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0097.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64
	[0097.559] lstrlenW (lpString=".jpg") returned 4
	[0097.559] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0097.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64
	[0097.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64
	[0097.559] lstrlenW (lpString=".doc") returned 4
	[0097.559] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0097.559] lstrlenW (lpString=".docx") returned 5
	[0097.559] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1
	[0097.559] lstrlenW (lpString=".pdf") returned 4
	[0097.559] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0097.559] lstrlenW (lpString=".xls") returned 4
	[0097.559] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0097.559] lstrlenW (lpString=".xlsx") returned 5
	[0097.559] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1
	[0097.559] lstrlenW (lpString=".ppt") returned 4
	[0097.559] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0097.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64
	[0097.559] lstrlenW (lpString=".zip") returned 4
	[0097.560] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0097.560] lstrlenW (lpString=".rar") returned 4
	[0097.560] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0097.560] lstrlenW (lpString=".bz2") returned 4
	[0097.560] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0097.560] lstrlenW (lpString=".7z") returned 3
	[0097.560] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0097.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64
	[0097.560] lstrlenW (lpString=".dbf") returned 4
	[0097.560] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0097.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64
	[0097.560] lstrlenW (lpString=".1cd") returned 4
	[0097.560] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0097.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64
	[0097.560] lstrlenW (lpString=".jpg") returned 4
	[0097.560] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0097.560] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0097.560] lstrlenW (lpString="msdia90.dll") returned 11
	[0097.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0097.561] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=855376) returned 1
	[0097.561] CloseHandle (hObject=0x1c0) returned 1
	[0097.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20
	[0097.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0097.562] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.562] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0097.601] GetLastError () returned 0x0
	[0097.601] ReadFile (in: hFile=0x1c0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xd0d50, lpOverlapped=0x0) returned 1
	[0097.686] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xd0d60, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xd0d60, lpOverlapped=0x0) returned 1
	[0097.704] ReadFile (in: hFile=0x1c0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.704] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0097.704] SetEndOfFile (hFile=0x1b0) returned 1
	[0097.705] CloseHandle (hObject=0x1b0) returned 1
	[0097.705] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.705] SetEndOfFile (hFile=0x1c0) returned 1
	[0097.714] CloseHandle (hObject=0x1c0) returned 1
	[0097.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.715] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 1
	[0097.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61
	[0097.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61
	[0097.715] lstrlenW (lpString=".doc") returned 4
	[0097.715] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0097.715] lstrlenW (lpString=".docx") returned 5
	[0097.715] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0097.715] lstrlenW (lpString=".pdf") returned 4
	[0097.715] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0097.715] lstrlenW (lpString=".xls") returned 4
	[0097.715] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0097.715] lstrlenW (lpString=".xlsx") returned 5
	[0097.715] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0097.715] lstrlenW (lpString=".ppt") returned 4
	[0097.715] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0097.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61
	[0097.716] lstrlenW (lpString=".zip") returned 4
	[0097.716] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0097.716] lstrlenW (lpString=".rar") returned 4
	[0097.716] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0097.716] lstrlenW (lpString=".bz2") returned 4
	[0097.716] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0097.716] lstrlenW (lpString=".7z") returned 3
	[0097.716] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0097.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61
	[0097.716] lstrlenW (lpString=".dbf") returned 4
	[0097.716] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0097.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61
	[0097.716] lstrlenW (lpString=".1cd") returned 4
	[0097.716] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0097.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61
	[0097.716] lstrlenW (lpString=".jpg") returned 4
	[0097.716] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0097.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61
	[0097.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61
	[0097.716] lstrlenW (lpString=".doc") returned 4
	[0097.716] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0097.716] lstrlenW (lpString=".docx") returned 5
	[0097.716] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0097.716] lstrlenW (lpString=".pdf") returned 4
	[0097.717] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0097.717] lstrlenW (lpString=".xls") returned 4
	[0097.717] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0097.717] lstrlenW (lpString=".xlsx") returned 5
	[0097.717] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0097.717] lstrlenW (lpString=".ppt") returned 4
	[0097.717] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0097.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61
	[0097.717] lstrlenW (lpString=".zip") returned 4
	[0097.717] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0097.717] lstrlenW (lpString=".rar") returned 4
	[0097.717] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0097.717] lstrlenW (lpString=".bz2") returned 4
	[0097.717] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0097.717] lstrlenW (lpString=".7z") returned 3
	[0097.717] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0097.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61
	[0097.717] lstrlenW (lpString=".dbf") returned 4
	[0097.717] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0097.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61
	[0097.717] lstrlenW (lpString=".1cd") returned 4
	[0097.717] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0097.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61
	[0097.717] lstrlenW (lpString=".jpg") returned 4
	[0097.717] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0097.718] lstrcmpiW (lpString1=".SHX", lpString2=".adobe") returned 1
	[0097.718] lstrlenW (lpString="CHINESET.SHX") returned 12
	[0097.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0097.719] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=665117) returned 1
	[0097.719] CloseHandle (hObject=0x1c0) returned 1
	[0097.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx")) returned 0x20
	[0097.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0097.719] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.719] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0097.720] GetLastError () returned 0x0
	[0097.720] ReadFile (in: hFile=0x1c0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xa261d, lpOverlapped=0x0) returned 1
	[0097.779] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xa2620, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xa2620, lpOverlapped=0x0) returned 1
	[0097.796] ReadFile (in: hFile=0x1c0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.796] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0097.796] SetEndOfFile (hFile=0x1b0) returned 1
	[0097.796] CloseHandle (hObject=0x1b0) returned 1
	[0097.796] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.796] SetEndOfFile (hFile=0x1c0) returned 1
	[0097.830] CloseHandle (hObject=0x1c0) returned 1
	[0097.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.830] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx")) returned 1
	[0097.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78
	[0097.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78
	[0097.830] lstrlenW (lpString=".doc") returned 4
	[0097.830] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0097.830] lstrlenW (lpString=".docx") returned 5
	[0097.830] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0097.830] lstrlenW (lpString=".pdf") returned 4
	[0097.830] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0097.830] lstrlenW (lpString=".xls") returned 4
	[0097.830] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0097.831] lstrlenW (lpString=".xlsx") returned 5
	[0097.831] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0097.831] lstrlenW (lpString=".ppt") returned 4
	[0097.831] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0097.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78
	[0097.831] lstrlenW (lpString=".zip") returned 4
	[0097.831] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0097.831] lstrlenW (lpString=".rar") returned 4
	[0097.831] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0097.831] lstrlenW (lpString=".bz2") returned 4
	[0097.831] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0097.831] lstrlenW (lpString=".7z") returned 3
	[0097.831] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0097.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78
	[0097.831] lstrlenW (lpString=".dbf") returned 4
	[0097.831] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0097.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78
	[0097.831] lstrlenW (lpString=".1cd") returned 4
	[0097.831] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0097.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78
	[0097.831] lstrlenW (lpString=".jpg") returned 4
	[0097.831] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0097.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78
	[0097.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78
	[0097.832] lstrlenW (lpString=".doc") returned 4
	[0097.832] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0097.832] lstrlenW (lpString=".docx") returned 5
	[0097.832] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0097.832] lstrlenW (lpString=".pdf") returned 4
	[0097.832] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0097.832] lstrlenW (lpString=".xls") returned 4
	[0097.832] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0097.832] lstrlenW (lpString=".xlsx") returned 5
	[0097.832] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0097.832] lstrlenW (lpString=".ppt") returned 4
	[0097.832] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0097.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78
	[0097.832] lstrlenW (lpString=".zip") returned 4
	[0097.832] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0097.832] lstrlenW (lpString=".rar") returned 4
	[0097.832] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0097.832] lstrlenW (lpString=".bz2") returned 4
	[0097.832] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0097.832] lstrlenW (lpString=".7z") returned 3
	[0097.832] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0097.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78
	[0097.832] lstrlenW (lpString=".dbf") returned 4
	[0097.832] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0097.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78
	[0097.832] lstrlenW (lpString=".1cd") returned 4
	[0097.832] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0097.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78
	[0097.832] lstrlenW (lpString=".jpg") returned 4
	[0097.832] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0097.833] lstrcmpiW (lpString1=".SHX", lpString2=".adobe") returned 1
	[0097.833] lstrlenW (lpString="IC-TXT.SHX") returned 10
	[0097.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0097.833] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=11009) returned 1
	[0097.833] CloseHandle (hObject=0x1c0) returned 1
	[0097.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx")) returned 0x20
	[0097.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0097.834] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.834] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0097.834] GetLastError () returned 0x0
	[0097.834] ReadFile (in: hFile=0x1c0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x2b01, lpOverlapped=0x0) returned 1
	[0097.838] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2b10, lpOverlapped=0x0) returned 1
	[0097.839] ReadFile (in: hFile=0x1c0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.839] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0097.839] SetEndOfFile (hFile=0x1b0) returned 1
	[0097.840] CloseHandle (hObject=0x1b0) returned 1
	[0097.840] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.840] SetEndOfFile (hFile=0x1c0) returned 1
	[0097.840] CloseHandle (hObject=0x1c0) returned 1
	[0097.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.841] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx")) returned 1
	[0097.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76
	[0097.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76
	[0097.841] lstrlenW (lpString=".doc") returned 4
	[0097.841] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0097.841] lstrlenW (lpString=".docx") returned 5
	[0097.841] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0097.841] lstrlenW (lpString=".pdf") returned 4
	[0097.841] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0097.841] lstrlenW (lpString=".xls") returned 4
	[0097.841] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0097.841] lstrlenW (lpString=".xlsx") returned 5
	[0097.841] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0097.841] lstrlenW (lpString=".ppt") returned 4
	[0097.841] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0097.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76
	[0097.841] lstrlenW (lpString=".zip") returned 4
	[0097.841] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0097.841] lstrlenW (lpString=".rar") returned 4
	[0097.841] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0097.841] lstrlenW (lpString=".bz2") returned 4
	[0097.842] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0097.842] lstrlenW (lpString=".7z") returned 3
	[0097.842] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0097.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76
	[0097.842] lstrlenW (lpString=".dbf") returned 4
	[0097.842] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0097.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76
	[0097.842] lstrlenW (lpString=".1cd") returned 4
	[0097.842] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0097.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76
	[0097.842] lstrlenW (lpString=".jpg") returned 4
	[0097.842] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0097.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76
	[0097.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76
	[0097.842] lstrlenW (lpString=".doc") returned 4
	[0097.842] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0097.842] lstrlenW (lpString=".docx") returned 5
	[0097.842] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0097.842] lstrlenW (lpString=".pdf") returned 4
	[0097.842] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0097.842] lstrlenW (lpString=".xls") returned 4
	[0097.842] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0097.842] lstrlenW (lpString=".xlsx") returned 5
	[0097.842] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0097.842] lstrlenW (lpString=".ppt") returned 4
	[0097.842] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0097.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76
	[0097.842] lstrlenW (lpString=".zip") returned 4
	[0097.843] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0097.843] lstrlenW (lpString=".rar") returned 4
	[0097.843] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0097.843] lstrlenW (lpString=".bz2") returned 4
	[0097.843] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0097.843] lstrlenW (lpString=".7z") returned 3
	[0097.843] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0097.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76
	[0097.843] lstrlenW (lpString=".dbf") returned 4
	[0097.843] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0097.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76
	[0097.843] lstrlenW (lpString=".1cd") returned 4
	[0097.843] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0097.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76
	[0097.843] lstrlenW (lpString=".jpg") returned 4
	[0097.843] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0097.843] lstrcmpiW (lpString1=".FMP", lpString2=".adobe") returned 1
	[0097.843] lstrlenW (lpString="ICAD.FMP") returned 8
	[0097.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0097.844] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=326) returned 1
	[0097.844] CloseHandle (hObject=0x1c0) returned 1
	[0097.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp")) returned 0x20
	[0097.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0097.844] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.845] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0097.845] GetLastError () returned 0x0
	[0097.845] ReadFile (in: hFile=0x1c0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x146, lpOverlapped=0x0) returned 1
	[0097.846] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x150, lpOverlapped=0x0) returned 1
	[0097.850] ReadFile (in: hFile=0x1c0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.850] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0097.850] SetEndOfFile (hFile=0x1b0) returned 1
	[0097.850] CloseHandle (hObject=0x1b0) returned 1
	[0097.850] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.850] SetEndOfFile (hFile=0x1c0) returned 1
	[0097.851] CloseHandle (hObject=0x1c0) returned 1
	[0097.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.851] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp")) returned 1
	[0097.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74
	[0097.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74
	[0097.852] lstrlenW (lpString=".doc") returned 4
	[0097.852] lstrcmpiW (lpString1=".doc", lpString2=".FMP") returned -1
	[0097.852] lstrlenW (lpString=".docx") returned 5
	[0097.852] lstrcmpiW (lpString1=".docx", lpString2="D.FMP") returned -1
	[0097.852] lstrlenW (lpString=".pdf") returned 4
	[0097.852] lstrcmpiW (lpString1=".pdf", lpString2=".FMP") returned 1
	[0097.852] lstrlenW (lpString=".xls") returned 4
	[0097.852] lstrcmpiW (lpString1=".xls", lpString2=".FMP") returned 1
	[0097.852] lstrlenW (lpString=".xlsx") returned 5
	[0097.852] lstrcmpiW (lpString1=".xlsx", lpString2="D.FMP") returned -1
	[0097.852] lstrlenW (lpString=".ppt") returned 4
	[0097.852] lstrcmpiW (lpString1=".ppt", lpString2=".FMP") returned 1
	[0097.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74
	[0097.852] lstrlenW (lpString=".zip") returned 4
	[0097.852] lstrcmpiW (lpString1=".zip", lpString2=".FMP") returned 1
	[0097.852] lstrlenW (lpString=".rar") returned 4
	[0097.852] lstrcmpiW (lpString1=".rar", lpString2=".FMP") returned 1
	[0097.852] lstrlenW (lpString=".bz2") returned 4
	[0097.852] lstrcmpiW (lpString1=".bz2", lpString2=".FMP") returned -1
	[0097.852] lstrlenW (lpString=".7z") returned 3
	[0097.852] lstrcmpiW (lpString1=".7z", lpString2="FMP") returned -1
	[0097.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74
	[0097.852] lstrlenW (lpString=".dbf") returned 4
	[0097.852] lstrcmpiW (lpString1=".dbf", lpString2=".FMP") returned -1
	[0097.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74
	[0097.852] lstrlenW (lpString=".1cd") returned 4
	[0097.852] lstrcmpiW (lpString1=".1cd", lpString2=".FMP") returned -1
	[0097.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74
	[0097.852] lstrlenW (lpString=".jpg") returned 4
	[0097.852] lstrcmpiW (lpString1=".jpg", lpString2=".FMP") returned 1
	[0097.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74
	[0097.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74
	[0097.853] lstrlenW (lpString=".doc") returned 4
	[0097.853] lstrcmpiW (lpString1=".doc", lpString2=".FMP") returned -1
	[0097.853] lstrlenW (lpString=".docx") returned 5
	[0097.853] lstrcmpiW (lpString1=".docx", lpString2="D.FMP") returned -1
	[0097.853] lstrlenW (lpString=".pdf") returned 4
	[0097.853] lstrcmpiW (lpString1=".pdf", lpString2=".FMP") returned 1
	[0097.853] lstrlenW (lpString=".xls") returned 4
	[0097.853] lstrcmpiW (lpString1=".xls", lpString2=".FMP") returned 1
	[0097.853] lstrlenW (lpString=".xlsx") returned 5
	[0097.853] lstrcmpiW (lpString1=".xlsx", lpString2="D.FMP") returned -1
	[0097.853] lstrlenW (lpString=".ppt") returned 4
	[0097.853] lstrcmpiW (lpString1=".ppt", lpString2=".FMP") returned 1
	[0097.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74
	[0097.853] lstrlenW (lpString=".zip") returned 4
	[0097.853] lstrcmpiW (lpString1=".zip", lpString2=".FMP") returned 1
	[0097.853] lstrlenW (lpString=".rar") returned 4
	[0097.853] lstrcmpiW (lpString1=".rar", lpString2=".FMP") returned 1
	[0097.853] lstrlenW (lpString=".bz2") returned 4
	[0097.853] lstrcmpiW (lpString1=".bz2", lpString2=".FMP") returned -1
	[0097.853] lstrlenW (lpString=".7z") returned 3
	[0097.853] lstrcmpiW (lpString1=".7z", lpString2="FMP") returned -1
	[0097.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74
	[0097.853] lstrlenW (lpString=".dbf") returned 4
	[0097.853] lstrcmpiW (lpString1=".dbf", lpString2=".FMP") returned -1
	[0097.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74
	[0097.853] lstrlenW (lpString=".1cd") returned 4
	[0097.853] lstrcmpiW (lpString1=".1cd", lpString2=".FMP") returned -1
	[0097.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74
	[0097.853] lstrlenW (lpString=".jpg") returned 4
	[0097.853] lstrcmpiW (lpString1=".jpg", lpString2=".FMP") returned 1
	[0097.854] lstrcmpiW (lpString1=".SHX", lpString2=".adobe") returned 1
	[0097.854] lstrlenW (lpString="WHGDTXT.SHX") returned 11
	[0097.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0097.854] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=223699) returned 1
	[0097.854] CloseHandle (hObject=0x1c0) returned 1
	[0097.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx")) returned 0x20
	[0097.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0097.855] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.855] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0097.855] GetLastError () returned 0x0
	[0097.855] ReadFile (in: hFile=0x1c0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x369d3, lpOverlapped=0x0) returned 1
	[0097.872] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x369e0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x369e0, lpOverlapped=0x0) returned 1
	[0097.876] ReadFile (in: hFile=0x1c0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.876] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0097.876] SetEndOfFile (hFile=0x1b0) returned 1
	[0097.876] CloseHandle (hObject=0x1b0) returned 1
	[0097.876] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.877] SetEndOfFile (hFile=0x1c0) returned 1
	[0097.878] CloseHandle (hObject=0x1c0) returned 1
	[0097.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.879] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx")) returned 1
	[0097.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77
	[0097.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77
	[0097.879] lstrlenW (lpString=".doc") returned 4
	[0097.879] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0097.879] lstrlenW (lpString=".docx") returned 5
	[0097.879] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0097.879] lstrlenW (lpString=".pdf") returned 4
	[0097.879] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0097.879] lstrlenW (lpString=".xls") returned 4
	[0097.879] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0097.879] lstrlenW (lpString=".xlsx") returned 5
	[0097.879] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0097.879] lstrlenW (lpString=".ppt") returned 4
	[0097.879] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0097.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77
	[0097.879] lstrlenW (lpString=".zip") returned 4
	[0097.880] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0097.880] lstrlenW (lpString=".rar") returned 4
	[0097.880] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0097.880] lstrlenW (lpString=".bz2") returned 4
	[0097.880] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0097.880] lstrlenW (lpString=".7z") returned 3
	[0097.880] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0097.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77
	[0097.880] lstrlenW (lpString=".dbf") returned 4
	[0097.880] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0097.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77
	[0097.880] lstrlenW (lpString=".1cd") returned 4
	[0097.880] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0097.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77
	[0097.880] lstrlenW (lpString=".jpg") returned 4
	[0097.880] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0097.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77
	[0097.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77
	[0097.880] lstrlenW (lpString=".doc") returned 4
	[0097.880] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0097.880] lstrlenW (lpString=".docx") returned 5
	[0097.880] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0097.880] lstrlenW (lpString=".pdf") returned 4
	[0097.880] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0097.880] lstrlenW (lpString=".xls") returned 4
	[0097.880] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0097.880] lstrlenW (lpString=".xlsx") returned 5
	[0097.880] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0097.880] lstrlenW (lpString=".ppt") returned 4
	[0097.880] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0097.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77
	[0097.881] lstrlenW (lpString=".zip") returned 4
	[0097.881] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0097.881] lstrlenW (lpString=".rar") returned 4
	[0097.881] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0097.881] lstrlenW (lpString=".bz2") returned 4
	[0097.881] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0097.881] lstrlenW (lpString=".7z") returned 3
	[0097.881] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0097.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77
	[0097.881] lstrlenW (lpString=".dbf") returned 4
	[0097.881] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0097.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77
	[0097.881] lstrlenW (lpString=".1cd") returned 4
	[0097.881] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0097.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77
	[0097.881] lstrlenW (lpString=".jpg") returned 4
	[0097.881] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0097.881] lstrcmpiW (lpString1=".SHX", lpString2=".adobe") returned 1
	[0097.881] lstrlenW (lpString="WHGTXT.SHX") returned 10
	[0097.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0097.883] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=196069) returned 1
	[0097.884] CloseHandle (hObject=0x1a8) returned 1
	[0097.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx")) returned 0x20
	[0097.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0097.884] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.884] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0097.885] GetLastError () returned 0x0
	[0097.885] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x2fde5, lpOverlapped=0x0) returned 1
	[0097.961] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2fdf0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2fdf0, lpOverlapped=0x0) returned 1
	[0097.965] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.965] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0097.965] SetEndOfFile (hFile=0x19c) returned 1
	[0097.965] CloseHandle (hObject=0x19c) returned 1
	[0097.965] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.965] SetEndOfFile (hFile=0x1a8) returned 1
	[0097.967] CloseHandle (hObject=0x1a8) returned 1
	[0097.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.968] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx")) returned 1
	[0097.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76
	[0097.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76
	[0097.968] lstrlenW (lpString=".doc") returned 4
	[0097.968] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0097.968] lstrlenW (lpString=".docx") returned 5
	[0097.968] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0097.968] lstrlenW (lpString=".pdf") returned 4
	[0097.968] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0097.968] lstrlenW (lpString=".xls") returned 4
	[0097.968] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0097.968] lstrlenW (lpString=".xlsx") returned 5
	[0097.968] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0097.968] lstrlenW (lpString=".ppt") returned 4
	[0097.968] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0097.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76
	[0097.968] lstrlenW (lpString=".zip") returned 4
	[0097.968] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0097.968] lstrlenW (lpString=".rar") returned 4
	[0097.968] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0097.968] lstrlenW (lpString=".bz2") returned 4
	[0097.969] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0097.969] lstrlenW (lpString=".7z") returned 3
	[0097.969] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0097.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76
	[0097.969] lstrlenW (lpString=".dbf") returned 4
	[0097.969] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0097.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76
	[0097.969] lstrlenW (lpString=".1cd") returned 4
	[0097.969] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0097.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76
	[0097.969] lstrlenW (lpString=".jpg") returned 4
	[0097.969] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0097.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76
	[0097.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76
	[0097.969] lstrlenW (lpString=".doc") returned 4
	[0097.969] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0097.969] lstrlenW (lpString=".docx") returned 5
	[0097.969] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0097.969] lstrlenW (lpString=".pdf") returned 4
	[0097.969] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0097.969] lstrlenW (lpString=".xls") returned 4
	[0097.969] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0097.969] lstrlenW (lpString=".xlsx") returned 5
	[0097.969] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0097.969] lstrlenW (lpString=".ppt") returned 4
	[0097.969] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0097.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76
	[0097.969] lstrlenW (lpString=".zip") returned 4
	[0097.969] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0097.969] lstrlenW (lpString=".rar") returned 4
	[0097.970] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0097.970] lstrlenW (lpString=".bz2") returned 4
	[0097.970] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0097.970] lstrlenW (lpString=".7z") returned 3
	[0097.970] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0097.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76
	[0097.970] lstrlenW (lpString=".dbf") returned 4
	[0097.970] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0097.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76
	[0097.970] lstrlenW (lpString=".1cd") returned 4
	[0097.970] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0097.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76
	[0097.970] lstrlenW (lpString=".jpg") returned 4
	[0097.970] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0097.970] lstrcmpiW (lpString1=".SHX", lpString2=".adobe") returned 1
	[0097.970] lstrlenW (lpString="WHTMTXT.SHX") returned 11
	[0097.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0097.971] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=916632) returned 1
	[0097.971] CloseHandle (hObject=0x1a8) returned 1
	[0097.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx")) returned 0x20
	[0097.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0097.971] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.971] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0097.972] GetLastError () returned 0x0
	[0097.972] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xdfc98, lpOverlapped=0x0) returned 1
	[0098.127] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xdfca0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xdfca0, lpOverlapped=0x0) returned 1
	[0098.143] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.143] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0098.143] SetEndOfFile (hFile=0x19c) returned 1
	[0098.144] CloseHandle (hObject=0x19c) returned 1
	[0098.144] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.144] SetEndOfFile (hFile=0x1a8) returned 1
	[0098.152] CloseHandle (hObject=0x1a8) returned 1
	[0098.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.152] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx")) returned 1
	[0098.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77
	[0098.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77
	[0098.152] lstrlenW (lpString=".doc") returned 4
	[0098.153] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0098.153] lstrlenW (lpString=".docx") returned 5
	[0098.153] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0098.153] lstrlenW (lpString=".pdf") returned 4
	[0098.153] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0098.153] lstrlenW (lpString=".xls") returned 4
	[0098.153] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0098.153] lstrlenW (lpString=".xlsx") returned 5
	[0098.153] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0098.153] lstrlenW (lpString=".ppt") returned 4
	[0098.153] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0098.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77
	[0098.153] lstrlenW (lpString=".zip") returned 4
	[0098.153] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0098.153] lstrlenW (lpString=".rar") returned 4
	[0098.153] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0098.153] lstrlenW (lpString=".bz2") returned 4
	[0098.153] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0098.153] lstrlenW (lpString=".7z") returned 3
	[0098.153] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0098.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77
	[0098.153] lstrlenW (lpString=".dbf") returned 4
	[0098.153] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0098.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77
	[0098.153] lstrlenW (lpString=".1cd") returned 4
	[0098.153] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0098.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77
	[0098.153] lstrlenW (lpString=".jpg") returned 4
	[0098.153] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0098.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77
	[0098.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77
	[0098.153] lstrlenW (lpString=".doc") returned 4
	[0098.154] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0098.154] lstrlenW (lpString=".docx") returned 5
	[0098.154] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0098.154] lstrlenW (lpString=".pdf") returned 4
	[0098.154] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0098.154] lstrlenW (lpString=".xls") returned 4
	[0098.154] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0098.154] lstrlenW (lpString=".xlsx") returned 5
	[0098.154] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0098.154] lstrlenW (lpString=".ppt") returned 4
	[0098.154] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0098.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77
	[0098.154] lstrlenW (lpString=".zip") returned 4
	[0098.154] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0098.154] lstrlenW (lpString=".rar") returned 4
	[0098.154] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0098.154] lstrlenW (lpString=".bz2") returned 4
	[0098.154] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0098.154] lstrlenW (lpString=".7z") returned 3
	[0098.154] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0098.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77
	[0098.154] lstrlenW (lpString=".dbf") returned 4
	[0098.154] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0098.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77
	[0098.154] lstrlenW (lpString=".1cd") returned 4
	[0098.154] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0098.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77
	[0098.154] lstrlenW (lpString=".jpg") returned 4
	[0098.154] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0098.155] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0098.155] lstrlenW (lpString="VSTOLoaderUI.dll") returned 16
	[0098.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0098.164] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=18264) returned 1
	[0098.164] CloseHandle (hObject=0x184) returned 1
	[0098.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20
	[0098.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0098.164] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.164] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.165] GetLastError () returned 0x0
	[0098.165] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x4758, lpOverlapped=0x0) returned 1
	[0098.174] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x4760, lpOverlapped=0x0) returned 1
	[0098.176] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.176] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0098.176] SetEndOfFile (hFile=0x1a8) returned 1
	[0098.176] CloseHandle (hObject=0x1a8) returned 1
	[0098.176] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.176] SetEndOfFile (hFile=0x184) returned 1
	[0098.177] CloseHandle (hObject=0x184) returned 1
	[0098.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.177] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 1
	[0098.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0098.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0098.177] lstrlenW (lpString=".doc") returned 4
	[0098.177] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.177] lstrlenW (lpString=".docx") returned 5
	[0098.178] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0098.178] lstrlenW (lpString=".pdf") returned 4
	[0098.178] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.178] lstrlenW (lpString=".xls") returned 4
	[0098.178] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.178] lstrlenW (lpString=".xlsx") returned 5
	[0098.178] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0098.178] lstrlenW (lpString=".ppt") returned 4
	[0098.178] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0098.178] lstrlenW (lpString=".zip") returned 4
	[0098.178] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.178] lstrlenW (lpString=".rar") returned 4
	[0098.178] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.178] lstrlenW (lpString=".bz2") returned 4
	[0098.178] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.178] lstrlenW (lpString=".7z") returned 3
	[0098.178] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0098.178] lstrlenW (lpString=".dbf") returned 4
	[0098.178] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0098.178] lstrlenW (lpString=".1cd") returned 4
	[0098.178] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0098.178] lstrlenW (lpString=".jpg") returned 4
	[0098.178] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0098.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0098.178] lstrlenW (lpString=".doc") returned 4
	[0098.178] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.178] lstrlenW (lpString=".docx") returned 5
	[0098.178] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0098.179] lstrlenW (lpString=".pdf") returned 4
	[0098.179] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.179] lstrlenW (lpString=".xls") returned 4
	[0098.179] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.179] lstrlenW (lpString=".xlsx") returned 5
	[0098.179] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0098.179] lstrlenW (lpString=".ppt") returned 4
	[0098.179] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0098.179] lstrlenW (lpString=".zip") returned 4
	[0098.179] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.179] lstrlenW (lpString=".rar") returned 4
	[0098.179] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.179] lstrlenW (lpString=".bz2") returned 4
	[0098.179] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.179] lstrlenW (lpString=".7z") returned 3
	[0098.179] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0098.179] lstrlenW (lpString=".dbf") returned 4
	[0098.179] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0098.179] lstrlenW (lpString=".1cd") returned 4
	[0098.179] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0098.179] lstrlenW (lpString=".jpg") returned 4
	[0098.179] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.179] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0098.179] lstrlenW (lpString="VSTOLoader.dll") returned 14
	[0098.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.185] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=387408) returned 1
	[0098.185] CloseHandle (hObject=0x1a8) returned 1
	[0098.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20
	[0098.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0098.215] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.215] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.226] GetLastError () returned 0x0
	[0098.226] ReadFile (in: hFile=0x1c8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x5e950, lpOverlapped=0x0) returned 1
	[0098.267] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5e960, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x5e960, lpOverlapped=0x0) returned 1
	[0098.276] ReadFile (in: hFile=0x1c8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.276] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0098.276] SetEndOfFile (hFile=0x1a8) returned 1
	[0098.277] CloseHandle (hObject=0x1a8) returned 1
	[0098.277] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.277] SetEndOfFile (hFile=0x1c8) returned 1
	[0098.281] CloseHandle (hObject=0x1c8) returned 1
	[0098.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.282] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 1
	[0098.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0098.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0098.282] lstrlenW (lpString=".doc") returned 4
	[0098.282] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.282] lstrlenW (lpString=".docx") returned 5
	[0098.282] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0098.282] lstrlenW (lpString=".pdf") returned 4
	[0098.282] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.282] lstrlenW (lpString=".xls") returned 4
	[0098.282] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.282] lstrlenW (lpString=".xlsx") returned 5
	[0098.282] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0098.282] lstrlenW (lpString=".ppt") returned 4
	[0098.282] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0098.283] lstrlenW (lpString=".zip") returned 4
	[0098.283] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.283] lstrlenW (lpString=".rar") returned 4
	[0098.283] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.283] lstrlenW (lpString=".bz2") returned 4
	[0098.283] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.283] lstrlenW (lpString=".7z") returned 3
	[0098.283] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0098.283] lstrlenW (lpString=".dbf") returned 4
	[0098.283] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0098.283] lstrlenW (lpString=".1cd") returned 4
	[0098.283] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0098.283] lstrlenW (lpString=".jpg") returned 4
	[0098.283] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0098.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0098.283] lstrlenW (lpString=".doc") returned 4
	[0098.283] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.283] lstrlenW (lpString=".docx") returned 5
	[0098.283] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0098.283] lstrlenW (lpString=".pdf") returned 4
	[0098.284] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.284] lstrlenW (lpString=".xls") returned 4
	[0098.284] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.284] lstrlenW (lpString=".xlsx") returned 5
	[0098.284] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0098.284] lstrlenW (lpString=".ppt") returned 4
	[0098.284] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0098.284] lstrlenW (lpString=".zip") returned 4
	[0098.284] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.284] lstrlenW (lpString=".rar") returned 4
	[0098.284] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.284] lstrlenW (lpString=".bz2") returned 4
	[0098.284] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.284] lstrlenW (lpString=".7z") returned 3
	[0098.284] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0098.284] lstrlenW (lpString=".dbf") returned 4
	[0098.284] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0098.284] lstrlenW (lpString=".1cd") returned 4
	[0098.284] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0098.284] lstrlenW (lpString=".jpg") returned 4
	[0098.284] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.285] lstrcmpiW (lpString1=".tlb", lpString2=".adobe") returned 1
	[0098.285] lstrlenW (lpString="vstoee100.tlb") returned 13
	[0098.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0098.286] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=16208) returned 1
	[0098.286] CloseHandle (hObject=0x1c8) returned 1
	[0098.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20
	[0098.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0098.286] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.286] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.287] GetLastError () returned 0x0
	[0098.287] ReadFile (in: hFile=0x1c8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x3f50, lpOverlapped=0x0) returned 1
	[0098.306] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x3f60, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x3f60, lpOverlapped=0x0) returned 1
	[0098.308] ReadFile (in: hFile=0x1c8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.308] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0098.308] SetEndOfFile (hFile=0x1a8) returned 1
	[0098.308] CloseHandle (hObject=0x1a8) returned 1
	[0098.308] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.308] SetEndOfFile (hFile=0x1c8) returned 1
	[0098.309] CloseHandle (hObject=0x1c8) returned 1
	[0098.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.310] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1
	[0098.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65
	[0098.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65
	[0098.311] lstrlenW (lpString=".doc") returned 4
	[0098.312] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0098.312] lstrlenW (lpString=".docx") returned 5
	[0098.312] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0098.312] lstrlenW (lpString=".pdf") returned 4
	[0098.312] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0098.312] lstrlenW (lpString=".xls") returned 4
	[0098.312] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0098.312] lstrlenW (lpString=".xlsx") returned 5
	[0098.312] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0098.312] lstrlenW (lpString=".ppt") returned 4
	[0098.312] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0098.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65
	[0098.312] lstrlenW (lpString=".zip") returned 4
	[0098.312] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0098.312] lstrlenW (lpString=".rar") returned 4
	[0098.312] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0098.312] lstrlenW (lpString=".bz2") returned 4
	[0098.312] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0098.312] lstrlenW (lpString=".7z") returned 3
	[0098.312] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0098.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65
	[0098.313] lstrlenW (lpString=".dbf") returned 4
	[0098.313] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0098.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65
	[0098.313] lstrlenW (lpString=".1cd") returned 4
	[0098.313] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0098.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65
	[0098.313] lstrlenW (lpString=".jpg") returned 4
	[0098.313] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0098.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65
	[0098.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65
	[0098.313] lstrlenW (lpString=".doc") returned 4
	[0098.313] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0098.313] lstrlenW (lpString=".docx") returned 5
	[0098.313] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0098.313] lstrlenW (lpString=".pdf") returned 4
	[0098.313] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0098.313] lstrlenW (lpString=".xls") returned 4
	[0098.313] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0098.313] lstrlenW (lpString=".xlsx") returned 5
	[0098.313] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0098.313] lstrlenW (lpString=".ppt") returned 4
	[0098.314] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0098.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65
	[0098.314] lstrlenW (lpString=".zip") returned 4
	[0098.314] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0098.314] lstrlenW (lpString=".rar") returned 4
	[0098.314] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0098.314] lstrlenW (lpString=".bz2") returned 4
	[0098.314] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0098.314] lstrlenW (lpString=".7z") returned 3
	[0098.314] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0098.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65
	[0098.314] lstrlenW (lpString=".dbf") returned 4
	[0098.314] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0098.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65
	[0098.314] lstrlenW (lpString=".1cd") returned 4
	[0098.314] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0098.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65
	[0098.314] lstrlenW (lpString=".jpg") returned 4
	[0098.314] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0098.314] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0098.314] lstrlenW (lpString="MSOSVINT.DLL") returned 12
	[0098.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.320] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=10632) returned 1
	[0098.320] CloseHandle (hObject=0x1a8) returned 1
	[0098.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll")) returned 0x20
	[0098.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.321] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.321] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0098.322] GetLastError () returned 0x0
	[0098.322] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x2988, lpOverlapped=0x0) returned 1
	[0098.337] WriteFile (in: hFile=0x178, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2990, lpOverlapped=0x0) returned 1
	[0098.338] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.338] WriteFile (in: hFile=0x178, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.338] SetEndOfFile (hFile=0x178) returned 1
	[0098.339] CloseHandle (hObject=0x178) returned 1
	[0098.339] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.339] SetEndOfFile (hFile=0x1a8) returned 1
	[0098.340] CloseHandle (hObject=0x1a8) returned 1
	[0098.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.340] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll")) returned 1
	[0098.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76
	[0098.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76
	[0098.340] lstrlenW (lpString=".doc") returned 4
	[0098.340] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0098.340] lstrlenW (lpString=".docx") returned 5
	[0098.340] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0098.340] lstrlenW (lpString=".pdf") returned 4
	[0098.341] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0098.341] lstrlenW (lpString=".xls") returned 4
	[0098.341] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0098.341] lstrlenW (lpString=".xlsx") returned 5
	[0098.341] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0098.341] lstrlenW (lpString=".ppt") returned 4
	[0098.341] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0098.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76
	[0098.341] lstrlenW (lpString=".zip") returned 4
	[0098.341] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0098.341] lstrlenW (lpString=".rar") returned 4
	[0098.341] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0098.341] lstrlenW (lpString=".bz2") returned 4
	[0098.341] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0098.341] lstrlenW (lpString=".7z") returned 3
	[0098.341] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0098.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76
	[0098.341] lstrlenW (lpString=".dbf") returned 4
	[0098.341] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0098.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76
	[0098.341] lstrlenW (lpString=".1cd") returned 4
	[0098.341] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0098.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76
	[0098.341] lstrlenW (lpString=".jpg") returned 4
	[0098.341] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0098.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76
	[0098.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76
	[0098.342] lstrlenW (lpString=".doc") returned 4
	[0098.342] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0098.342] lstrlenW (lpString=".docx") returned 5
	[0098.342] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0098.342] lstrlenW (lpString=".pdf") returned 4
	[0098.342] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0098.342] lstrlenW (lpString=".xls") returned 4
	[0098.342] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0098.342] lstrlenW (lpString=".xlsx") returned 5
	[0098.342] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0098.342] lstrlenW (lpString=".ppt") returned 4
	[0098.342] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0098.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76
	[0098.342] lstrlenW (lpString=".zip") returned 4
	[0098.342] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0098.342] lstrlenW (lpString=".rar") returned 4
	[0098.342] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0098.342] lstrlenW (lpString=".bz2") returned 4
	[0098.342] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0098.342] lstrlenW (lpString=".7z") returned 3
	[0098.342] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0098.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76
	[0098.342] lstrlenW (lpString=".dbf") returned 4
	[0098.342] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0098.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76
	[0098.342] lstrlenW (lpString=".1cd") returned 4
	[0098.342] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0098.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76
	[0098.343] lstrlenW (lpString=".jpg") returned 4
	[0098.343] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0098.343] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0098.343] lstrlenW (lpString="FPSRVUTL.DLL") returned 12
	[0098.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.344] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=2522488) returned 1
	[0098.344] CloseHandle (hObject=0x1a8) returned 1
	[0098.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll")) returned 0x20
	[0098.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0098.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.346] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0098.346] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.346] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0098.424] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcd47d, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.424] ReadFile (in: hFile=0x1a8, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0098.561] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.561] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x227d78, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.561] ReadFile (in: hFile=0x1a8, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0098.637] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.638] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0098.658] SetEndOfFile (hFile=0x1a8) returned 1
	[0098.658] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x4041040
	[0098.664] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0098.664] WriteFile (in: hFile=0x1a8, lpBuffer=0x4041040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4041040*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0098.666] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcd47d, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0098.666] WriteFile (in: hFile=0x1a8, lpBuffer=0x4041040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4041040*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0098.674] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x227d78, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0098.674] WriteFile (in: hFile=0x1a8, lpBuffer=0x4041040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4041040*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0098.678] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x4041040 | out: hHeap=0x5e0000) returned 1
	[0098.678] CloseHandle (hObject=0x1a8) returned 1
	[0098.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88
	[0098.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88
	[0098.678] lstrlenW (lpString=".doc") returned 4
	[0098.678] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0098.678] lstrlenW (lpString=".docx") returned 5
	[0098.678] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0098.678] lstrlenW (lpString=".pdf") returned 4
	[0098.678] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0098.678] lstrlenW (lpString=".xls") returned 4
	[0098.678] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0098.678] lstrlenW (lpString=".xlsx") returned 5
	[0098.678] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0098.678] lstrlenW (lpString=".ppt") returned 4
	[0098.678] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0098.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88
	[0098.679] lstrlenW (lpString=".zip") returned 4
	[0098.679] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0098.679] lstrlenW (lpString=".rar") returned 4
	[0098.679] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0098.679] lstrlenW (lpString=".bz2") returned 4
	[0098.679] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0098.679] lstrlenW (lpString=".7z") returned 3
	[0098.679] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0098.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88
	[0098.679] lstrlenW (lpString=".dbf") returned 4
	[0098.679] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0098.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88
	[0098.679] lstrlenW (lpString=".1cd") returned 4
	[0098.679] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0098.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88
	[0098.679] lstrlenW (lpString=".jpg") returned 4
	[0098.679] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0098.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88
	[0098.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88
	[0098.679] lstrlenW (lpString=".doc") returned 4
	[0098.679] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0098.679] lstrlenW (lpString=".docx") returned 5
	[0098.679] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0098.679] lstrlenW (lpString=".pdf") returned 4
	[0098.679] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0098.679] lstrlenW (lpString=".xls") returned 4
	[0098.679] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0098.679] lstrlenW (lpString=".xlsx") returned 5
	[0098.679] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0098.680] lstrlenW (lpString=".ppt") returned 4
	[0098.680] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0098.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88
	[0098.680] lstrlenW (lpString=".zip") returned 4
	[0098.680] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0098.680] lstrlenW (lpString=".rar") returned 4
	[0098.680] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0098.680] lstrlenW (lpString=".bz2") returned 4
	[0098.680] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0098.680] lstrlenW (lpString=".7z") returned 3
	[0098.680] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0098.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88
	[0098.680] lstrlenW (lpString=".dbf") returned 4
	[0098.680] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0098.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88
	[0098.680] lstrlenW (lpString=".1cd") returned 4
	[0098.680] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0098.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88
	[0098.680] lstrlenW (lpString=".jpg") returned 4
	[0098.680] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0098.680] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0098.680] lstrlenW (lpString="MSTTSFrontendENU.dll") returned 20
	[0098.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.718] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=373760) returned 1
	[0098.718] CloseHandle (hObject=0x190) returned 1
	[0098.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll")) returned 0x20
	[0098.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86
	[0098.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86
	[0098.768] lstrlenW (lpString=".doc") returned 4
	[0098.768] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.768] lstrlenW (lpString=".docx") returned 5
	[0098.768] lstrcmpiW (lpString1=".docx", lpString2="U.dll") returned -1
	[0098.768] lstrlenW (lpString=".pdf") returned 4
	[0098.768] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.768] lstrlenW (lpString=".xls") returned 4
	[0098.768] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.768] lstrlenW (lpString=".xlsx") returned 5
	[0098.768] lstrcmpiW (lpString1=".xlsx", lpString2="U.dll") returned -1
	[0098.768] lstrlenW (lpString=".ppt") returned 4
	[0098.768] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86
	[0098.768] lstrlenW (lpString=".zip") returned 4
	[0098.768] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.769] lstrlenW (lpString=".rar") returned 4
	[0098.769] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.769] lstrlenW (lpString=".bz2") returned 4
	[0098.769] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.769] lstrlenW (lpString=".7z") returned 3
	[0098.769] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86
	[0098.769] lstrlenW (lpString=".dbf") returned 4
	[0098.769] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86
	[0098.769] lstrlenW (lpString=".1cd") returned 4
	[0098.769] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86
	[0098.769] lstrlenW (lpString=".jpg") returned 4
	[0098.769] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86
	[0098.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86
	[0098.769] lstrlenW (lpString=".doc") returned 4
	[0098.770] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.770] lstrlenW (lpString=".docx") returned 5
	[0098.770] lstrcmpiW (lpString1=".docx", lpString2="U.dll") returned -1
	[0098.770] lstrlenW (lpString=".pdf") returned 4
	[0098.770] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.770] lstrlenW (lpString=".xls") returned 4
	[0098.770] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.770] lstrlenW (lpString=".xlsx") returned 5
	[0098.770] lstrcmpiW (lpString1=".xlsx", lpString2="U.dll") returned -1
	[0098.770] lstrlenW (lpString=".ppt") returned 4
	[0098.770] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86
	[0098.770] lstrlenW (lpString=".zip") returned 4
	[0098.770] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.770] lstrlenW (lpString=".rar") returned 4
	[0098.770] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.770] lstrlenW (lpString=".bz2") returned 4
	[0098.770] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.770] lstrlenW (lpString=".7z") returned 3
	[0098.770] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86
	[0098.770] lstrlenW (lpString=".dbf") returned 4
	[0098.770] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86
	[0098.770] lstrlenW (lpString=".1cd") returned 4
	[0098.770] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86
	[0098.770] lstrlenW (lpString=".jpg") returned 4
	[0098.770] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.771] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0098.771] lstrlenW (lpString="MSTTSCommon.dll") returned 15
	[0098.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0098.771] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=41472) returned 1
	[0098.771] CloseHandle (hObject=0x198) returned 1
	[0098.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll")) returned 0x20
	[0098.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75
	[0098.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75
	[0098.772] lstrlenW (lpString=".doc") returned 4
	[0098.772] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.772] lstrlenW (lpString=".docx") returned 5
	[0098.772] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0098.772] lstrlenW (lpString=".pdf") returned 4
	[0098.772] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.772] lstrlenW (lpString=".xls") returned 4
	[0098.772] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.772] lstrlenW (lpString=".xlsx") returned 5
	[0098.772] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0098.772] lstrlenW (lpString=".ppt") returned 4
	[0098.772] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75
	[0098.772] lstrlenW (lpString=".zip") returned 4
	[0098.772] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.772] lstrlenW (lpString=".rar") returned 4
	[0098.772] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.772] lstrlenW (lpString=".bz2") returned 4
	[0098.772] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.772] lstrlenW (lpString=".7z") returned 3
	[0098.773] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75
	[0098.773] lstrlenW (lpString=".dbf") returned 4
	[0098.773] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75
	[0098.773] lstrlenW (lpString=".1cd") returned 4
	[0098.773] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75
	[0098.773] lstrlenW (lpString=".jpg") returned 4
	[0098.773] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75
	[0098.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75
	[0098.773] lstrlenW (lpString=".doc") returned 4
	[0098.773] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.773] lstrlenW (lpString=".docx") returned 5
	[0098.773] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0098.773] lstrlenW (lpString=".pdf") returned 4
	[0098.773] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.773] lstrlenW (lpString=".xls") returned 4
	[0098.773] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.773] lstrlenW (lpString=".xlsx") returned 5
	[0098.773] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0098.773] lstrlenW (lpString=".ppt") returned 4
	[0098.773] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75
	[0098.773] lstrlenW (lpString=".zip") returned 4
	[0098.773] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.773] lstrlenW (lpString=".rar") returned 4
	[0098.773] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.773] lstrlenW (lpString=".bz2") returned 4
	[0098.774] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.774] lstrlenW (lpString=".7z") returned 3
	[0098.774] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75
	[0098.774] lstrlenW (lpString=".dbf") returned 4
	[0098.774] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75
	[0098.774] lstrlenW (lpString=".1cd") returned 4
	[0098.774] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75
	[0098.774] lstrlenW (lpString=".jpg") returned 4
	[0098.774] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.774] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0098.774] lstrlenW (lpString="MSTTSEngine.dll") returned 15
	[0098.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0098.775] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=181248) returned 1
	[0098.775] CloseHandle (hObject=0x198) returned 1
	[0098.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll")) returned 0x20
	[0098.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75
	[0098.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75
	[0098.775] lstrlenW (lpString=".doc") returned 4
	[0098.775] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.775] lstrlenW (lpString=".docx") returned 5
	[0098.775] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0098.775] lstrlenW (lpString=".pdf") returned 4
	[0098.775] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.776] lstrlenW (lpString=".xls") returned 4
	[0098.776] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.776] lstrlenW (lpString=".xlsx") returned 5
	[0098.776] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0098.776] lstrlenW (lpString=".ppt") returned 4
	[0098.776] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75
	[0098.776] lstrlenW (lpString=".zip") returned 4
	[0098.776] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.776] lstrlenW (lpString=".rar") returned 4
	[0098.776] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.776] lstrlenW (lpString=".bz2") returned 4
	[0098.776] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.776] lstrlenW (lpString=".7z") returned 3
	[0098.776] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75
	[0098.776] lstrlenW (lpString=".dbf") returned 4
	[0098.776] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75
	[0098.776] lstrlenW (lpString=".1cd") returned 4
	[0098.776] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75
	[0098.776] lstrlenW (lpString=".jpg") returned 4
	[0098.776] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75
	[0098.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75
	[0098.776] lstrlenW (lpString=".doc") returned 4
	[0098.776] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.776] lstrlenW (lpString=".docx") returned 5
	[0098.776] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0098.777] lstrlenW (lpString=".pdf") returned 4
	[0098.777] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.777] lstrlenW (lpString=".xls") returned 4
	[0098.777] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.777] lstrlenW (lpString=".xlsx") returned 5
	[0098.777] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0098.777] lstrlenW (lpString=".ppt") returned 4
	[0098.777] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75
	[0098.777] lstrlenW (lpString=".zip") returned 4
	[0098.777] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.777] lstrlenW (lpString=".rar") returned 4
	[0098.777] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.777] lstrlenW (lpString=".bz2") returned 4
	[0098.777] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.777] lstrlenW (lpString=".7z") returned 3
	[0098.777] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75
	[0098.777] lstrlenW (lpString=".dbf") returned 4
	[0098.777] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75
	[0098.777] lstrlenW (lpString=".1cd") returned 4
	[0098.777] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75
	[0098.777] lstrlenW (lpString=".jpg") returned 4
	[0098.777] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.777] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0098.778] lstrlenW (lpString="MSTTSLoc.dll") returned 12
	[0098.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0098.778] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=9728) returned 1
	[0098.778] CloseHandle (hObject=0x198) returned 1
	[0098.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll")) returned 0x20
	[0098.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72
	[0098.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72
	[0098.779] lstrlenW (lpString=".doc") returned 4
	[0098.779] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.779] lstrlenW (lpString=".docx") returned 5
	[0098.779] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1
	[0098.779] lstrlenW (lpString=".pdf") returned 4
	[0098.779] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.779] lstrlenW (lpString=".xls") returned 4
	[0098.779] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.779] lstrlenW (lpString=".xlsx") returned 5
	[0098.779] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1
	[0098.779] lstrlenW (lpString=".ppt") returned 4
	[0098.779] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72
	[0098.779] lstrlenW (lpString=".zip") returned 4
	[0098.779] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.779] lstrlenW (lpString=".rar") returned 4
	[0098.779] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.779] lstrlenW (lpString=".bz2") returned 4
	[0098.779] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.779] lstrlenW (lpString=".7z") returned 3
	[0098.779] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72
	[0098.779] lstrlenW (lpString=".dbf") returned 4
	[0098.779] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72
	[0098.780] lstrlenW (lpString=".1cd") returned 4
	[0098.780] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72
	[0098.780] lstrlenW (lpString=".jpg") returned 4
	[0098.780] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72
	[0098.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72
	[0098.780] lstrlenW (lpString=".doc") returned 4
	[0098.780] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.780] lstrlenW (lpString=".docx") returned 5
	[0098.780] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1
	[0098.780] lstrlenW (lpString=".pdf") returned 4
	[0098.780] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.780] lstrlenW (lpString=".xls") returned 4
	[0098.780] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.780] lstrlenW (lpString=".xlsx") returned 5
	[0098.780] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1
	[0098.780] lstrlenW (lpString=".ppt") returned 4
	[0098.780] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72
	[0098.780] lstrlenW (lpString=".zip") returned 4
	[0098.780] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.780] lstrlenW (lpString=".rar") returned 4
	[0098.780] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.780] lstrlenW (lpString=".bz2") returned 4
	[0098.780] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.780] lstrlenW (lpString=".7z") returned 3
	[0098.780] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72
	[0098.781] lstrlenW (lpString=".dbf") returned 4
	[0098.781] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72
	[0098.781] lstrlenW (lpString=".1cd") returned 4
	[0098.781] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72
	[0098.781] lstrlenW (lpString=".jpg") returned 4
	[0098.781] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.781] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0098.781] lstrlenW (lpString="msader15.dll.mui") returned 16
	[0098.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0098.824] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=17408) returned 1
	[0098.824] CloseHandle (hObject=0x174) returned 1
	[0098.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20
	[0098.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0098.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0098.838] lstrlenW (lpString=".doc") returned 4
	[0098.838] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0098.838] lstrlenW (lpString=".docx") returned 5
	[0098.838] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0098.838] lstrlenW (lpString=".pdf") returned 4
	[0098.838] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0098.838] lstrlenW (lpString=".xls") returned 4
	[0098.838] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0098.838] lstrlenW (lpString=".xlsx") returned 5
	[0098.838] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0098.838] lstrlenW (lpString=".ppt") returned 4
	[0098.838] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0098.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0098.838] lstrlenW (lpString=".zip") returned 4
	[0098.838] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0098.838] lstrlenW (lpString=".rar") returned 4
	[0098.838] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0098.838] lstrlenW (lpString=".bz2") returned 4
	[0098.838] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0098.838] lstrlenW (lpString=".7z") returned 3
	[0098.838] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0098.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0098.838] lstrlenW (lpString=".dbf") returned 4
	[0098.838] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0098.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0098.838] lstrlenW (lpString=".1cd") returned 4
	[0098.838] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0098.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0098.839] lstrlenW (lpString=".jpg") returned 4
	[0098.839] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0098.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0098.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0098.839] lstrlenW (lpString=".doc") returned 4
	[0098.839] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0098.839] lstrlenW (lpString=".docx") returned 5
	[0098.839] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0098.839] lstrlenW (lpString=".pdf") returned 4
	[0098.839] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0098.839] lstrlenW (lpString=".xls") returned 4
	[0098.839] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0098.839] lstrlenW (lpString=".xlsx") returned 5
	[0098.839] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0098.839] lstrlenW (lpString=".ppt") returned 4
	[0098.839] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0098.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0098.839] lstrlenW (lpString=".zip") returned 4
	[0098.839] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0098.839] lstrlenW (lpString=".rar") returned 4
	[0098.839] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0098.839] lstrlenW (lpString=".bz2") returned 4
	[0098.839] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0098.839] lstrlenW (lpString=".7z") returned 3
	[0098.839] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0098.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0098.839] lstrlenW (lpString=".dbf") returned 4
	[0098.839] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0098.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0098.839] lstrlenW (lpString=".1cd") returned 4
	[0098.840] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0098.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0098.840] lstrlenW (lpString=".jpg") returned 4
	[0098.840] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0098.840] lstrcmpiW (lpString1=".tlb", lpString2=".adobe") returned 1
	[0098.840] lstrlenW (lpString="msado20.tlb") returned 11
	[0098.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.857] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=69632) returned 1
	[0098.857] CloseHandle (hObject=0x160) returned 1
	[0098.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20
	[0098.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0098.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0098.892] lstrlenW (lpString=".doc") returned 4
	[0098.892] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0098.892] lstrlenW (lpString=".docx") returned 5
	[0098.892] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0098.892] lstrlenW (lpString=".pdf") returned 4
	[0098.892] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0098.892] lstrlenW (lpString=".xls") returned 4
	[0098.892] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0098.892] lstrlenW (lpString=".xlsx") returned 5
	[0098.892] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0098.892] lstrlenW (lpString=".ppt") returned 4
	[0098.892] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0098.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0098.892] lstrlenW (lpString=".zip") returned 4
	[0098.893] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0098.893] lstrlenW (lpString=".rar") returned 4
	[0098.893] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0098.893] lstrlenW (lpString=".bz2") returned 4
	[0098.893] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0098.893] lstrlenW (lpString=".7z") returned 3
	[0098.893] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0098.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0098.893] lstrlenW (lpString=".dbf") returned 4
	[0098.893] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0099.361] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.361] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.361] GetLastError () returned 0x0
	[0099.362] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xe580, lpOverlapped=0x0) returned 1
	[0099.366] WriteFile (in: hFile=0x198, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe590, lpOverlapped=0x0) returned 1
	[0099.368] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.368] WriteFile (in: hFile=0x198, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.368] SetEndOfFile (hFile=0x198) returned 1
	[0099.368] CloseHandle (hObject=0x198) returned 1
	[0099.368] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.368] SetEndOfFile (hFile=0x188) returned 1
	[0099.369] CloseHandle (hObject=0x188) returned 1
	[0099.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.369] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll")) returned 1
	[0099.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61
	[0099.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61
	[0099.370] lstrlenW (lpString=".doc") returned 4
	[0099.370] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0099.370] lstrlenW (lpString=".docx") returned 5
	[0099.370] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1
	[0099.370] lstrlenW (lpString=".pdf") returned 4
	[0099.370] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0099.370] lstrlenW (lpString=".xls") returned 4
	[0099.370] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0099.370] lstrlenW (lpString=".xlsx") returned 5
	[0099.370] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1
	[0099.370] lstrlenW (lpString=".ppt") returned 4
	[0099.370] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0099.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61
	[0099.370] lstrlenW (lpString=".zip") returned 4
	[0099.370] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0099.370] lstrlenW (lpString=".rar") returned 4
	[0099.370] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0099.370] lstrlenW (lpString=".bz2") returned 4
	[0099.371] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0099.371] lstrlenW (lpString=".7z") returned 3
	[0099.371] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0099.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61
	[0099.371] lstrlenW (lpString=".dbf") returned 4
	[0099.371] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0099.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61
	[0099.371] lstrlenW (lpString=".1cd") returned 4
	[0099.371] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0099.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61
	[0099.371] lstrlenW (lpString=".jpg") returned 4
	[0099.371] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0099.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61
	[0099.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61
	[0099.371] lstrlenW (lpString=".doc") returned 4
	[0099.371] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0099.371] lstrlenW (lpString=".docx") returned 5
	[0099.371] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1
	[0099.371] lstrlenW (lpString=".pdf") returned 4
	[0099.371] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0099.371] lstrlenW (lpString=".xls") returned 4
	[0099.371] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0099.371] lstrlenW (lpString=".xlsx") returned 5
	[0099.371] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1
	[0099.371] lstrlenW (lpString=".ppt") returned 4
	[0099.371] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0099.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61
	[0099.371] lstrlenW (lpString=".zip") returned 4
	[0099.371] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0099.371] lstrlenW (lpString=".rar") returned 4
	[0099.372] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0099.372] lstrlenW (lpString=".bz2") returned 4
	[0099.372] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0099.372] lstrlenW (lpString=".7z") returned 3
	[0099.372] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0099.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61
	[0099.372] lstrlenW (lpString=".dbf") returned 4
	[0099.372] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0099.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61
	[0099.372] lstrlenW (lpString=".1cd") returned 4
	[0099.372] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0099.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61
	[0099.372] lstrlenW (lpString=".jpg") returned 4
	[0099.372] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0099.372] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0099.372] lstrlenW (lpString="oledb32r.dll.mui") returned 16
	[0099.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.376] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=47616) returned 1
	[0099.376] CloseHandle (hObject=0x1c0) returned 1
	[0099.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20
	[0099.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0099.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0099.420] lstrlenW (lpString=".doc") returned 4
	[0099.420] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0099.420] lstrlenW (lpString=".docx") returned 5
	[0099.420] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0099.421] lstrlenW (lpString=".pdf") returned 4
	[0099.421] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0099.421] lstrlenW (lpString=".xls") returned 4
	[0099.421] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0099.421] lstrlenW (lpString=".xlsx") returned 5
	[0099.421] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0099.421] lstrlenW (lpString=".ppt") returned 4
	[0099.421] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0099.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0099.421] lstrlenW (lpString=".zip") returned 4
	[0099.421] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0099.421] lstrlenW (lpString=".rar") returned 4
	[0099.421] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0099.421] lstrlenW (lpString=".bz2") returned 4
	[0099.421] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0099.421] lstrlenW (lpString=".7z") returned 3
	[0099.421] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0099.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0099.421] lstrlenW (lpString=".dbf") returned 4
	[0099.421] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0099.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0099.421] lstrlenW (lpString=".1cd") returned 4
	[0099.421] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0099.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0099.421] lstrlenW (lpString=".jpg") returned 4
	[0099.421] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0099.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0099.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0099.422] lstrlenW (lpString=".doc") returned 4
	[0099.422] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0099.422] lstrlenW (lpString=".docx") returned 5
	[0099.422] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0099.422] lstrlenW (lpString=".pdf") returned 4
	[0099.422] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0099.422] lstrlenW (lpString=".xls") returned 4
	[0099.422] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0099.422] lstrlenW (lpString=".xlsx") returned 5
	[0099.422] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0099.422] lstrlenW (lpString=".ppt") returned 4
	[0099.422] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0099.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0099.422] lstrlenW (lpString=".zip") returned 4
	[0099.422] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0099.422] lstrlenW (lpString=".rar") returned 4
	[0099.422] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0099.422] lstrlenW (lpString=".bz2") returned 4
	[0099.422] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0099.422] lstrlenW (lpString=".7z") returned 3
	[0099.422] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0099.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0099.423] lstrlenW (lpString=".dbf") returned 4
	[0099.423] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0099.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0099.423] lstrlenW (lpString=".1cd") returned 4
	[0099.423] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0099.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0099.423] lstrlenW (lpString=".jpg") returned 4
	[0099.423] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0099.423] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0099.423] lstrlenW (lpString="sqlxmlx.rll.mui") returned 15
	[0099.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.430] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=17920) returned 1
	[0099.430] CloseHandle (hObject=0x188) returned 1
	[0099.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20
	[0099.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0099.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0099.437] lstrlenW (lpString=".doc") returned 4
	[0099.437] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0099.437] lstrlenW (lpString=".docx") returned 5
	[0099.437] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0099.437] lstrlenW (lpString=".pdf") returned 4
	[0099.437] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0099.438] lstrlenW (lpString=".xls") returned 4
	[0099.438] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0099.438] lstrlenW (lpString=".xlsx") returned 5
	[0099.438] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0099.438] lstrlenW (lpString=".ppt") returned 4
	[0099.438] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0099.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0099.438] lstrlenW (lpString=".zip") returned 4
	[0099.438] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0099.438] lstrlenW (lpString=".rar") returned 4
	[0099.438] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0099.438] lstrlenW (lpString=".bz2") returned 4
	[0099.438] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0099.438] lstrlenW (lpString=".7z") returned 3
	[0099.438] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0099.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0099.438] lstrlenW (lpString=".dbf") returned 4
	[0099.438] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0099.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0099.439] lstrlenW (lpString=".1cd") returned 4
	[0099.439] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0099.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0099.439] lstrlenW (lpString=".jpg") returned 4
	[0099.439] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0099.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0099.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0099.439] lstrlenW (lpString=".doc") returned 4
	[0099.439] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0099.439] lstrlenW (lpString=".docx") returned 5
	[0099.439] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0099.439] lstrlenW (lpString=".pdf") returned 4
	[0099.439] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0099.439] lstrlenW (lpString=".xls") returned 4
	[0099.439] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0099.440] lstrlenW (lpString=".xlsx") returned 5
	[0099.440] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0099.440] lstrlenW (lpString=".ppt") returned 4
	[0099.440] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0099.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0099.440] lstrlenW (lpString=".zip") returned 4
	[0099.440] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0099.440] lstrlenW (lpString=".rar") returned 4
	[0099.440] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0099.440] lstrlenW (lpString=".bz2") returned 4
	[0099.440] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0099.440] lstrlenW (lpString=".7z") returned 3
	[0099.441] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0099.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0099.441] lstrlenW (lpString=".dbf") returned 4
	[0099.441] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0099.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0099.441] lstrlenW (lpString=".1cd") returned 4
	[0099.441] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0099.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0099.441] lstrlenW (lpString=".jpg") returned 4
	[0099.441] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0099.442] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0099.442] lstrlenW (lpString="msdasql.dll") returned 11
	[0099.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0099.486] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=745472) returned 1
	[0099.486] CloseHandle (hObject=0x170) returned 1
	[0099.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0x20
	[0099.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55
	[0099.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55
	[0099.542] lstrlenW (lpString=".doc") returned 4
	[0099.542] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0099.542] lstrlenW (lpString=".docx") returned 5
	[0099.542] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1
	[0099.542] lstrlenW (lpString=".pdf") returned 4
	[0099.542] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0099.542] lstrlenW (lpString=".xls") returned 4
	[0099.542] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0099.542] lstrlenW (lpString=".xlsx") returned 5
	[0099.542] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1
	[0099.542] lstrlenW (lpString=".ppt") returned 4
	[0099.542] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0099.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55
	[0099.542] lstrlenW (lpString=".zip") returned 4
	[0099.542] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0099.542] lstrlenW (lpString=".rar") returned 4
	[0099.542] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0099.542] lstrlenW (lpString=".bz2") returned 4
	[0099.542] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0099.543] lstrlenW (lpString=".7z") returned 3
	[0099.543] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0099.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55
	[0099.543] lstrlenW (lpString=".dbf") returned 4
	[0099.543] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0099.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55
	[0099.543] lstrlenW (lpString=".1cd") returned 4
	[0099.543] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0099.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55
	[0099.543] lstrlenW (lpString=".jpg") returned 4
	[0099.543] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0099.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55
	[0099.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55
	[0099.543] lstrlenW (lpString=".doc") returned 4
	[0099.543] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0099.543] lstrlenW (lpString=".docx") returned 5
	[0099.543] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1
	[0099.543] lstrlenW (lpString=".pdf") returned 4
	[0099.543] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0099.543] lstrlenW (lpString=".xls") returned 4
	[0099.543] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0099.543] lstrlenW (lpString=".xlsx") returned 5
	[0099.544] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1
	[0099.544] lstrlenW (lpString=".ppt") returned 4
	[0099.544] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0099.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55
	[0099.544] lstrlenW (lpString=".zip") returned 4
	[0099.544] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0099.544] lstrlenW (lpString=".rar") returned 4
	[0099.544] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0099.544] lstrlenW (lpString=".bz2") returned 4
	[0099.544] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0099.544] lstrlenW (lpString=".7z") returned 3
	[0099.544] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0099.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55
	[0099.544] lstrlenW (lpString=".dbf") returned 4
	[0099.544] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0099.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55
	[0099.544] lstrlenW (lpString=".1cd") returned 4
	[0099.544] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0099.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55
	[0099.544] lstrlenW (lpString=".jpg") returned 4
	[0099.544] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0099.545] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0099.545] lstrlenW (lpString="msdatl3.dll") returned 11
	[0099.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.550] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=131072) returned 1
	[0099.550] CloseHandle (hObject=0x160) returned 1
	[0099.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0x20
	[0099.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55
	[0099.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55
	[0099.558] lstrlenW (lpString=".doc") returned 4
	[0099.558] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0099.558] lstrlenW (lpString=".docx") returned 5
	[0099.558] lstrcmpiW (lpString1=".docx", lpString2="3.dll") returned -1
	[0099.558] lstrlenW (lpString=".pdf") returned 4
	[0099.558] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0099.558] lstrlenW (lpString=".xls") returned 4
	[0099.558] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0099.558] lstrlenW (lpString=".xlsx") returned 5
	[0099.558] lstrcmpiW (lpString1=".xlsx", lpString2="3.dll") returned -1
	[0099.558] lstrlenW (lpString=".ppt") returned 4
	[0099.558] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0099.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55
	[0099.558] lstrlenW (lpString=".zip") returned 4
	[0099.558] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0099.558] lstrlenW (lpString=".rar") returned 4
	[0099.559] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0099.559] lstrlenW (lpString=".bz2") returned 4
	[0099.559] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0099.559] lstrlenW (lpString=".7z") returned 3
	[0099.559] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0099.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55
	[0099.559] lstrlenW (lpString=".dbf") returned 4
	[0099.559] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0099.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55
	[0099.559] lstrlenW (lpString=".1cd") returned 4
	[0099.559] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0099.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55
	[0099.559] lstrlenW (lpString=".jpg") returned 4
	[0099.559] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0099.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55
	[0099.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55
	[0099.559] lstrlenW (lpString=".doc") returned 4
	[0099.559] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0099.560] lstrlenW (lpString=".docx") returned 5
	[0099.560] lstrcmpiW (lpString1=".docx", lpString2="3.dll") returned -1
	[0099.560] lstrlenW (lpString=".pdf") returned 4
	[0099.560] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0099.560] lstrlenW (lpString=".xls") returned 4
	[0099.560] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0099.560] lstrlenW (lpString=".xlsx") returned 5
	[0099.560] lstrcmpiW (lpString1=".xlsx", lpString2="3.dll") returned -1
	[0099.560] lstrlenW (lpString=".ppt") returned 4
	[0099.560] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0099.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55
	[0099.560] lstrlenW (lpString=".zip") returned 4
	[0099.560] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0099.560] lstrlenW (lpString=".rar") returned 4
	[0099.560] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0099.560] lstrlenW (lpString=".bz2") returned 4
	[0099.560] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0099.560] lstrlenW (lpString=".7z") returned 3
	[0099.560] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0099.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55
	[0099.560] lstrlenW (lpString=".dbf") returned 4
	[0099.560] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0099.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55
	[0099.561] lstrlenW (lpString=".1cd") returned 4
	[0099.561] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0099.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55
	[0099.561] lstrlenW (lpString=".jpg") returned 4
	[0099.561] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0099.561] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0099.561] lstrlenW (lpString="oledb32r.dll") returned 12
	[0099.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.584] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=81920) returned 1
	[0099.584] CloseHandle (hObject=0x184) returned 1
	[0099.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20
	[0099.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56
	[0099.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56
	[0099.591] lstrlenW (lpString=".doc") returned 4
	[0099.591] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0099.591] lstrlenW (lpString=".docx") returned 5
	[0099.591] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0099.591] lstrlenW (lpString=".pdf") returned 4
	[0099.591] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0099.591] lstrlenW (lpString=".xls") returned 4
	[0099.591] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0099.591] lstrlenW (lpString=".xlsx") returned 5
	[0099.591] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0099.592] lstrlenW (lpString=".ppt") returned 4
	[0099.592] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0099.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56
	[0099.592] lstrlenW (lpString=".zip") returned 4
	[0099.592] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0099.592] lstrlenW (lpString=".rar") returned 4
	[0099.592] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0099.592] lstrlenW (lpString=".bz2") returned 4
	[0099.592] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0099.592] lstrlenW (lpString=".7z") returned 3
	[0099.592] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0099.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56
	[0099.592] lstrlenW (lpString=".dbf") returned 4
	[0099.592] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0099.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56
	[0099.592] lstrlenW (lpString=".1cd") returned 4
	[0099.592] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0099.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56
	[0099.592] lstrlenW (lpString=".jpg") returned 4
	[0099.592] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0099.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56
	[0099.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56
	[0099.593] lstrlenW (lpString=".doc") returned 4
	[0099.593] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0099.593] lstrlenW (lpString=".docx") returned 5
	[0099.593] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0099.593] lstrlenW (lpString=".pdf") returned 4
	[0099.593] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0099.593] lstrlenW (lpString=".xls") returned 4
	[0099.593] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0099.593] lstrlenW (lpString=".xlsx") returned 5
	[0099.593] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0099.593] lstrlenW (lpString=".ppt") returned 4
	[0099.593] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0099.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56
	[0099.593] lstrlenW (lpString=".zip") returned 4
	[0099.593] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0099.593] lstrlenW (lpString=".rar") returned 4
	[0099.593] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0099.594] lstrlenW (lpString=".bz2") returned 4
	[0099.594] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0099.594] lstrlenW (lpString=".7z") returned 3
	[0099.594] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0099.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56
	[0099.594] lstrlenW (lpString=".dbf") returned 4
	[0099.594] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0099.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56
	[0099.594] lstrlenW (lpString=".1cd") returned 4
	[0099.594] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0099.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56
	[0099.594] lstrlenW (lpString=".jpg") returned 4
	[0099.594] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0099.594] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0099.594] lstrlenW (lpString="sqloledb.dll") returned 12
	[0099.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.597] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1212416) returned 1
	[0099.597] CloseHandle (hObject=0x184) returned 1
	[0099.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll")) returned 0x20
	[0099.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56
	[0099.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56
	[0099.606] lstrlenW (lpString=".doc") returned 4
	[0099.606] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0099.606] lstrlenW (lpString=".docx") returned 5
	[0099.606] lstrcmpiW (lpString1=".docx", lpString2="b.dll") returned -1
	[0099.606] lstrlenW (lpString=".pdf") returned 4
	[0099.606] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0099.606] lstrlenW (lpString=".xls") returned 4
	[0099.606] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0099.606] lstrlenW (lpString=".xlsx") returned 5
	[0099.606] lstrcmpiW (lpString1=".xlsx", lpString2="b.dll") returned -1
	[0099.606] lstrlenW (lpString=".ppt") returned 4
	[0099.606] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0099.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56
	[0099.606] lstrlenW (lpString=".zip") returned 4
	[0099.606] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0099.606] lstrlenW (lpString=".rar") returned 4
	[0099.606] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0099.606] lstrlenW (lpString=".bz2") returned 4
	[0099.606] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0099.606] lstrlenW (lpString=".7z") returned 3
	[0099.606] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0099.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56
	[0099.606] lstrlenW (lpString=".dbf") returned 4
	[0099.606] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0099.676] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.676] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.703] GetLastError () returned 0x0
	[0099.703] ReadFile (in: hFile=0x170, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x44e18, lpOverlapped=0x0) returned 1
	[0099.712] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x44e20, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x44e20, lpOverlapped=0x0) returned 1
	[0099.718] ReadFile (in: hFile=0x170, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.718] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0099.718] SetEndOfFile (hFile=0x1a0) returned 1
	[0099.718] CloseHandle (hObject=0x1a0) returned 1
	[0099.718] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.718] SetEndOfFile (hFile=0x170) returned 1
	[0099.721] CloseHandle (hObject=0x170) returned 1
	[0099.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.722] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll")) returned 1
	[0099.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53
	[0099.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53
	[0099.723] lstrlenW (lpString=".doc") returned 4
	[0099.723] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0099.723] lstrlenW (lpString=".docx") returned 5
	[0099.723] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1
	[0099.723] lstrlenW (lpString=".pdf") returned 4
	[0099.723] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0099.723] lstrlenW (lpString=".xls") returned 4
	[0099.723] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0099.723] lstrlenW (lpString=".xlsx") returned 5
	[0099.723] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1
	[0099.723] lstrlenW (lpString=".ppt") returned 4
	[0099.723] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0099.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53
	[0099.723] lstrlenW (lpString=".zip") returned 4
	[0099.723] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0099.723] lstrlenW (lpString=".rar") returned 4
	[0099.723] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0099.723] lstrlenW (lpString=".bz2") returned 4
	[0099.723] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0099.723] lstrlenW (lpString=".7z") returned 3
	[0099.723] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0099.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53
	[0099.723] lstrlenW (lpString=".dbf") returned 4
	[0099.723] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0099.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53
	[0099.723] lstrlenW (lpString=".1cd") returned 4
	[0099.723] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0099.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53
	[0099.723] lstrlenW (lpString=".jpg") returned 4
	[0099.723] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0099.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53
	[0099.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53
	[0099.724] lstrlenW (lpString=".doc") returned 4
	[0099.724] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0099.724] lstrlenW (lpString=".docx") returned 5
	[0099.724] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1
	[0099.724] lstrlenW (lpString=".pdf") returned 4
	[0099.724] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0099.724] lstrlenW (lpString=".xls") returned 4
	[0099.724] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0099.724] lstrlenW (lpString=".xlsx") returned 5
	[0099.724] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1
	[0099.724] lstrlenW (lpString=".ppt") returned 4
	[0099.724] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0099.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53
	[0099.724] lstrlenW (lpString=".zip") returned 4
	[0099.724] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0099.724] lstrlenW (lpString=".rar") returned 4
	[0099.724] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0099.724] lstrlenW (lpString=".bz2") returned 4
	[0099.724] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0099.724] lstrlenW (lpString=".7z") returned 3
	[0099.724] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0099.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53
	[0099.724] lstrlenW (lpString=".dbf") returned 4
	[0099.724] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0099.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53
	[0099.724] lstrlenW (lpString=".1cd") returned 4
	[0099.724] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0099.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53
	[0099.724] lstrlenW (lpString=".jpg") returned 4
	[0099.724] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0099.725] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0099.725] lstrlenW (lpString="wab32.dll") returned 9
	[0099.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0099.725] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=886784) returned 1
	[0099.725] CloseHandle (hObject=0x170) returned 1
	[0099.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll")) returned 0x20
	[0099.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\wab32.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46
	[0099.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46
	[0099.726] lstrlenW (lpString=".doc") returned 4
	[0099.726] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0099.726] lstrlenW (lpString=".docx") returned 5
	[0099.726] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0099.726] lstrlenW (lpString=".pdf") returned 4
	[0099.726] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0099.726] lstrlenW (lpString=".xls") returned 4
	[0099.726] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0099.726] lstrlenW (lpString=".xlsx") returned 5
	[0099.726] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0099.726] lstrlenW (lpString=".ppt") returned 4
	[0099.726] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0099.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46
	[0099.726] lstrlenW (lpString=".zip") returned 4
	[0099.726] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0099.726] lstrlenW (lpString=".rar") returned 4
	[0099.726] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0099.726] lstrlenW (lpString=".bz2") returned 4
	[0099.726] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0099.726] lstrlenW (lpString=".7z") returned 3
	[0099.726] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0099.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46
	[0099.727] lstrlenW (lpString=".dbf") returned 4
	[0099.727] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0099.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46
	[0099.727] lstrlenW (lpString=".1cd") returned 4
	[0099.727] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0099.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46
	[0099.727] lstrlenW (lpString=".jpg") returned 4
	[0099.727] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0099.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46
	[0099.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46
	[0099.727] lstrlenW (lpString=".doc") returned 4
	[0099.727] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0099.727] lstrlenW (lpString=".docx") returned 5
	[0099.727] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0099.727] lstrlenW (lpString=".pdf") returned 4
	[0099.727] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0099.727] lstrlenW (lpString=".xls") returned 4
	[0099.727] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0099.727] lstrlenW (lpString=".xlsx") returned 5
	[0099.727] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0099.727] lstrlenW (lpString=".ppt") returned 4
	[0099.727] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0099.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46
	[0099.727] lstrlenW (lpString=".zip") returned 4
	[0099.727] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0099.727] lstrlenW (lpString=".rar") returned 4
	[0099.727] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0099.727] lstrlenW (lpString=".bz2") returned 4
	[0099.728] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0099.728] lstrlenW (lpString=".7z") returned 3
	[0099.728] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0099.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46
	[0099.728] lstrlenW (lpString=".dbf") returned 4
	[0099.728] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0099.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46
	[0099.728] lstrlenW (lpString=".1cd") returned 4
	[0099.728] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0099.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46
	[0099.728] lstrlenW (lpString=".jpg") returned 4
	[0099.728] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0099.728] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0099.728] lstrlenW (lpString="wab32res.dll") returned 12
	[0099.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0099.729] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1098752) returned 1
	[0099.729] CloseHandle (hObject=0x170) returned 1
	[0099.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0x20
	[0099.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\wab32res.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0099.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0099.729] lstrlenW (lpString=".doc") returned 4
	[0099.729] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0099.729] lstrlenW (lpString=".docx") returned 5
	[0099.729] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0099.729] lstrlenW (lpString=".pdf") returned 4
	[0099.729] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0099.729] lstrlenW (lpString=".xls") returned 4
	[0099.729] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0099.730] lstrlenW (lpString=".xlsx") returned 5
	[0099.730] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0099.730] lstrlenW (lpString=".ppt") returned 4
	[0099.730] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0099.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0099.730] lstrlenW (lpString=".zip") returned 4
	[0099.730] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0099.730] lstrlenW (lpString=".rar") returned 4
	[0099.730] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0099.730] lstrlenW (lpString=".bz2") returned 4
	[0099.730] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0099.730] lstrlenW (lpString=".7z") returned 3
	[0099.730] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0099.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0099.730] lstrlenW (lpString=".dbf") returned 4
	[0099.730] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0099.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0099.730] lstrlenW (lpString=".1cd") returned 4
	[0099.730] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0099.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0099.730] lstrlenW (lpString=".jpg") returned 4
	[0099.730] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0099.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0099.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0099.730] lstrlenW (lpString=".doc") returned 4
	[0099.730] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0099.730] lstrlenW (lpString=".docx") returned 5
	[0099.730] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0099.731] lstrlenW (lpString=".pdf") returned 4
	[0099.731] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0099.731] lstrlenW (lpString=".xls") returned 4
	[0099.731] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0099.731] lstrlenW (lpString=".xlsx") returned 5
	[0099.731] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0099.731] lstrlenW (lpString=".ppt") returned 4
	[0099.731] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0099.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0099.731] lstrlenW (lpString=".zip") returned 4
	[0099.731] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0099.731] lstrlenW (lpString=".rar") returned 4
	[0099.731] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0099.731] lstrlenW (lpString=".bz2") returned 4
	[0099.731] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0099.731] lstrlenW (lpString=".7z") returned 3
	[0099.731] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0099.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0099.731] lstrlenW (lpString=".dbf") returned 4
	[0099.731] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0099.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0099.731] lstrlenW (lpString=".1cd") returned 4
	[0099.731] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0099.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0099.731] lstrlenW (lpString=".jpg") returned 4
	[0099.731] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0099.731] lstrcmpiW (lpString1=".ax", lpString2=".adobe") returned 1
	[0099.731] lstrlenW (lpString="audiodepthconverter.ax") returned 22
	[0099.732] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.749] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=50688) returned 1
	[0099.749] CloseHandle (hObject=0x160) returned 1
	[0099.750] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax")) returned 0x20
	[0099.753] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.757] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.758] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49
	[0099.758] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49
	[0099.758] lstrlenW (lpString=".doc") returned 4
	[0099.758] lstrcmpiW (lpString1=".doc", lpString2="r.ax") returned -1
	[0099.758] lstrlenW (lpString=".docx") returned 5
	[0099.758] lstrcmpiW (lpString1=".docx", lpString2="er.ax") returned -1
	[0099.758] lstrlenW (lpString=".pdf") returned 4
	[0099.758] lstrcmpiW (lpString1=".pdf", lpString2="r.ax") returned -1
	[0099.758] lstrlenW (lpString=".xls") returned 4
	[0099.758] lstrcmpiW (lpString1=".xls", lpString2="r.ax") returned -1
	[0099.758] lstrlenW (lpString=".xlsx") returned 5
	[0099.758] lstrcmpiW (lpString1=".xlsx", lpString2="er.ax") returned -1
	[0099.758] lstrlenW (lpString=".ppt") returned 4
	[0099.758] lstrcmpiW (lpString1=".ppt", lpString2="r.ax") returned -1
	[0099.758] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49
	[0099.758] lstrlenW (lpString=".zip") returned 4
	[0099.758] lstrcmpiW (lpString1=".zip", lpString2="r.ax") returned -1
	[0099.758] lstrlenW (lpString=".rar") returned 4
	[0099.758] lstrcmpiW (lpString1=".rar", lpString2="r.ax") returned -1
	[0099.758] lstrlenW (lpString=".bz2") returned 4
	[0099.758] lstrcmpiW (lpString1=".bz2", lpString2="r.ax") returned -1
	[0099.758] lstrlenW (lpString=".7z") returned 3
	[0099.758] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1
	[0099.758] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49
	[0099.758] lstrlenW (lpString=".dbf") returned 4
	[0099.758] lstrcmpiW (lpString1=".dbf", lpString2="r.ax") returned -1
	[0099.758] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49
	[0099.758] lstrlenW (lpString=".1cd") returned 4
	[0099.758] lstrcmpiW (lpString1=".1cd", lpString2="r.ax") returned -1
	[0099.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49
	[0099.759] lstrlenW (lpString=".jpg") returned 4
	[0099.759] lstrcmpiW (lpString1=".jpg", lpString2="r.ax") returned -1
	[0099.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49
	[0099.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49
	[0099.759] lstrlenW (lpString=".doc") returned 4
	[0099.759] lstrcmpiW (lpString1=".doc", lpString2="r.ax") returned -1
	[0099.759] lstrlenW (lpString=".docx") returned 5
	[0099.759] lstrcmpiW (lpString1=".docx", lpString2="er.ax") returned -1
	[0099.759] lstrlenW (lpString=".pdf") returned 4
	[0099.759] lstrcmpiW (lpString1=".pdf", lpString2="r.ax") returned -1
	[0099.759] lstrlenW (lpString=".xls") returned 4
	[0099.759] lstrcmpiW (lpString1=".xls", lpString2="r.ax") returned -1
	[0099.759] lstrlenW (lpString=".xlsx") returned 5
	[0099.759] lstrcmpiW (lpString1=".xlsx", lpString2="er.ax") returned -1
	[0099.759] lstrlenW (lpString=".ppt") returned 4
	[0099.759] lstrcmpiW (lpString1=".ppt", lpString2="r.ax") returned -1
	[0099.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49
	[0099.759] lstrlenW (lpString=".zip") returned 4
	[0099.759] lstrcmpiW (lpString1=".zip", lpString2="r.ax") returned -1
	[0099.759] lstrlenW (lpString=".rar") returned 4
	[0099.759] lstrcmpiW (lpString1=".rar", lpString2="r.ax") returned -1
	[0099.759] lstrlenW (lpString=".bz2") returned 4
	[0099.759] lstrcmpiW (lpString1=".bz2", lpString2="r.ax") returned -1
	[0099.759] lstrlenW (lpString=".7z") returned 3
	[0099.759] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1
	[0099.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49
	[0099.759] lstrlenW (lpString=".dbf") returned 4
	[0099.759] lstrcmpiW (lpString1=".dbf", lpString2="r.ax") returned -1
	[0099.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49
	[0099.759] lstrlenW (lpString=".1cd") returned 4
	[0099.760] lstrcmpiW (lpString1=".1cd", lpString2="r.ax") returned -1
	[0099.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49
	[0099.760] lstrlenW (lpString=".jpg") returned 4
	[0099.760] lstrcmpiW (lpString1=".jpg", lpString2="r.ax") returned -1
	[0099.760] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0099.760] lstrlenW (lpString="DVDMaker.exe") returned 12
	[0099.760] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.805] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=2258432) returned 1
	[0099.805] CloseHandle (hObject=0x190) returned 1
	[0099.806] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe")) returned 0x20
	[0099.811] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.812] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0099.816] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39
	[0099.816] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39
	[0099.816] lstrlenW (lpString=".doc") returned 4
	[0099.816] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0099.816] lstrlenW (lpString=".docx") returned 5
	[0099.816] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0099.816] lstrlenW (lpString=".pdf") returned 4
	[0099.816] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0099.816] lstrlenW (lpString=".xls") returned 4
	[0099.817] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0099.817] lstrlenW (lpString=".xlsx") returned 5
	[0099.817] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0099.817] lstrlenW (lpString=".ppt") returned 4
	[0099.817] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0099.817] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39
	[0099.817] lstrlenW (lpString=".zip") returned 4
	[0099.817] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0099.817] lstrlenW (lpString=".rar") returned 4
	[0099.817] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0099.817] lstrlenW (lpString=".bz2") returned 4
	[0099.817] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0099.817] lstrlenW (lpString=".7z") returned 3
	[0099.817] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0099.817] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39
	[0099.817] lstrlenW (lpString=".dbf") returned 4
	[0099.817] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0099.817] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39
	[0099.817] lstrlenW (lpString=".1cd") returned 4
	[0099.817] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0099.817] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39
	[0099.817] lstrlenW (lpString=".jpg") returned 4
	[0099.817] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0099.817] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39
	[0099.817] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39
	[0099.817] lstrlenW (lpString=".doc") returned 4
	[0099.817] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0099.817] lstrlenW (lpString=".docx") returned 5
	[0099.817] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0099.818] lstrlenW (lpString=".pdf") returned 4
	[0099.818] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0099.818] lstrlenW (lpString=".xls") returned 4
	[0099.818] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0099.818] lstrlenW (lpString=".xlsx") returned 5
	[0099.818] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0099.818] lstrlenW (lpString=".ppt") returned 4
	[0099.818] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0099.818] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39
	[0099.818] lstrlenW (lpString=".zip") returned 4
	[0099.818] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0099.818] lstrlenW (lpString=".rar") returned 4
	[0099.818] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0099.818] lstrlenW (lpString=".bz2") returned 4
	[0099.818] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0099.818] lstrlenW (lpString=".7z") returned 3
	[0099.818] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0099.818] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39
	[0099.818] lstrlenW (lpString=".dbf") returned 4
	[0099.818] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0099.818] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39
	[0099.818] lstrlenW (lpString=".1cd") returned 4
	[0099.818] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0099.818] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39
	[0099.818] lstrlenW (lpString=".jpg") returned 4
	[0099.818] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0099.818] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0099.819] lstrlenW (lpString="OmdProject.dll.mui") returned 18
	[0099.819] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.828] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=12288) returned 1
	[0099.828] CloseHandle (hObject=0x190) returned 1
	[0099.828] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui")) returned 0x20
	[0099.839] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.839] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.839] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51
	[0099.839] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51
	[0099.839] lstrlenW (lpString=".doc") returned 4
	[0099.839] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0099.839] lstrlenW (lpString=".docx") returned 5
	[0099.839] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0099.839] lstrlenW (lpString=".pdf") returned 4
	[0099.839] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0099.839] lstrlenW (lpString=".xls") returned 4
	[0099.839] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0099.839] lstrlenW (lpString=".xlsx") returned 5
	[0099.839] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0099.839] lstrlenW (lpString=".ppt") returned 4
	[0099.839] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0099.839] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51
	[0099.839] lstrlenW (lpString=".zip") returned 4
	[0099.839] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0099.839] lstrlenW (lpString=".rar") returned 4
	[0099.839] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0099.840] lstrlenW (lpString=".bz2") returned 4
	[0099.840] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0099.840] lstrlenW (lpString=".7z") returned 3
	[0099.840] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0099.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51
	[0099.840] lstrlenW (lpString=".dbf") returned 4
	[0099.840] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0099.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51
	[0099.840] lstrlenW (lpString=".1cd") returned 4
	[0099.840] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0099.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51
	[0099.840] lstrlenW (lpString=".jpg") returned 4
	[0099.840] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0099.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51
	[0099.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51
	[0099.840] lstrlenW (lpString=".doc") returned 4
	[0099.840] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0099.840] lstrlenW (lpString=".docx") returned 5
	[0099.840] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0099.840] lstrlenW (lpString=".pdf") returned 4
	[0099.840] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0099.840] lstrlenW (lpString=".xls") returned 4
	[0099.840] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0099.840] lstrlenW (lpString=".xlsx") returned 5
	[0099.840] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0099.840] lstrlenW (lpString=".ppt") returned 4
	[0099.840] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0099.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51
	[0099.840] lstrlenW (lpString=".zip") returned 4
	[0099.840] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0099.840] lstrlenW (lpString=".rar") returned 4
	[0099.841] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0099.841] lstrlenW (lpString=".bz2") returned 4
	[0099.841] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0099.841] lstrlenW (lpString=".7z") returned 3
	[0099.841] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0099.841] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51
	[0099.841] lstrlenW (lpString=".dbf") returned 4
	[0099.841] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0099.841] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51
	[0099.841] lstrlenW (lpString=".1cd") returned 4
	[0099.841] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0099.841] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51
	[0099.841] lstrlenW (lpString=".jpg") returned 4
	[0099.841] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0099.841] lstrcmpiW (lpString1=".TTF", lpString2=".adobe") returned 1
	[0099.841] lstrlenW (lpString="Eurosti.TTF") returned 11
	[0099.841] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.842] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=56760) returned 1
	[0099.842] CloseHandle (hObject=0x1c0) returned 1
	[0099.842] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf")) returned 0x20
	[0099.842] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.842] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.842] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38
	[0099.842] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38
	[0099.842] lstrlenW (lpString=".doc") returned 4
	[0099.842] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1
	[0099.842] lstrlenW (lpString=".docx") returned 5
	[0099.842] lstrcmpiW (lpString1=".docx", lpString2="i.TTF") returned -1
	[0099.842] lstrlenW (lpString=".pdf") returned 4
	[0099.842] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1
	[0099.842] lstrlenW (lpString=".xls") returned 4
	[0099.842] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1
	[0099.842] lstrlenW (lpString=".xlsx") returned 5
	[0099.842] lstrcmpiW (lpString1=".xlsx", lpString2="i.TTF") returned -1
	[0099.842] lstrlenW (lpString=".ppt") returned 4
	[0099.843] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1
	[0099.843] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38
	[0099.843] lstrlenW (lpString=".zip") returned 4
	[0099.843] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1
	[0099.843] lstrlenW (lpString=".rar") returned 4
	[0099.843] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1
	[0099.843] lstrlenW (lpString=".bz2") returned 4
	[0099.843] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1
	[0099.843] lstrlenW (lpString=".7z") returned 3
	[0099.843] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1
	[0099.843] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38
	[0099.843] lstrlenW (lpString=".dbf") returned 4
	[0099.843] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1
	[0099.923] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0099.988] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0100.045] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0100.148] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=79360) returned 1
	[0100.148] CloseHandle (hObject=0x198) returned 1
	[0100.148] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax")) returned 0x20
	[0100.176] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.176] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0100.186] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=303104) returned 1
	[0100.186] CloseHandle (hObject=0x174) returned 1
	[0100.186] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll")) returned 0x20
	[0100.192] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.192] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0101.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0101.094] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0101.094] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.094] ReadFile (in: hFile=0x194, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.149] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xe21f22, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.149] ReadFile (in: hFile=0x194, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.203] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.203] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x2a25d68, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.203] ReadFile (in: hFile=0x194, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.287] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.288] WriteFile (in: hFile=0x194, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0106, lpOverlapped=0x0) returned 1
	[0101.309] SetEndOfFile (hFile=0x194) returned 1
	[0101.309] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f60070
	[0101.352] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.352] WriteFile (in: hFile=0x194, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.354] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xe21f22, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.354] WriteFile (in: hFile=0x194, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.355] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x2a25d68, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.355] WriteFile (in: hFile=0x194, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.358] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f60070 | out: hHeap=0x5e0000) returned 1
	[0101.361] CloseHandle (hObject=0x194) returned 1
	[0101.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70
	[0101.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70
	[0101.361] lstrlenW (lpString=".doc") returned 4
	[0101.361] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0101.361] lstrlenW (lpString=".docx") returned 5
	[0101.361] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1
	[0101.361] lstrlenW (lpString=".pdf") returned 4
	[0101.361] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0101.361] lstrlenW (lpString=".xls") returned 4
	[0101.361] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0101.361] lstrlenW (lpString=".xlsx") returned 5
	[0101.361] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1
	[0101.361] lstrlenW (lpString=".ppt") returned 4
	[0101.361] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0101.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70
	[0101.362] lstrlenW (lpString=".zip") returned 4
	[0101.362] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0101.362] lstrlenW (lpString=".rar") returned 4
	[0101.362] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0101.362] lstrlenW (lpString=".bz2") returned 4
	[0101.362] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0101.362] lstrlenW (lpString=".7z") returned 3
	[0101.362] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0101.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70
	[0101.362] lstrlenW (lpString=".dbf") returned 4
	[0101.362] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0101.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70
	[0101.362] lstrlenW (lpString=".1cd") returned 4
	[0101.362] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0101.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70
	[0101.362] lstrlenW (lpString=".jpg") returned 4
	[0101.362] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0101.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70
	[0101.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70
	[0101.362] lstrlenW (lpString=".doc") returned 4
	[0101.362] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0101.362] lstrlenW (lpString=".docx") returned 5
	[0101.362] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1
	[0101.362] lstrlenW (lpString=".pdf") returned 4
	[0101.362] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0101.362] lstrlenW (lpString=".xls") returned 4
	[0101.362] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0101.362] lstrlenW (lpString=".xlsx") returned 5
	[0101.362] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1
	[0101.362] lstrlenW (lpString=".ppt") returned 4
	[0101.363] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0101.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70
	[0101.363] lstrlenW (lpString=".zip") returned 4
	[0101.363] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0101.363] lstrlenW (lpString=".rar") returned 4
	[0101.363] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0101.363] lstrlenW (lpString=".bz2") returned 4
	[0101.363] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0101.363] lstrlenW (lpString=".7z") returned 3
	[0101.363] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0101.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70
	[0101.363] lstrlenW (lpString=".dbf") returned 4
	[0101.363] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0101.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70
	[0101.363] lstrlenW (lpString=".1cd") returned 4
	[0101.363] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0101.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70
	[0101.363] lstrlenW (lpString=".jpg") returned 4
	[0101.363] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0101.363] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0101.363] lstrlenW (lpString="msolui100.dll") returned 13
	[0101.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0101.368] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=318488) returned 1
	[0101.368] CloseHandle (hObject=0x194) returned 1
	[0101.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll")) returned 0x20
	[0101.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0101.369] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.369] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0101.370] GetLastError () returned 0x0
	[0101.370] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x4dc18, lpOverlapped=0x0) returned 1
	[0101.429] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4dc20, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x4dc20, lpOverlapped=0x0) returned 1
	[0101.439] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.439] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0101.440] SetEndOfFile (hFile=0x1b0) returned 1
	[0101.440] CloseHandle (hObject=0x1b0) returned 1
	[0101.440] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.440] SetEndOfFile (hFile=0x194) returned 1
	[0101.443] CloseHandle (hObject=0x194) returned 1
	[0101.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll")) returned 1
	[0101.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70
	[0101.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70
	[0101.444] lstrlenW (lpString=".doc") returned 4
	[0101.444] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0101.444] lstrlenW (lpString=".docx") returned 5
	[0101.444] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0101.444] lstrlenW (lpString=".pdf") returned 4
	[0101.444] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0101.444] lstrlenW (lpString=".xls") returned 4
	[0101.444] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0101.444] lstrlenW (lpString=".xlsx") returned 5
	[0101.444] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0101.444] lstrlenW (lpString=".ppt") returned 4
	[0101.444] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0101.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70
	[0101.444] lstrlenW (lpString=".zip") returned 4
	[0101.444] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0101.444] lstrlenW (lpString=".rar") returned 4
	[0101.444] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0101.444] lstrlenW (lpString=".bz2") returned 4
	[0101.445] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0101.445] lstrlenW (lpString=".7z") returned 3
	[0101.445] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0101.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70
	[0101.445] lstrlenW (lpString=".dbf") returned 4
	[0101.445] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0101.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70
	[0101.445] lstrlenW (lpString=".1cd") returned 4
	[0101.445] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0101.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70
	[0101.445] lstrlenW (lpString=".jpg") returned 4
	[0101.445] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0101.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70
	[0101.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70
	[0101.445] lstrlenW (lpString=".doc") returned 4
	[0101.445] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0101.445] lstrlenW (lpString=".docx") returned 5
	[0101.445] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0101.445] lstrlenW (lpString=".pdf") returned 4
	[0101.445] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0101.445] lstrlenW (lpString=".xls") returned 4
	[0101.445] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0101.445] lstrlenW (lpString=".xlsx") returned 5
	[0101.445] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0101.445] lstrlenW (lpString=".ppt") returned 4
	[0101.445] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0101.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70
	[0101.445] lstrlenW (lpString=".zip") returned 4
	[0101.445] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0101.445] lstrlenW (lpString=".rar") returned 4
	[0101.446] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0101.446] lstrlenW (lpString=".bz2") returned 4
	[0101.446] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0101.446] lstrlenW (lpString=".7z") returned 3
	[0101.446] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0101.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70
	[0101.446] lstrlenW (lpString=".dbf") returned 4
	[0101.446] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0101.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70
	[0101.446] lstrlenW (lpString=".1cd") returned 4
	[0101.446] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0101.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70
	[0101.446] lstrlenW (lpString=".jpg") returned 4
	[0101.446] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0101.446] lstrcmpiW (lpString1=".rll", lpString2=".adobe") returned 1
	[0101.446] lstrlenW (lpString="msmdsrv.rll") returned 11
	[0101.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0101.447] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=666456) returned 1
	[0101.447] CloseHandle (hObject=0x194) returned 1
	[0101.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 0x20
	[0101.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0101.448] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.448] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0101.449] GetLastError () returned 0x0
	[0101.449] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xa2b58, lpOverlapped=0x0) returned 1
	[0101.465] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xa2b60, lpOverlapped=0x0) returned 1
	[0101.489] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.489] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0101.489] SetEndOfFile (hFile=0x1b0) returned 1
	[0101.489] CloseHandle (hObject=0x1b0) returned 1
	[0101.489] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.489] SetEndOfFile (hFile=0x194) returned 1
	[0101.495] CloseHandle (hObject=0x194) returned 1
	[0101.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 1
	[0101.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0101.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0101.496] lstrlenW (lpString=".doc") returned 4
	[0101.496] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1
	[0101.496] lstrlenW (lpString=".docx") returned 5
	[0101.496] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1
	[0101.496] lstrlenW (lpString=".pdf") returned 4
	[0101.496] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1
	[0101.496] lstrlenW (lpString=".xls") returned 4
	[0101.496] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1
	[0101.496] lstrlenW (lpString=".xlsx") returned 5
	[0101.496] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1
	[0101.496] lstrlenW (lpString=".ppt") returned 4
	[0101.496] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1
	[0101.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0101.496] lstrlenW (lpString=".zip") returned 4
	[0101.496] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1
	[0101.496] lstrlenW (lpString=".rar") returned 4
	[0101.496] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1
	[0101.496] lstrlenW (lpString=".bz2") returned 4
	[0101.496] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1
	[0101.496] lstrlenW (lpString=".7z") returned 3
	[0101.496] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1
	[0101.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0101.496] lstrlenW (lpString=".dbf") returned 4
	[0101.496] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1
	[0101.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0101.497] lstrlenW (lpString=".1cd") returned 4
	[0101.497] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1
	[0101.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0101.497] lstrlenW (lpString=".jpg") returned 4
	[0101.497] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1
	[0101.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0101.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0101.497] lstrlenW (lpString=".doc") returned 4
	[0101.497] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1
	[0101.497] lstrlenW (lpString=".docx") returned 5
	[0101.497] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1
	[0101.497] lstrlenW (lpString=".pdf") returned 4
	[0101.497] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1
	[0101.497] lstrlenW (lpString=".xls") returned 4
	[0101.497] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1
	[0101.497] lstrlenW (lpString=".xlsx") returned 5
	[0101.497] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1
	[0101.497] lstrlenW (lpString=".ppt") returned 4
	[0101.497] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1
	[0101.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0101.497] lstrlenW (lpString=".zip") returned 4
	[0101.497] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1
	[0101.497] lstrlenW (lpString=".rar") returned 4
	[0101.497] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1
	[0101.497] lstrlenW (lpString=".bz2") returned 4
	[0101.497] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1
	[0101.497] lstrlenW (lpString=".7z") returned 3
	[0101.497] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1
	[0101.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0101.497] lstrlenW (lpString=".dbf") returned 4
	[0101.497] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1
	[0101.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0101.498] lstrlenW (lpString=".1cd") returned 4
	[0101.498] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1
	[0101.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0101.498] lstrlenW (lpString=".jpg") returned 4
	[0101.498] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1
	[0101.498] lstrcmpiW (lpString1=".rll", lpString2=".adobe") returned 1
	[0101.498] lstrlenW (lpString="msolui100.rll") returned 13
	[0101.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0101.499] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=14872) returned 1
	[0101.499] CloseHandle (hObject=0x194) returned 1
	[0101.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 0x20
	[0101.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0101.499] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.500] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0101.548] GetLastError () returned 0x0
	[0101.548] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x3a18, lpOverlapped=0x0) returned 1
	[0101.567] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x3a20, lpOverlapped=0x0) returned 1
	[0101.568] ReadFile (in: hFile=0x194, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.568] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0101.568] SetEndOfFile (hFile=0x1b0) returned 1
	[0101.568] CloseHandle (hObject=0x1b0) returned 1
	[0101.581] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.581] SetEndOfFile (hFile=0x194) returned 1
	[0101.582] CloseHandle (hObject=0x194) returned 1
	[0101.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 1
	[0101.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0101.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0101.583] lstrlenW (lpString=".doc") returned 4
	[0101.583] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1
	[0101.583] lstrlenW (lpString=".docx") returned 5
	[0101.583] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1
	[0101.583] lstrlenW (lpString=".pdf") returned 4
	[0101.583] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1
	[0101.583] lstrlenW (lpString=".xls") returned 4
	[0101.583] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1
	[0101.583] lstrlenW (lpString=".xlsx") returned 5
	[0101.583] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1
	[0101.583] lstrlenW (lpString=".ppt") returned 4
	[0101.583] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1
	[0101.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0101.583] lstrlenW (lpString=".zip") returned 4
	[0101.583] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1
	[0101.583] lstrlenW (lpString=".rar") returned 4
	[0101.583] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1
	[0101.583] lstrlenW (lpString=".bz2") returned 4
	[0101.584] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1
	[0101.584] lstrlenW (lpString=".7z") returned 3
	[0101.584] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1
	[0101.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0101.584] lstrlenW (lpString=".dbf") returned 4
	[0101.584] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1
	[0101.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0101.584] lstrlenW (lpString=".1cd") returned 4
	[0101.584] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1
	[0101.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0101.584] lstrlenW (lpString=".jpg") returned 4
	[0101.584] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1
	[0101.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0101.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0101.584] lstrlenW (lpString=".doc") returned 4
	[0101.584] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1
	[0101.584] lstrlenW (lpString=".docx") returned 5
	[0101.584] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1
	[0101.584] lstrlenW (lpString=".pdf") returned 4
	[0101.584] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1
	[0101.584] lstrlenW (lpString=".xls") returned 4
	[0101.584] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1
	[0101.584] lstrlenW (lpString=".xlsx") returned 5
	[0101.584] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1
	[0101.584] lstrlenW (lpString=".ppt") returned 4
	[0101.584] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1
	[0101.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0101.584] lstrlenW (lpString=".zip") returned 4
	[0101.584] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1
	[0101.584] lstrlenW (lpString=".rar") returned 4
	[0101.584] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1
	[0101.584] lstrlenW (lpString=".bz2") returned 4
	[0101.585] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1
	[0101.585] lstrlenW (lpString=".7z") returned 3
	[0101.585] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1
	[0101.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0101.585] lstrlenW (lpString=".dbf") returned 4
	[0101.585] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1
	[0101.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0101.585] lstrlenW (lpString=".1cd") returned 4
	[0101.585] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1
	[0101.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0101.585] lstrlenW (lpString=".jpg") returned 4
	[0101.585] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1
	[0101.585] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0101.585] lstrlenW (lpString="CARBN_01.MID") returned 12
	[0101.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0101.596] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=9322) returned 1
	[0101.596] CloseHandle (hObject=0x19c) returned 1
	[0101.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 0x20
	[0101.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0101.611] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.612] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0101.629] GetLastError () returned 0x0
	[0101.629] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x246a, lpOverlapped=0x0) returned 1
	[0101.631] WriteFile (in: hFile=0x174, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2470, lpOverlapped=0x0) returned 1
	[0101.635] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.635] WriteFile (in: hFile=0x174, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.635] SetEndOfFile (hFile=0x174) returned 1
	[0101.644] CloseHandle (hObject=0x174) returned 1
	[0101.652] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.652] SetEndOfFile (hFile=0x19c) returned 1
	[0101.661] CloseHandle (hObject=0x19c) returned 1
	[0101.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 1
	[0101.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0101.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0101.665] lstrlenW (lpString=".doc") returned 4
	[0101.665] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.665] lstrlenW (lpString=".docx") returned 5
	[0101.665] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0101.666] lstrlenW (lpString=".pdf") returned 4
	[0101.666] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.666] lstrlenW (lpString=".xls") returned 4
	[0101.666] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.666] lstrlenW (lpString=".xlsx") returned 5
	[0101.666] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0101.666] lstrlenW (lpString=".ppt") returned 4
	[0101.666] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0101.666] lstrlenW (lpString=".zip") returned 4
	[0101.666] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.666] lstrlenW (lpString=".rar") returned 4
	[0101.666] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.666] lstrlenW (lpString=".bz2") returned 4
	[0101.666] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.666] lstrlenW (lpString=".7z") returned 3
	[0101.666] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0101.666] lstrlenW (lpString=".dbf") returned 4
	[0101.666] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0101.666] lstrlenW (lpString=".1cd") returned 4
	[0101.666] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0101.666] lstrlenW (lpString=".jpg") returned 4
	[0101.666] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0101.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0101.667] lstrlenW (lpString=".doc") returned 4
	[0101.667] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.667] lstrlenW (lpString=".docx") returned 5
	[0101.667] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0101.667] lstrlenW (lpString=".pdf") returned 4
	[0101.667] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.667] lstrlenW (lpString=".xls") returned 4
	[0101.667] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.667] lstrlenW (lpString=".xlsx") returned 5
	[0101.667] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0101.667] lstrlenW (lpString=".ppt") returned 4
	[0101.667] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0101.667] lstrlenW (lpString=".zip") returned 4
	[0101.667] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.667] lstrlenW (lpString=".rar") returned 4
	[0101.667] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.667] lstrlenW (lpString=".bz2") returned 4
	[0101.667] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.667] lstrlenW (lpString=".7z") returned 3
	[0101.667] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0101.667] lstrlenW (lpString=".dbf") returned 4
	[0101.667] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0101.669] lstrlenW (lpString=".1cd") returned 4
	[0101.669] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0101.669] lstrlenW (lpString=".jpg") returned 4
	[0101.669] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.669] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0101.669] lstrlenW (lpString="CMNTY_01.MID") returned 12
	[0101.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0101.681] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=6970) returned 1
	[0101.681] CloseHandle (hObject=0x160) returned 1
	[0101.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x20
	[0101.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0101.708] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.708] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0101.723] GetLastError () returned 0x0
	[0101.723] ReadFile (in: hFile=0x174, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1b3a, lpOverlapped=0x0) returned 1
	[0101.729] WriteFile (in: hFile=0x1cc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1b40, lpOverlapped=0x0) returned 1
	[0101.730] ReadFile (in: hFile=0x174, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.730] WriteFile (in: hFile=0x1cc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.730] SetEndOfFile (hFile=0x1cc) returned 1
	[0101.735] CloseHandle (hObject=0x1cc) returned 1
	[0101.738] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.738] SetEndOfFile (hFile=0x174) returned 1
	[0101.741] CloseHandle (hObject=0x174) returned 1
	[0101.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 1
	[0101.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0101.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0101.745] lstrlenW (lpString=".doc") returned 4
	[0101.745] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.745] lstrlenW (lpString=".docx") returned 5
	[0101.745] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0101.745] lstrlenW (lpString=".pdf") returned 4
	[0101.745] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.745] lstrlenW (lpString=".xls") returned 4
	[0101.745] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.745] lstrlenW (lpString=".xlsx") returned 5
	[0101.745] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0101.745] lstrlenW (lpString=".ppt") returned 4
	[0101.745] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0101.745] lstrlenW (lpString=".zip") returned 4
	[0101.745] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.745] lstrlenW (lpString=".rar") returned 4
	[0101.745] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.745] lstrlenW (lpString=".bz2") returned 4
	[0101.745] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.745] lstrlenW (lpString=".7z") returned 3
	[0101.745] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0101.746] lstrlenW (lpString=".dbf") returned 4
	[0101.746] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0101.746] lstrlenW (lpString=".1cd") returned 4
	[0101.746] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0101.746] lstrlenW (lpString=".jpg") returned 4
	[0101.746] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0101.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0101.746] lstrlenW (lpString=".doc") returned 4
	[0101.746] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.746] lstrlenW (lpString=".docx") returned 5
	[0101.746] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0101.746] lstrlenW (lpString=".pdf") returned 4
	[0101.746] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.746] lstrlenW (lpString=".xls") returned 4
	[0101.746] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.746] lstrlenW (lpString=".xlsx") returned 5
	[0101.746] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0101.746] lstrlenW (lpString=".ppt") returned 4
	[0101.746] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0101.746] lstrlenW (lpString=".zip") returned 4
	[0101.746] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.746] lstrlenW (lpString=".rar") returned 4
	[0101.747] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.747] lstrlenW (lpString=".bz2") returned 4
	[0101.747] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.747] lstrlenW (lpString=".7z") returned 3
	[0101.747] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0101.747] lstrlenW (lpString=".dbf") returned 4
	[0101.747] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0101.747] lstrlenW (lpString=".1cd") returned 4
	[0101.747] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0101.747] lstrlenW (lpString=".jpg") returned 4
	[0101.747] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.747] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0101.747] lstrlenW (lpString="EXPLR_01.MID") returned 12
	[0101.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0101.761] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=10562) returned 1
	[0101.761] CloseHandle (hObject=0x160) returned 1
	[0101.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 0x20
	[0101.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0101.787] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.787] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0101.801] GetLastError () returned 0x0
	[0101.801] ReadFile (in: hFile=0x1c0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x2942, lpOverlapped=0x0) returned 1
	[0101.803] WriteFile (in: hFile=0x174, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2950, lpOverlapped=0x0) returned 1
	[0101.804] ReadFile (in: hFile=0x1c0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.804] WriteFile (in: hFile=0x174, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.804] SetEndOfFile (hFile=0x174) returned 1
	[0101.806] CloseHandle (hObject=0x174) returned 1
	[0101.806] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.806] SetEndOfFile (hFile=0x1c0) returned 1
	[0101.811] CloseHandle (hObject=0x1c0) returned 1
	[0101.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 1
	[0101.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0101.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0101.815] lstrlenW (lpString=".doc") returned 4
	[0101.815] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.815] lstrlenW (lpString=".docx") returned 5
	[0101.815] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0101.815] lstrlenW (lpString=".pdf") returned 4
	[0101.815] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.815] lstrlenW (lpString=".xls") returned 4
	[0101.815] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.815] lstrlenW (lpString=".xlsx") returned 5
	[0101.815] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0101.815] lstrlenW (lpString=".ppt") returned 4
	[0101.815] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0101.815] lstrlenW (lpString=".zip") returned 4
	[0101.815] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.815] lstrlenW (lpString=".rar") returned 4
	[0101.815] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.816] lstrlenW (lpString=".bz2") returned 4
	[0101.816] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.816] lstrlenW (lpString=".7z") returned 3
	[0101.816] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0101.816] lstrlenW (lpString=".dbf") returned 4
	[0101.816] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0101.816] lstrlenW (lpString=".1cd") returned 4
	[0101.816] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0101.816] lstrlenW (lpString=".jpg") returned 4
	[0101.816] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0101.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0101.816] lstrlenW (lpString=".doc") returned 4
	[0101.816] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.816] lstrlenW (lpString=".docx") returned 5
	[0101.816] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0101.816] lstrlenW (lpString=".pdf") returned 4
	[0101.816] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.816] lstrlenW (lpString=".xls") returned 4
	[0101.816] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.816] lstrlenW (lpString=".xlsx") returned 5
	[0101.816] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0101.816] lstrlenW (lpString=".ppt") returned 4
	[0101.816] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0101.816] lstrlenW (lpString=".zip") returned 4
	[0101.816] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.816] lstrlenW (lpString=".rar") returned 4
	[0101.817] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.817] lstrlenW (lpString=".bz2") returned 4
	[0101.817] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.817] lstrlenW (lpString=".7z") returned 3
	[0101.817] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0101.817] lstrlenW (lpString=".dbf") returned 4
	[0101.817] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0101.817] lstrlenW (lpString=".1cd") returned 4
	[0101.817] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0101.817] lstrlenW (lpString=".jpg") returned 4
	[0101.817] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.817] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0101.817] lstrlenW (lpString="FINCL_01.MID") returned 12
	[0101.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0101.828] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=12981) returned 1
	[0101.828] CloseHandle (hObject=0x160) returned 1
	[0101.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 0x20
	[0101.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0101.852] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.853] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0101.869] GetLastError () returned 0x0
	[0101.869] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x32b5, lpOverlapped=0x0) returned 1
	[0101.872] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x32c0, lpOverlapped=0x0) returned 1
	[0101.873] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.873] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.873] SetEndOfFile (hFile=0x1a0) returned 1
	[0101.879] CloseHandle (hObject=0x1a0) returned 1
	[0101.879] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.879] SetEndOfFile (hFile=0x198) returned 1
	[0101.882] CloseHandle (hObject=0x198) returned 1
	[0101.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 1
	[0101.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0101.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0101.889] lstrlenW (lpString=".doc") returned 4
	[0101.889] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.889] lstrlenW (lpString=".docx") returned 5
	[0101.889] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0101.889] lstrlenW (lpString=".pdf") returned 4
	[0101.889] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.889] lstrlenW (lpString=".xls") returned 4
	[0101.889] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.889] lstrlenW (lpString=".xlsx") returned 5
	[0101.889] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0101.889] lstrlenW (lpString=".ppt") returned 4
	[0101.889] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0101.889] lstrlenW (lpString=".zip") returned 4
	[0101.889] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.889] lstrlenW (lpString=".rar") returned 4
	[0101.889] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.889] lstrlenW (lpString=".bz2") returned 4
	[0101.889] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.889] lstrlenW (lpString=".7z") returned 3
	[0101.890] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0101.890] lstrlenW (lpString=".dbf") returned 4
	[0101.890] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0101.890] lstrlenW (lpString=".1cd") returned 4
	[0101.890] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0101.890] lstrlenW (lpString=".jpg") returned 4
	[0101.890] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0101.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0101.890] lstrlenW (lpString=".doc") returned 4
	[0101.890] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.890] lstrlenW (lpString=".docx") returned 5
	[0101.890] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0101.890] lstrlenW (lpString=".pdf") returned 4
	[0101.890] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.890] lstrlenW (lpString=".xls") returned 4
	[0101.890] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.890] lstrlenW (lpString=".xlsx") returned 5
	[0101.890] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0101.890] lstrlenW (lpString=".ppt") returned 4
	[0101.890] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0101.891] lstrlenW (lpString=".zip") returned 4
	[0101.891] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.891] lstrlenW (lpString=".rar") returned 4
	[0101.891] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.891] lstrlenW (lpString=".bz2") returned 4
	[0101.891] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.891] lstrlenW (lpString=".7z") returned 3
	[0101.891] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0101.891] lstrlenW (lpString=".dbf") returned 4
	[0101.891] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0101.891] lstrlenW (lpString=".1cd") returned 4
	[0101.891] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0101.891] lstrlenW (lpString=".jpg") returned 4
	[0101.891] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.891] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0101.891] lstrlenW (lpString="GRDEN_01.MID") returned 12
	[0101.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0101.924] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=7567) returned 1
	[0101.924] CloseHandle (hObject=0x190) returned 1
	[0101.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 0x20
	[0101.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0101.961] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.961] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0101.978] GetLastError () returned 0x0
	[0101.978] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1d8f, lpOverlapped=0x0) returned 1
	[0101.980] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1d90, lpOverlapped=0x0) returned 1
	[0101.981] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.981] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.981] SetEndOfFile (hFile=0x19c) returned 1
	[0101.988] CloseHandle (hObject=0x19c) returned 1
	[0101.991] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.991] SetEndOfFile (hFile=0x198) returned 1
	[0101.995] CloseHandle (hObject=0x198) returned 1
	[0102.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 1
	[0102.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0102.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0102.016] lstrlenW (lpString=".doc") returned 4
	[0102.016] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.016] lstrlenW (lpString=".docx") returned 5
	[0102.016] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.016] lstrlenW (lpString=".pdf") returned 4
	[0102.016] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.016] lstrlenW (lpString=".xls") returned 4
	[0102.016] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.016] lstrlenW (lpString=".xlsx") returned 5
	[0102.016] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.016] lstrlenW (lpString=".ppt") returned 4
	[0102.016] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0102.016] lstrlenW (lpString=".zip") returned 4
	[0102.016] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.016] lstrlenW (lpString=".rar") returned 4
	[0102.016] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.016] lstrlenW (lpString=".bz2") returned 4
	[0102.016] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.016] lstrlenW (lpString=".7z") returned 3
	[0102.016] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0102.016] lstrlenW (lpString=".dbf") returned 4
	[0102.016] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0102.016] lstrlenW (lpString=".1cd") returned 4
	[0102.016] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0102.016] lstrlenW (lpString=".jpg") returned 4
	[0102.016] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0102.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0102.017] lstrlenW (lpString=".doc") returned 4
	[0102.017] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.017] lstrlenW (lpString=".docx") returned 5
	[0102.017] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.017] lstrlenW (lpString=".pdf") returned 4
	[0102.017] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.017] lstrlenW (lpString=".xls") returned 4
	[0102.017] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.017] lstrlenW (lpString=".xlsx") returned 5
	[0102.017] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.017] lstrlenW (lpString=".ppt") returned 4
	[0102.017] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0102.017] lstrlenW (lpString=".zip") returned 4
	[0102.017] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.017] lstrlenW (lpString=".rar") returned 4
	[0102.017] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.017] lstrlenW (lpString=".bz2") returned 4
	[0102.017] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.017] lstrlenW (lpString=".7z") returned 3
	[0102.017] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0102.017] lstrlenW (lpString=".dbf") returned 4
	[0102.017] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0102.017] lstrlenW (lpString=".1cd") returned 4
	[0102.017] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0102.017] lstrlenW (lpString=".jpg") returned 4
	[0102.017] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.018] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.018] lstrlenW (lpString="HTECH_01.MID") returned 12
	[0102.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.032] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=7178) returned 1
	[0102.032] CloseHandle (hObject=0x1d0) returned 1
	[0102.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 0x20
	[0102.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.046] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.046] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0102.067] GetLastError () returned 0x0
	[0102.067] ReadFile (in: hFile=0x1d4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1c0a, lpOverlapped=0x0) returned 1
	[0102.072] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1c10, lpOverlapped=0x0) returned 1
	[0102.074] ReadFile (in: hFile=0x1d4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.074] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.074] SetEndOfFile (hFile=0x1e0) returned 1
	[0102.078] CloseHandle (hObject=0x1e0) returned 1
	[0102.080] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.080] SetEndOfFile (hFile=0x1d4) returned 1
	[0102.082] CloseHandle (hObject=0x1d4) returned 1
	[0102.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 1
	[0102.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0102.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0102.087] lstrlenW (lpString=".doc") returned 4
	[0102.087] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.087] lstrlenW (lpString=".docx") returned 5
	[0102.088] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.088] lstrlenW (lpString=".pdf") returned 4
	[0102.088] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.088] lstrlenW (lpString=".xls") returned 4
	[0102.088] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.088] lstrlenW (lpString=".xlsx") returned 5
	[0102.088] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.088] lstrlenW (lpString=".ppt") returned 4
	[0102.088] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0102.088] lstrlenW (lpString=".zip") returned 4
	[0102.088] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.088] lstrlenW (lpString=".rar") returned 4
	[0102.088] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.088] lstrlenW (lpString=".bz2") returned 4
	[0102.088] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.088] lstrlenW (lpString=".7z") returned 3
	[0102.088] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0102.088] lstrlenW (lpString=".dbf") returned 4
	[0102.088] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0102.088] lstrlenW (lpString=".1cd") returned 4
	[0102.088] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0102.088] lstrlenW (lpString=".jpg") returned 4
	[0102.088] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0102.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0102.089] lstrlenW (lpString=".doc") returned 4
	[0102.089] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.089] lstrlenW (lpString=".docx") returned 5
	[0102.089] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.089] lstrlenW (lpString=".pdf") returned 4
	[0102.089] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.089] lstrlenW (lpString=".xls") returned 4
	[0102.089] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.089] lstrlenW (lpString=".xlsx") returned 5
	[0102.089] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.089] lstrlenW (lpString=".ppt") returned 4
	[0102.089] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0102.089] lstrlenW (lpString=".zip") returned 4
	[0102.089] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.089] lstrlenW (lpString=".rar") returned 4
	[0102.089] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.089] lstrlenW (lpString=".bz2") returned 4
	[0102.089] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.089] lstrlenW (lpString=".7z") returned 3
	[0102.089] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0102.089] lstrlenW (lpString=".dbf") returned 4
	[0102.089] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0102.089] lstrlenW (lpString=".1cd") returned 4
	[0102.089] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0102.089] lstrlenW (lpString=".jpg") returned 4
	[0102.089] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.090] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.090] lstrlenW (lpString="JAVA_01.MID") returned 11
	[0102.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.101] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=9797) returned 1
	[0102.101] CloseHandle (hObject=0x1d4) returned 1
	[0102.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 0x20
	[0102.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.112] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.113] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.132] GetLastError () returned 0x0
	[0102.132] ReadFile (in: hFile=0x1d0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x2645, lpOverlapped=0x0) returned 1
	[0102.135] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2650, lpOverlapped=0x0) returned 1
	[0102.137] ReadFile (in: hFile=0x1d0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.137] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0102.137] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.141] CloseHandle (hObject=0x1a8) returned 1
	[0102.143] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.143] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.145] CloseHandle (hObject=0x1d0) returned 1
	[0102.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 1
	[0102.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0102.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0102.150] lstrlenW (lpString=".doc") returned 4
	[0102.151] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.151] lstrlenW (lpString=".docx") returned 5
	[0102.151] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.151] lstrlenW (lpString=".pdf") returned 4
	[0102.151] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.151] lstrlenW (lpString=".xls") returned 4
	[0102.151] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.151] lstrlenW (lpString=".xlsx") returned 5
	[0102.151] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.151] lstrlenW (lpString=".ppt") returned 4
	[0102.151] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0102.151] lstrlenW (lpString=".zip") returned 4
	[0102.151] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.151] lstrlenW (lpString=".rar") returned 4
	[0102.151] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.151] lstrlenW (lpString=".bz2") returned 4
	[0102.151] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.151] lstrlenW (lpString=".7z") returned 3
	[0102.151] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0102.151] lstrlenW (lpString=".dbf") returned 4
	[0102.151] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0102.151] lstrlenW (lpString=".1cd") returned 4
	[0102.151] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0102.151] lstrlenW (lpString=".jpg") returned 4
	[0102.152] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0102.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0102.152] lstrlenW (lpString=".doc") returned 4
	[0102.152] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.152] lstrlenW (lpString=".docx") returned 5
	[0102.152] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.152] lstrlenW (lpString=".pdf") returned 4
	[0102.152] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.152] lstrlenW (lpString=".xls") returned 4
	[0102.152] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.152] lstrlenW (lpString=".xlsx") returned 5
	[0102.152] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.152] lstrlenW (lpString=".ppt") returned 4
	[0102.152] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0102.152] lstrlenW (lpString=".zip") returned 4
	[0102.152] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.152] lstrlenW (lpString=".rar") returned 4
	[0102.152] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.152] lstrlenW (lpString=".bz2") returned 4
	[0102.152] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.152] lstrlenW (lpString=".7z") returned 3
	[0102.152] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0102.152] lstrlenW (lpString=".dbf") returned 4
	[0102.152] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0102.152] lstrlenW (lpString=".1cd") returned 4
	[0102.152] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0102.153] lstrlenW (lpString=".jpg") returned 4
	[0102.153] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.153] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.153] lstrlenW (lpString="MUSIC_01.MID") returned 12
	[0102.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.168] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=6880) returned 1
	[0102.168] CloseHandle (hObject=0x1d0) returned 1
	[0102.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 0x20
	[0102.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.183] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.184] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.199] GetLastError () returned 0x0
	[0102.199] ReadFile (in: hFile=0x1d4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1ae0, lpOverlapped=0x0) returned 1
	[0102.201] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1af0, lpOverlapped=0x0) returned 1
	[0102.203] ReadFile (in: hFile=0x1d4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.203] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.203] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.208] CloseHandle (hObject=0x1a8) returned 1
	[0102.210] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.210] SetEndOfFile (hFile=0x1d4) returned 1
	[0102.212] CloseHandle (hObject=0x1d4) returned 1
	[0102.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 1
	[0102.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0102.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0102.218] lstrlenW (lpString=".doc") returned 4
	[0102.218] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.218] lstrlenW (lpString=".docx") returned 5
	[0102.218] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.218] lstrlenW (lpString=".pdf") returned 4
	[0102.218] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.218] lstrlenW (lpString=".xls") returned 4
	[0102.218] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.218] lstrlenW (lpString=".xlsx") returned 5
	[0102.218] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.218] lstrlenW (lpString=".ppt") returned 4
	[0102.218] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0102.218] lstrlenW (lpString=".zip") returned 4
	[0102.218] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.218] lstrlenW (lpString=".rar") returned 4
	[0102.218] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.219] lstrlenW (lpString=".bz2") returned 4
	[0102.219] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.219] lstrlenW (lpString=".7z") returned 3
	[0102.219] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0102.219] lstrlenW (lpString=".dbf") returned 4
	[0102.219] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0102.219] lstrlenW (lpString=".1cd") returned 4
	[0102.219] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0102.219] lstrlenW (lpString=".jpg") returned 4
	[0102.219] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0102.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0102.219] lstrlenW (lpString=".doc") returned 4
	[0102.219] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.219] lstrlenW (lpString=".docx") returned 5
	[0102.219] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.219] lstrlenW (lpString=".pdf") returned 4
	[0102.219] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.219] lstrlenW (lpString=".xls") returned 4
	[0102.219] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.219] lstrlenW (lpString=".xlsx") returned 5
	[0102.219] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.219] lstrlenW (lpString=".ppt") returned 4
	[0102.220] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0102.220] lstrlenW (lpString=".zip") returned 4
	[0102.220] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.220] lstrlenW (lpString=".rar") returned 4
	[0102.220] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.220] lstrlenW (lpString=".bz2") returned 4
	[0102.220] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.220] lstrlenW (lpString=".7z") returned 3
	[0102.220] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0102.220] lstrlenW (lpString=".dbf") returned 4
	[0102.220] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0102.220] lstrlenW (lpString=".1cd") returned 4
	[0102.220] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0102.220] lstrlenW (lpString=".jpg") returned 4
	[0102.220] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.220] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.220] lstrlenW (lpString="OCEAN_01.MID") returned 12
	[0102.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.232] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=5440) returned 1
	[0102.232] CloseHandle (hObject=0x1d0) returned 1
	[0102.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 0x20
	[0102.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.250] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.250] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.271] GetLastError () returned 0x0
	[0102.271] ReadFile (in: hFile=0x1d0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1540, lpOverlapped=0x0) returned 1
	[0102.274] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1550, lpOverlapped=0x0) returned 1
	[0102.276] ReadFile (in: hFile=0x1d0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.276] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.276] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.279] CloseHandle (hObject=0x1d8) returned 1
	[0102.282] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.282] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.284] CloseHandle (hObject=0x1d0) returned 1
	[0102.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 1
	[0102.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0102.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0102.289] lstrlenW (lpString=".doc") returned 4
	[0102.289] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.289] lstrlenW (lpString=".docx") returned 5
	[0102.290] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.290] lstrlenW (lpString=".pdf") returned 4
	[0102.290] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.290] lstrlenW (lpString=".xls") returned 4
	[0102.290] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.290] lstrlenW (lpString=".xlsx") returned 5
	[0102.290] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.290] lstrlenW (lpString=".ppt") returned 4
	[0102.290] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0102.290] lstrlenW (lpString=".zip") returned 4
	[0102.290] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.290] lstrlenW (lpString=".rar") returned 4
	[0102.290] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.290] lstrlenW (lpString=".bz2") returned 4
	[0102.290] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.290] lstrlenW (lpString=".7z") returned 3
	[0102.290] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0102.290] lstrlenW (lpString=".dbf") returned 4
	[0102.290] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0102.290] lstrlenW (lpString=".1cd") returned 4
	[0102.290] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0102.290] lstrlenW (lpString=".jpg") returned 4
	[0102.291] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0102.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0102.291] lstrlenW (lpString=".doc") returned 4
	[0102.291] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.291] lstrlenW (lpString=".docx") returned 5
	[0102.291] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.291] lstrlenW (lpString=".pdf") returned 4
	[0102.291] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.291] lstrlenW (lpString=".xls") returned 4
	[0102.291] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.291] lstrlenW (lpString=".xlsx") returned 5
	[0102.291] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.291] lstrlenW (lpString=".ppt") returned 4
	[0102.291] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0102.291] lstrlenW (lpString=".zip") returned 4
	[0102.291] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.291] lstrlenW (lpString=".rar") returned 4
	[0102.291] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.291] lstrlenW (lpString=".bz2") returned 4
	[0102.291] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.291] lstrlenW (lpString=".7z") returned 3
	[0102.291] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0102.292] lstrlenW (lpString=".dbf") returned 4
	[0102.292] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0102.292] lstrlenW (lpString=".1cd") returned 4
	[0102.292] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0102.292] lstrlenW (lpString=".jpg") returned 4
	[0102.292] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.292] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.292] lstrlenW (lpString="PAPER_01.MID") returned 12
	[0102.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.304] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=6763) returned 1
	[0102.304] CloseHandle (hObject=0x1d0) returned 1
	[0102.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 0x20
	[0102.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.319] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.320] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.335] GetLastError () returned 0x0
	[0102.335] ReadFile (in: hFile=0x1d4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1a6b, lpOverlapped=0x0) returned 1
	[0102.337] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1a70, lpOverlapped=0x0) returned 1
	[0102.339] ReadFile (in: hFile=0x1d4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.339] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.339] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.343] CloseHandle (hObject=0x1a8) returned 1
	[0102.344] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.344] SetEndOfFile (hFile=0x1d4) returned 1
	[0102.346] CloseHandle (hObject=0x1d4) returned 1
	[0102.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 1
	[0102.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0102.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0102.352] lstrlenW (lpString=".doc") returned 4
	[0102.352] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.352] lstrlenW (lpString=".docx") returned 5
	[0102.352] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.352] lstrlenW (lpString=".pdf") returned 4
	[0102.352] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.352] lstrlenW (lpString=".xls") returned 4
	[0102.352] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.352] lstrlenW (lpString=".xlsx") returned 5
	[0102.352] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.352] lstrlenW (lpString=".ppt") returned 4
	[0102.352] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0102.352] lstrlenW (lpString=".zip") returned 4
	[0102.352] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.352] lstrlenW (lpString=".rar") returned 4
	[0102.352] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.352] lstrlenW (lpString=".bz2") returned 4
	[0102.352] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.352] lstrlenW (lpString=".7z") returned 3
	[0102.352] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0102.352] lstrlenW (lpString=".dbf") returned 4
	[0102.352] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0102.353] lstrlenW (lpString=".1cd") returned 4
	[0102.353] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0102.353] lstrlenW (lpString=".jpg") returned 4
	[0102.353] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0102.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0102.353] lstrlenW (lpString=".doc") returned 4
	[0102.353] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.353] lstrlenW (lpString=".docx") returned 5
	[0102.353] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.353] lstrlenW (lpString=".pdf") returned 4
	[0102.353] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.353] lstrlenW (lpString=".xls") returned 4
	[0102.353] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.353] lstrlenW (lpString=".xlsx") returned 5
	[0102.353] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.353] lstrlenW (lpString=".ppt") returned 4
	[0102.353] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0102.353] lstrlenW (lpString=".zip") returned 4
	[0102.353] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.353] lstrlenW (lpString=".rar") returned 4
	[0102.353] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.353] lstrlenW (lpString=".bz2") returned 4
	[0102.353] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.354] lstrlenW (lpString=".7z") returned 3
	[0102.354] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0102.354] lstrlenW (lpString=".dbf") returned 4
	[0102.354] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0102.354] lstrlenW (lpString=".1cd") returned 4
	[0102.354] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0102.354] lstrlenW (lpString=".jpg") returned 4
	[0102.354] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.354] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.354] lstrlenW (lpString="PARNT_02.MID") returned 12
	[0102.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.366] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=5714) returned 1
	[0102.366] CloseHandle (hObject=0x1d4) returned 1
	[0102.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 0x20
	[0102.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.380] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.380] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.397] GetLastError () returned 0x0
	[0102.397] ReadFile (in: hFile=0x1d0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1652, lpOverlapped=0x0) returned 1
	[0102.401] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1660, lpOverlapped=0x0) returned 1
	[0102.402] ReadFile (in: hFile=0x1d0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.402] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.402] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.406] CloseHandle (hObject=0x1d8) returned 1
	[0102.407] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.407] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.410] CloseHandle (hObject=0x1d0) returned 1
	[0102.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 1
	[0102.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0102.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0102.416] lstrlenW (lpString=".doc") returned 4
	[0102.416] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.416] lstrlenW (lpString=".docx") returned 5
	[0102.416] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0102.416] lstrlenW (lpString=".pdf") returned 4
	[0102.416] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.416] lstrlenW (lpString=".xls") returned 4
	[0102.416] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.417] lstrlenW (lpString=".xlsx") returned 5
	[0102.417] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0102.417] lstrlenW (lpString=".ppt") returned 4
	[0102.417] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0102.417] lstrlenW (lpString=".zip") returned 4
	[0102.417] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.417] lstrlenW (lpString=".rar") returned 4
	[0102.417] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.417] lstrlenW (lpString=".bz2") returned 4
	[0102.417] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.417] lstrlenW (lpString=".7z") returned 3
	[0102.417] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0102.417] lstrlenW (lpString=".dbf") returned 4
	[0102.417] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0102.417] lstrlenW (lpString=".1cd") returned 4
	[0102.417] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0102.417] lstrlenW (lpString=".jpg") returned 4
	[0102.417] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0102.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0102.418] lstrlenW (lpString=".doc") returned 4
	[0102.418] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.418] lstrlenW (lpString=".docx") returned 5
	[0102.418] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0102.418] lstrlenW (lpString=".pdf") returned 4
	[0102.418] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.418] lstrlenW (lpString=".xls") returned 4
	[0102.418] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.418] lstrlenW (lpString=".xlsx") returned 5
	[0102.418] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0102.418] lstrlenW (lpString=".ppt") returned 4
	[0102.418] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0102.418] lstrlenW (lpString=".zip") returned 4
	[0102.418] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.418] lstrlenW (lpString=".rar") returned 4
	[0102.418] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.418] lstrlenW (lpString=".bz2") returned 4
	[0102.418] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.418] lstrlenW (lpString=".7z") returned 3
	[0102.418] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0102.418] lstrlenW (lpString=".dbf") returned 4
	[0102.418] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0102.418] lstrlenW (lpString=".1cd") returned 4
	[0102.418] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0102.419] lstrlenW (lpString=".jpg") returned 4
	[0102.419] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.419] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.419] lstrlenW (lpString="PARNT_04.MID") returned 12
	[0102.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.430] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=6070) returned 1
	[0102.430] CloseHandle (hObject=0x1d8) returned 1
	[0102.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 0x20
	[0102.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.452] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.453] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0102.469] GetLastError () returned 0x0
	[0102.469] ReadFile (in: hFile=0x1d4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x17b6, lpOverlapped=0x0) returned 1
	[0102.471] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x17c0, lpOverlapped=0x0) returned 1
	[0102.473] ReadFile (in: hFile=0x1d4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.473] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.473] SetEndOfFile (hFile=0x1dc) returned 1
	[0102.478] CloseHandle (hObject=0x1dc) returned 1
	[0102.479] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.479] SetEndOfFile (hFile=0x1d4) returned 1
	[0102.482] CloseHandle (hObject=0x1d4) returned 1
	[0102.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 1
	[0102.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0102.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0102.493] lstrlenW (lpString=".doc") returned 4
	[0102.493] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.493] lstrlenW (lpString=".docx") returned 5
	[0102.493] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1
	[0102.493] lstrlenW (lpString=".pdf") returned 4
	[0102.493] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.493] lstrlenW (lpString=".xls") returned 4
	[0102.493] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.493] lstrlenW (lpString=".xlsx") returned 5
	[0102.493] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1
	[0102.493] lstrlenW (lpString=".ppt") returned 4
	[0102.493] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0102.493] lstrlenW (lpString=".zip") returned 4
	[0102.493] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.494] lstrlenW (lpString=".rar") returned 4
	[0102.494] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.494] lstrlenW (lpString=".bz2") returned 4
	[0102.494] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.494] lstrlenW (lpString=".7z") returned 3
	[0102.494] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0102.494] lstrlenW (lpString=".dbf") returned 4
	[0102.494] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0102.494] lstrlenW (lpString=".1cd") returned 4
	[0102.494] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0102.494] lstrlenW (lpString=".jpg") returned 4
	[0102.494] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0102.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0102.494] lstrlenW (lpString=".doc") returned 4
	[0102.494] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.494] lstrlenW (lpString=".docx") returned 5
	[0102.494] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1
	[0102.494] lstrlenW (lpString=".pdf") returned 4
	[0102.495] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.495] lstrlenW (lpString=".xls") returned 4
	[0102.495] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.495] lstrlenW (lpString=".xlsx") returned 5
	[0102.495] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1
	[0102.495] lstrlenW (lpString=".ppt") returned 4
	[0102.495] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0102.495] lstrlenW (lpString=".zip") returned 4
	[0102.495] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.495] lstrlenW (lpString=".rar") returned 4
	[0102.495] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.495] lstrlenW (lpString=".bz2") returned 4
	[0102.495] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.495] lstrlenW (lpString=".7z") returned 3
	[0102.495] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0102.495] lstrlenW (lpString=".dbf") returned 4
	[0102.495] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0102.496] lstrlenW (lpString=".1cd") returned 4
	[0102.496] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0102.496] lstrlenW (lpString=".jpg") returned 4
	[0102.496] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.496] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.496] lstrlenW (lpString="PARNT_06.MID") returned 12
	[0102.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.507] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=7768) returned 1
	[0102.507] CloseHandle (hObject=0x1a8) returned 1
	[0102.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20
	[0102.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0102.519] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.519] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.546] GetLastError () returned 0x0
	[0102.546] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1e58, lpOverlapped=0x0) returned 1
	[0102.549] WriteFile (in: hFile=0x1d0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1e60, lpOverlapped=0x0) returned 1
	[0102.550] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.550] WriteFile (in: hFile=0x1d0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.550] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.552] CloseHandle (hObject=0x1d0) returned 1
	[0102.556] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.556] SetEndOfFile (hFile=0x1bc) returned 1
	[0102.562] CloseHandle (hObject=0x1bc) returned 1
	[0102.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 1
	[0102.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0102.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0102.585] lstrlenW (lpString=".doc") returned 4
	[0102.585] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.587] lstrlenW (lpString=".docx") returned 5
	[0102.587] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1
	[0102.587] lstrlenW (lpString=".pdf") returned 4
	[0102.587] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.587] lstrlenW (lpString=".xls") returned 4
	[0102.587] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.587] lstrlenW (lpString=".xlsx") returned 5
	[0102.587] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1
	[0102.587] lstrlenW (lpString=".ppt") returned 4
	[0102.587] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0102.587] lstrlenW (lpString=".zip") returned 4
	[0102.587] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.587] lstrlenW (lpString=".rar") returned 4
	[0102.587] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.587] lstrlenW (lpString=".bz2") returned 4
	[0102.587] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.587] lstrlenW (lpString=".7z") returned 3
	[0102.587] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0102.587] lstrlenW (lpString=".dbf") returned 4
	[0102.588] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0102.588] lstrlenW (lpString=".1cd") returned 4
	[0102.588] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0102.588] lstrlenW (lpString=".jpg") returned 4
	[0102.588] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0102.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0102.588] lstrlenW (lpString=".doc") returned 4
	[0102.588] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.588] lstrlenW (lpString=".docx") returned 5
	[0102.588] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1
	[0102.588] lstrlenW (lpString=".pdf") returned 4
	[0102.588] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.588] lstrlenW (lpString=".xls") returned 4
	[0102.588] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.588] lstrlenW (lpString=".xlsx") returned 5
	[0102.588] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1
	[0102.588] lstrlenW (lpString=".ppt") returned 4
	[0102.588] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0102.588] lstrlenW (lpString=".zip") returned 4
	[0102.588] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.588] lstrlenW (lpString=".rar") returned 4
	[0102.589] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.589] lstrlenW (lpString=".bz2") returned 4
	[0102.589] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.589] lstrlenW (lpString=".7z") returned 3
	[0102.589] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0102.589] lstrlenW (lpString=".dbf") returned 4
	[0102.589] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0102.589] lstrlenW (lpString=".1cd") returned 4
	[0102.589] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0102.589] lstrlenW (lpString=".jpg") returned 4
	[0102.589] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.589] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.589] lstrlenW (lpString="PARNT_08.MID") returned 12
	[0102.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.601] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=7347) returned 1
	[0102.602] CloseHandle (hObject=0x184) returned 1
	[0102.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20
	[0102.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0102.618] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.618] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.633] GetLastError () returned 0x0
	[0102.633] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1cb3, lpOverlapped=0x0) returned 1
	[0102.639] WriteFile (in: hFile=0x1d0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1cc0, lpOverlapped=0x0) returned 1
	[0102.640] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.640] WriteFile (in: hFile=0x1d0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.640] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.644] CloseHandle (hObject=0x1d0) returned 1
	[0102.645] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.645] SetEndOfFile (hFile=0x1bc) returned 1
	[0102.647] CloseHandle (hObject=0x1bc) returned 1
	[0102.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 1
	[0102.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0102.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0102.654] lstrlenW (lpString=".doc") returned 4
	[0102.654] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.654] lstrlenW (lpString=".docx") returned 5
	[0102.654] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1
	[0102.654] lstrlenW (lpString=".pdf") returned 4
	[0102.654] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.654] lstrlenW (lpString=".xls") returned 4
	[0102.655] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.655] lstrlenW (lpString=".xlsx") returned 5
	[0102.655] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1
	[0102.655] lstrlenW (lpString=".ppt") returned 4
	[0102.655] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0102.655] lstrlenW (lpString=".zip") returned 4
	[0102.655] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.655] lstrlenW (lpString=".rar") returned 4
	[0102.655] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.655] lstrlenW (lpString=".bz2") returned 4
	[0102.655] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.655] lstrlenW (lpString=".7z") returned 3
	[0102.655] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0102.655] lstrlenW (lpString=".dbf") returned 4
	[0102.655] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0102.655] lstrlenW (lpString=".1cd") returned 4
	[0102.655] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0102.656] lstrlenW (lpString=".jpg") returned 4
	[0102.656] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0102.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0102.656] lstrlenW (lpString=".doc") returned 4
	[0102.656] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.656] lstrlenW (lpString=".docx") returned 5
	[0102.656] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1
	[0102.656] lstrlenW (lpString=".pdf") returned 4
	[0102.656] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.656] lstrlenW (lpString=".xls") returned 4
	[0102.656] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.656] lstrlenW (lpString=".xlsx") returned 5
	[0102.656] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1
	[0102.656] lstrlenW (lpString=".ppt") returned 4
	[0102.656] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0102.656] lstrlenW (lpString=".zip") returned 4
	[0102.656] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.656] lstrlenW (lpString=".rar") returned 4
	[0102.656] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.656] lstrlenW (lpString=".bz2") returned 4
	[0102.656] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.656] lstrlenW (lpString=".7z") returned 3
	[0102.656] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0102.657] lstrlenW (lpString=".dbf") returned 4
	[0102.657] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0102.657] lstrlenW (lpString=".1cd") returned 4
	[0102.657] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0102.657] lstrlenW (lpString=".jpg") returned 4
	[0102.657] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.657] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.657] lstrlenW (lpString="PARNT_10.MID") returned 12
	[0102.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.664] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=5393) returned 1
	[0102.664] CloseHandle (hObject=0x1a8) returned 1
	[0102.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20
	[0102.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.680] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.681] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.690] GetLastError () returned 0x0
	[0102.690] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1511, lpOverlapped=0x0) returned 1
	[0102.697] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1520, lpOverlapped=0x0) returned 1
	[0102.699] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.699] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.699] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.700] CloseHandle (hObject=0x1a8) returned 1
	[0102.701] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.701] SetEndOfFile (hFile=0x184) returned 1
	[0102.704] CloseHandle (hObject=0x184) returned 1
	[0102.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 1
	[0102.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0102.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0102.712] lstrlenW (lpString=".doc") returned 4
	[0102.712] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.712] lstrlenW (lpString=".docx") returned 5
	[0102.712] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1
	[0102.712] lstrlenW (lpString=".pdf") returned 4
	[0102.712] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.712] lstrlenW (lpString=".xls") returned 4
	[0102.712] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.712] lstrlenW (lpString=".xlsx") returned 5
	[0102.712] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1
	[0102.712] lstrlenW (lpString=".ppt") returned 4
	[0102.712] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0102.712] lstrlenW (lpString=".zip") returned 4
	[0102.712] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.712] lstrlenW (lpString=".rar") returned 4
	[0102.712] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.712] lstrlenW (lpString=".bz2") returned 4
	[0102.712] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.712] lstrlenW (lpString=".7z") returned 3
	[0102.712] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0102.713] lstrlenW (lpString=".dbf") returned 4
	[0102.713] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0102.713] lstrlenW (lpString=".1cd") returned 4
	[0102.713] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0102.713] lstrlenW (lpString=".jpg") returned 4
	[0102.713] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0102.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0102.713] lstrlenW (lpString=".doc") returned 4
	[0102.713] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.713] lstrlenW (lpString=".docx") returned 5
	[0102.713] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1
	[0102.713] lstrlenW (lpString=".pdf") returned 4
	[0102.713] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.713] lstrlenW (lpString=".xls") returned 4
	[0102.713] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.713] lstrlenW (lpString=".xlsx") returned 5
	[0102.713] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1
	[0102.713] lstrlenW (lpString=".ppt") returned 4
	[0102.713] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0102.713] lstrlenW (lpString=".zip") returned 4
	[0102.713] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.714] lstrlenW (lpString=".rar") returned 4
	[0102.714] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.714] lstrlenW (lpString=".bz2") returned 4
	[0102.714] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.714] lstrlenW (lpString=".7z") returned 3
	[0102.714] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0102.714] lstrlenW (lpString=".dbf") returned 4
	[0102.714] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0102.714] lstrlenW (lpString=".1cd") returned 4
	[0102.714] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0102.714] lstrlenW (lpString=".jpg") returned 4
	[0102.714] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.714] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.714] lstrlenW (lpString="SAFRI_01.MID") returned 12
	[0102.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.724] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=10122) returned 1
	[0102.724] CloseHandle (hObject=0x1d8) returned 1
	[0102.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 0x20
	[0102.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.744] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.744] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.754] GetLastError () returned 0x0
	[0102.754] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x278a, lpOverlapped=0x0) returned 1
	[0102.756] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2790, lpOverlapped=0x0) returned 1
	[0102.758] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.758] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.758] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.759] CloseHandle (hObject=0x1d8) returned 1
	[0102.759] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.760] SetEndOfFile (hFile=0x184) returned 1
	[0102.764] CloseHandle (hObject=0x184) returned 1
	[0102.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 1
	[0102.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0102.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0102.771] lstrlenW (lpString=".doc") returned 4
	[0102.771] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.771] lstrlenW (lpString=".docx") returned 5
	[0102.771] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.771] lstrlenW (lpString=".pdf") returned 4
	[0102.771] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.771] lstrlenW (lpString=".xls") returned 4
	[0102.771] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.771] lstrlenW (lpString=".xlsx") returned 5
	[0102.771] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.771] lstrlenW (lpString=".ppt") returned 4
	[0102.771] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0102.771] lstrlenW (lpString=".zip") returned 4
	[0102.771] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.771] lstrlenW (lpString=".rar") returned 4
	[0102.771] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.772] lstrlenW (lpString=".bz2") returned 4
	[0102.772] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.772] lstrlenW (lpString=".7z") returned 3
	[0102.772] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0102.772] lstrlenW (lpString=".dbf") returned 4
	[0102.772] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0102.772] lstrlenW (lpString=".1cd") returned 4
	[0102.772] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0102.772] lstrlenW (lpString=".jpg") returned 4
	[0102.772] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0102.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0102.772] lstrlenW (lpString=".doc") returned 4
	[0102.772] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.772] lstrlenW (lpString=".docx") returned 5
	[0102.772] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.772] lstrlenW (lpString=".pdf") returned 4
	[0102.772] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.772] lstrlenW (lpString=".xls") returned 4
	[0102.772] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.772] lstrlenW (lpString=".xlsx") returned 5
	[0102.772] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.773] lstrlenW (lpString=".ppt") returned 4
	[0102.773] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0102.773] lstrlenW (lpString=".zip") returned 4
	[0102.773] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.773] lstrlenW (lpString=".rar") returned 4
	[0102.773] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.773] lstrlenW (lpString=".bz2") returned 4
	[0102.773] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.773] lstrlenW (lpString=".7z") returned 3
	[0102.773] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0102.773] lstrlenW (lpString=".dbf") returned 4
	[0102.773] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0102.773] lstrlenW (lpString=".1cd") returned 4
	[0102.773] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0102.773] lstrlenW (lpString=".jpg") returned 4
	[0102.773] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.773] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.774] lstrlenW (lpString="SHOW_01.MID") returned 11
	[0102.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0102.786] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=6392) returned 1
	[0102.787] CloseHandle (hObject=0x1bc) returned 1
	[0102.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 0x20
	[0102.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.806] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.806] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.818] GetLastError () returned 0x0
	[0102.818] ReadFile (in: hFile=0x1d4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x18f8, lpOverlapped=0x0) returned 1
	[0102.822] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1900, lpOverlapped=0x0) returned 1
	[0102.823] ReadFile (in: hFile=0x1d4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.823] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0102.823] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.824] CloseHandle (hObject=0x1d8) returned 1
	[0102.825] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.825] SetEndOfFile (hFile=0x1d4) returned 1
	[0102.827] CloseHandle (hObject=0x1d4) returned 1
	[0102.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 1
	[0102.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0102.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0102.833] lstrlenW (lpString=".doc") returned 4
	[0102.833] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.833] lstrlenW (lpString=".docx") returned 5
	[0102.833] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.833] lstrlenW (lpString=".pdf") returned 4
	[0102.833] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.833] lstrlenW (lpString=".xls") returned 4
	[0102.833] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.833] lstrlenW (lpString=".xlsx") returned 5
	[0102.833] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.833] lstrlenW (lpString=".ppt") returned 4
	[0102.834] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0102.834] lstrlenW (lpString=".zip") returned 4
	[0102.834] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.834] lstrlenW (lpString=".rar") returned 4
	[0102.834] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.834] lstrlenW (lpString=".bz2") returned 4
	[0102.834] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.834] lstrlenW (lpString=".7z") returned 3
	[0102.834] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0102.834] lstrlenW (lpString=".dbf") returned 4
	[0102.834] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0102.834] lstrlenW (lpString=".1cd") returned 4
	[0102.834] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0102.834] lstrlenW (lpString=".jpg") returned 4
	[0102.834] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0102.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0102.834] lstrlenW (lpString=".doc") returned 4
	[0102.834] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.834] lstrlenW (lpString=".docx") returned 5
	[0102.834] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.834] lstrlenW (lpString=".pdf") returned 4
	[0102.834] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.834] lstrlenW (lpString=".xls") returned 4
	[0102.834] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.834] lstrlenW (lpString=".xlsx") returned 5
	[0102.834] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.834] lstrlenW (lpString=".ppt") returned 4
	[0102.835] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0102.835] lstrlenW (lpString=".zip") returned 4
	[0102.835] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.835] lstrlenW (lpString=".rar") returned 4
	[0102.835] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.835] lstrlenW (lpString=".bz2") returned 4
	[0102.835] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.835] lstrlenW (lpString=".7z") returned 3
	[0102.835] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0102.835] lstrlenW (lpString=".dbf") returned 4
	[0102.835] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0102.835] lstrlenW (lpString=".1cd") returned 4
	[0102.835] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0102.835] lstrlenW (lpString=".jpg") returned 4
	[0102.835] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.835] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.835] lstrlenW (lpString="SPRNG_01.MID") returned 12
	[0102.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.846] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=6700) returned 1
	[0102.846] CloseHandle (hObject=0x1a8) returned 1
	[0102.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 0x20
	[0102.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.858] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.858] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.867] GetLastError () returned 0x0
	[0102.867] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1a2c, lpOverlapped=0x0) returned 1
	[0102.874] WriteFile (in: hFile=0x184, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1a30, lpOverlapped=0x0) returned 1
	[0102.875] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.875] WriteFile (in: hFile=0x184, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.875] SetEndOfFile (hFile=0x184) returned 1
	[0102.876] CloseHandle (hObject=0x184) returned 1
	[0102.876] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.876] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.880] CloseHandle (hObject=0x1a8) returned 1
	[0102.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 1
	[0102.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0102.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0102.888] lstrlenW (lpString=".doc") returned 4
	[0102.888] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.888] lstrlenW (lpString=".docx") returned 5
	[0102.888] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.888] lstrlenW (lpString=".pdf") returned 4
	[0102.888] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.888] lstrlenW (lpString=".xls") returned 4
	[0102.888] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.888] lstrlenW (lpString=".xlsx") returned 5
	[0102.888] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.888] lstrlenW (lpString=".ppt") returned 4
	[0102.888] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0102.889] lstrlenW (lpString=".zip") returned 4
	[0102.889] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.889] lstrlenW (lpString=".rar") returned 4
	[0102.889] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.889] lstrlenW (lpString=".bz2") returned 4
	[0102.889] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.889] lstrlenW (lpString=".7z") returned 3
	[0102.889] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0102.889] lstrlenW (lpString=".dbf") returned 4
	[0102.889] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0102.889] lstrlenW (lpString=".1cd") returned 4
	[0102.889] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0102.889] lstrlenW (lpString=".jpg") returned 4
	[0102.889] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0102.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0102.889] lstrlenW (lpString=".doc") returned 4
	[0102.889] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.889] lstrlenW (lpString=".docx") returned 5
	[0102.889] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.889] lstrlenW (lpString=".pdf") returned 4
	[0102.889] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.889] lstrlenW (lpString=".xls") returned 4
	[0102.890] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.890] lstrlenW (lpString=".xlsx") returned 5
	[0102.890] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.890] lstrlenW (lpString=".ppt") returned 4
	[0102.890] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0102.890] lstrlenW (lpString=".zip") returned 4
	[0102.890] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.890] lstrlenW (lpString=".rar") returned 4
	[0102.890] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.890] lstrlenW (lpString=".bz2") returned 4
	[0102.890] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.890] lstrlenW (lpString=".7z") returned 3
	[0102.890] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0102.890] lstrlenW (lpString=".dbf") returned 4
	[0102.890] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0102.890] lstrlenW (lpString=".1cd") returned 4
	[0102.890] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0102.890] lstrlenW (lpString=".jpg") returned 4
	[0102.890] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.890] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.890] lstrlenW (lpString="SWEST_01.MID") returned 12
	[0102.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.916] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=8501) returned 1
	[0102.916] CloseHandle (hObject=0x184) returned 1
	[0102.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 0x20
	[0102.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.931] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.931] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.942] GetLastError () returned 0x0
	[0102.942] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x2135, lpOverlapped=0x0) returned 1
	[0102.944] WriteFile (in: hFile=0x184, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2140, lpOverlapped=0x0) returned 1
	[0102.945] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.946] WriteFile (in: hFile=0x184, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.946] SetEndOfFile (hFile=0x184) returned 1
	[0102.947] CloseHandle (hObject=0x184) returned 1
	[0102.948] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.948] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.952] CloseHandle (hObject=0x1a8) returned 1
	[0102.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 1
	[0102.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0102.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0102.960] lstrlenW (lpString=".doc") returned 4
	[0102.960] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.960] lstrlenW (lpString=".docx") returned 5
	[0102.960] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.960] lstrlenW (lpString=".pdf") returned 4
	[0102.960] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.960] lstrlenW (lpString=".xls") returned 4
	[0102.960] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.960] lstrlenW (lpString=".xlsx") returned 5
	[0102.960] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.960] lstrlenW (lpString=".ppt") returned 4
	[0102.960] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0102.960] lstrlenW (lpString=".zip") returned 4
	[0102.960] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.960] lstrlenW (lpString=".rar") returned 4
	[0102.960] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.960] lstrlenW (lpString=".bz2") returned 4
	[0102.960] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.960] lstrlenW (lpString=".7z") returned 3
	[0102.960] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0102.960] lstrlenW (lpString=".dbf") returned 4
	[0102.960] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0102.960] lstrlenW (lpString=".1cd") returned 4
	[0102.960] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0102.961] lstrlenW (lpString=".jpg") returned 4
	[0102.961] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0102.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0102.961] lstrlenW (lpString=".doc") returned 4
	[0102.961] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.961] lstrlenW (lpString=".docx") returned 5
	[0102.961] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.961] lstrlenW (lpString=".pdf") returned 4
	[0102.961] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.961] lstrlenW (lpString=".xls") returned 4
	[0102.961] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.961] lstrlenW (lpString=".xlsx") returned 5
	[0102.961] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.961] lstrlenW (lpString=".ppt") returned 4
	[0102.961] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0102.961] lstrlenW (lpString=".zip") returned 4
	[0102.961] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.961] lstrlenW (lpString=".rar") returned 4
	[0102.961] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.961] lstrlenW (lpString=".bz2") returned 4
	[0102.961] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.961] lstrlenW (lpString=".7z") returned 3
	[0102.961] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0102.962] lstrlenW (lpString=".dbf") returned 4
	[0102.962] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0102.962] lstrlenW (lpString=".1cd") returned 4
	[0102.962] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0102.962] lstrlenW (lpString=".jpg") returned 4
	[0102.962] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.962] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.962] lstrlenW (lpString="VCTRN_01.MID") returned 12
	[0102.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.978] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=4961) returned 1
	[0102.979] CloseHandle (hObject=0x1d4) returned 1
	[0102.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x20
	[0102.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.995] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.995] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.005] GetLastError () returned 0x0
	[0103.005] ReadFile (in: hFile=0x1d4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1361, lpOverlapped=0x0) returned 1
	[0103.007] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1370, lpOverlapped=0x0) returned 1
	[0103.008] ReadFile (in: hFile=0x1d4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.008] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.008] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.010] CloseHandle (hObject=0x1a8) returned 1
	[0103.011] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.011] SetEndOfFile (hFile=0x1d4) returned 1
	[0103.015] CloseHandle (hObject=0x1d4) returned 1
	[0103.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 1
	[0103.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0103.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0103.018] lstrlenW (lpString=".doc") returned 4
	[0103.018] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0103.018] lstrlenW (lpString=".docx") returned 5
	[0103.018] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0103.018] lstrlenW (lpString=".pdf") returned 4
	[0103.018] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0103.018] lstrlenW (lpString=".xls") returned 4
	[0103.018] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0103.018] lstrlenW (lpString=".xlsx") returned 5
	[0103.019] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0103.019] lstrlenW (lpString=".ppt") returned 4
	[0103.019] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0103.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0103.019] lstrlenW (lpString=".zip") returned 4
	[0103.019] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0103.019] lstrlenW (lpString=".rar") returned 4
	[0103.019] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0103.019] lstrlenW (lpString=".bz2") returned 4
	[0103.019] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0103.019] lstrlenW (lpString=".7z") returned 3
	[0103.019] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0103.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0103.019] lstrlenW (lpString=".dbf") returned 4
	[0103.019] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0103.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0103.019] lstrlenW (lpString=".1cd") returned 4
	[0103.019] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0103.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0103.019] lstrlenW (lpString=".jpg") returned 4
	[0103.019] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0103.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0103.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0103.019] lstrlenW (lpString=".doc") returned 4
	[0103.019] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0103.020] lstrlenW (lpString=".docx") returned 5
	[0103.020] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0103.020] lstrlenW (lpString=".pdf") returned 4
	[0103.020] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0103.020] lstrlenW (lpString=".xls") returned 4
	[0103.020] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0103.020] lstrlenW (lpString=".xlsx") returned 5
	[0103.020] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0103.020] lstrlenW (lpString=".ppt") returned 4
	[0103.020] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0103.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0103.020] lstrlenW (lpString=".zip") returned 4
	[0103.020] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0103.020] lstrlenW (lpString=".rar") returned 4
	[0103.020] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0103.020] lstrlenW (lpString=".bz2") returned 4
	[0103.020] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0103.020] lstrlenW (lpString=".7z") returned 3
	[0103.020] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0103.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0103.020] lstrlenW (lpString=".dbf") returned 4
	[0103.020] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0103.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0103.020] lstrlenW (lpString=".1cd") returned 4
	[0103.020] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0103.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0103.020] lstrlenW (lpString=".jpg") returned 4
	[0103.021] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0103.021] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.021] lstrlenW (lpString="Adjacency.eftx") returned 14
	[0103.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0103.027] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=21089) returned 1
	[0103.027] CloseHandle (hObject=0x1c4) returned 1
	[0103.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 0x20
	[0103.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0103.032] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.032] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0103.033] GetLastError () returned 0x0
	[0103.033] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x5261, lpOverlapped=0x0) returned 1
	[0103.036] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5270, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x5270, lpOverlapped=0x0) returned 1
	[0103.038] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.038] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0103.038] SetEndOfFile (hFile=0x1dc) returned 1
	[0103.038] CloseHandle (hObject=0x1dc) returned 1
	[0103.038] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.038] SetEndOfFile (hFile=0x1c4) returned 1
	[0103.039] CloseHandle (hObject=0x1c4) returned 1
	[0103.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 1
	[0103.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0103.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0103.040] lstrlenW (lpString=".doc") returned 4
	[0103.040] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.040] lstrlenW (lpString=".docx") returned 5
	[0103.040] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.040] lstrlenW (lpString=".pdf") returned 4
	[0103.040] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.040] lstrlenW (lpString=".xls") returned 4
	[0103.040] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.040] lstrlenW (lpString=".xlsx") returned 5
	[0103.040] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.040] lstrlenW (lpString=".ppt") returned 4
	[0103.040] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0103.040] lstrlenW (lpString=".zip") returned 4
	[0103.040] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.040] lstrlenW (lpString=".rar") returned 4
	[0103.040] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.040] lstrlenW (lpString=".bz2") returned 4
	[0103.041] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.041] lstrlenW (lpString=".7z") returned 3
	[0103.041] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0103.041] lstrlenW (lpString=".dbf") returned 4
	[0103.041] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0103.041] lstrlenW (lpString=".1cd") returned 4
	[0103.041] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0103.041] lstrlenW (lpString=".jpg") returned 4
	[0103.041] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0103.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0103.041] lstrlenW (lpString=".doc") returned 4
	[0103.041] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.041] lstrlenW (lpString=".docx") returned 5
	[0103.041] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.041] lstrlenW (lpString=".pdf") returned 4
	[0103.041] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.041] lstrlenW (lpString=".xls") returned 4
	[0103.041] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.041] lstrlenW (lpString=".xlsx") returned 5
	[0103.041] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.041] lstrlenW (lpString=".ppt") returned 4
	[0103.041] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0103.042] lstrlenW (lpString=".zip") returned 4
	[0103.042] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.042] lstrlenW (lpString=".rar") returned 4
	[0103.042] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.042] lstrlenW (lpString=".bz2") returned 4
	[0103.042] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.042] lstrlenW (lpString=".7z") returned 3
	[0103.042] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0103.042] lstrlenW (lpString=".dbf") returned 4
	[0103.042] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0103.042] lstrlenW (lpString=".1cd") returned 4
	[0103.042] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0103.042] lstrlenW (lpString=".jpg") returned 4
	[0103.042] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.042] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.042] lstrlenW (lpString="Angles.eftx") returned 11
	[0103.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0103.044] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=27365) returned 1
	[0103.044] CloseHandle (hObject=0x1dc) returned 1
	[0103.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 0x20
	[0103.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0103.045] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.045] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0103.046] GetLastError () returned 0x0
	[0103.046] ReadFile (in: hFile=0x1dc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x6ae5, lpOverlapped=0x0) returned 1
	[0103.052] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6af0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x6af0, lpOverlapped=0x0) returned 1
	[0103.054] ReadFile (in: hFile=0x1dc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.054] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0103.054] SetEndOfFile (hFile=0x1e0) returned 1
	[0103.054] CloseHandle (hObject=0x1e0) returned 1
	[0103.054] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.054] SetEndOfFile (hFile=0x1dc) returned 1
	[0103.056] CloseHandle (hObject=0x1dc) returned 1
	[0103.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 1
	[0103.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0103.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0103.056] lstrlenW (lpString=".doc") returned 4
	[0103.056] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.056] lstrlenW (lpString=".docx") returned 5
	[0103.056] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.056] lstrlenW (lpString=".pdf") returned 4
	[0103.056] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.056] lstrlenW (lpString=".xls") returned 4
	[0103.056] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.057] lstrlenW (lpString=".xlsx") returned 5
	[0103.057] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.057] lstrlenW (lpString=".ppt") returned 4
	[0103.057] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0103.057] lstrlenW (lpString=".zip") returned 4
	[0103.057] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.057] lstrlenW (lpString=".rar") returned 4
	[0103.057] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.057] lstrlenW (lpString=".bz2") returned 4
	[0103.057] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.057] lstrlenW (lpString=".7z") returned 3
	[0103.057] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0103.057] lstrlenW (lpString=".dbf") returned 4
	[0103.057] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0103.057] lstrlenW (lpString=".1cd") returned 4
	[0103.057] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0103.057] lstrlenW (lpString=".jpg") returned 4
	[0103.057] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0103.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0103.057] lstrlenW (lpString=".doc") returned 4
	[0103.058] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.058] lstrlenW (lpString=".docx") returned 5
	[0103.058] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.058] lstrlenW (lpString=".pdf") returned 4
	[0103.058] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.058] lstrlenW (lpString=".xls") returned 4
	[0103.058] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.058] lstrlenW (lpString=".xlsx") returned 5
	[0103.058] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.058] lstrlenW (lpString=".ppt") returned 4
	[0103.058] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0103.058] lstrlenW (lpString=".zip") returned 4
	[0103.058] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.058] lstrlenW (lpString=".rar") returned 4
	[0103.058] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.058] lstrlenW (lpString=".bz2") returned 4
	[0103.058] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.058] lstrlenW (lpString=".7z") returned 3
	[0103.058] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0103.058] lstrlenW (lpString=".dbf") returned 4
	[0103.058] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0103.058] lstrlenW (lpString=".1cd") returned 4
	[0103.058] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0103.058] lstrlenW (lpString=".jpg") returned 4
	[0103.059] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.059] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.059] lstrlenW (lpString="Apex.eftx") returned 9
	[0103.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0103.064] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=218310) returned 1
	[0103.064] CloseHandle (hObject=0x1dc) returned 1
	[0103.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 0x20
	[0103.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0103.065] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.065] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0103.066] GetLastError () returned 0x0
	[0103.066] ReadFile (in: hFile=0x1dc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x354c6, lpOverlapped=0x0) returned 1
	[0103.073] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x354d0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x354d0, lpOverlapped=0x0) returned 1
	[0103.079] ReadFile (in: hFile=0x1dc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.079] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0103.079] SetEndOfFile (hFile=0x1e0) returned 1
	[0103.079] CloseHandle (hObject=0x1e0) returned 1
	[0103.079] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.079] SetEndOfFile (hFile=0x1dc) returned 1
	[0103.082] CloseHandle (hObject=0x1dc) returned 1
	[0103.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 1
	[0103.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0103.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0103.083] lstrlenW (lpString=".doc") returned 4
	[0103.083] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.083] lstrlenW (lpString=".docx") returned 5
	[0103.083] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.083] lstrlenW (lpString=".pdf") returned 4
	[0103.083] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.083] lstrlenW (lpString=".xls") returned 4
	[0103.083] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.083] lstrlenW (lpString=".xlsx") returned 5
	[0103.083] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.083] lstrlenW (lpString=".ppt") returned 4
	[0103.083] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0103.084] lstrlenW (lpString=".zip") returned 4
	[0103.084] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.084] lstrlenW (lpString=".rar") returned 4
	[0103.084] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.084] lstrlenW (lpString=".bz2") returned 4
	[0103.084] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.084] lstrlenW (lpString=".7z") returned 3
	[0103.084] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0103.084] lstrlenW (lpString=".dbf") returned 4
	[0103.084] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0103.084] lstrlenW (lpString=".1cd") returned 4
	[0103.084] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0103.084] lstrlenW (lpString=".jpg") returned 4
	[0103.084] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0103.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0103.084] lstrlenW (lpString=".doc") returned 4
	[0103.085] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.085] lstrlenW (lpString=".docx") returned 5
	[0103.085] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.085] lstrlenW (lpString=".pdf") returned 4
	[0103.085] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.085] lstrlenW (lpString=".xls") returned 4
	[0103.085] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.085] lstrlenW (lpString=".xlsx") returned 5
	[0103.085] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.085] lstrlenW (lpString=".ppt") returned 4
	[0103.085] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0103.085] lstrlenW (lpString=".zip") returned 4
	[0103.085] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.085] lstrlenW (lpString=".rar") returned 4
	[0103.085] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.085] lstrlenW (lpString=".bz2") returned 4
	[0103.085] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.085] lstrlenW (lpString=".7z") returned 3
	[0103.085] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0103.085] lstrlenW (lpString=".dbf") returned 4
	[0103.085] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0103.085] lstrlenW (lpString=".1cd") returned 4
	[0103.085] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0103.086] lstrlenW (lpString=".jpg") returned 4
	[0103.086] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.086] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.086] lstrlenW (lpString="Apothecary.eftx") returned 15
	[0103.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0103.089] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=49025) returned 1
	[0103.089] CloseHandle (hObject=0x1dc) returned 1
	[0103.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 0x20
	[0103.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0103.089] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.089] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0103.090] GetLastError () returned 0x0
	[0103.090] ReadFile (in: hFile=0x1dc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xbf81, lpOverlapped=0x0) returned 1
	[0103.095] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xbf90, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xbf90, lpOverlapped=0x0) returned 1
	[0103.097] ReadFile (in: hFile=0x1dc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.097] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0103.098] SetEndOfFile (hFile=0x1e0) returned 1
	[0103.098] CloseHandle (hObject=0x1e0) returned 1
	[0103.098] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.098] SetEndOfFile (hFile=0x1dc) returned 1
	[0103.099] CloseHandle (hObject=0x1dc) returned 1
	[0103.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 1
	[0103.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0103.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0103.100] lstrlenW (lpString=".doc") returned 4
	[0103.100] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.100] lstrlenW (lpString=".docx") returned 5
	[0103.100] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.100] lstrlenW (lpString=".pdf") returned 4
	[0103.100] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.100] lstrlenW (lpString=".xls") returned 4
	[0103.100] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.100] lstrlenW (lpString=".xlsx") returned 5
	[0103.100] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.100] lstrlenW (lpString=".ppt") returned 4
	[0103.100] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0103.101] lstrlenW (lpString=".zip") returned 4
	[0103.101] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.101] lstrlenW (lpString=".rar") returned 4
	[0103.101] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.101] lstrlenW (lpString=".bz2") returned 4
	[0103.101] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.101] lstrlenW (lpString=".7z") returned 3
	[0103.101] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0103.101] lstrlenW (lpString=".dbf") returned 4
	[0103.101] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0103.101] lstrlenW (lpString=".1cd") returned 4
	[0103.101] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0103.101] lstrlenW (lpString=".jpg") returned 4
	[0103.101] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0103.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0103.101] lstrlenW (lpString=".doc") returned 4
	[0103.101] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.101] lstrlenW (lpString=".docx") returned 5
	[0103.101] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.101] lstrlenW (lpString=".pdf") returned 4
	[0103.102] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.102] lstrlenW (lpString=".xls") returned 4
	[0103.102] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.102] lstrlenW (lpString=".xlsx") returned 5
	[0103.102] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.102] lstrlenW (lpString=".ppt") returned 4
	[0103.102] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0103.102] lstrlenW (lpString=".zip") returned 4
	[0103.102] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.102] lstrlenW (lpString=".rar") returned 4
	[0103.102] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.102] lstrlenW (lpString=".bz2") returned 4
	[0103.102] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.102] lstrlenW (lpString=".7z") returned 3
	[0103.102] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0103.102] lstrlenW (lpString=".dbf") returned 4
	[0103.102] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0103.102] lstrlenW (lpString=".1cd") returned 4
	[0103.102] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0103.102] lstrlenW (lpString=".jpg") returned 4
	[0103.102] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.103] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.103] lstrlenW (lpString="Aspect.eftx") returned 11
	[0103.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0103.107] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=22554) returned 1
	[0103.107] CloseHandle (hObject=0x1bc) returned 1
	[0103.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 0x20
	[0103.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0103.108] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.108] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0103.109] GetLastError () returned 0x0
	[0103.109] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x581a, lpOverlapped=0x0) returned 1
	[0103.114] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5820, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x5820, lpOverlapped=0x0) returned 1
	[0103.116] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.116] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0103.116] SetEndOfFile (hFile=0x1dc) returned 1
	[0103.116] CloseHandle (hObject=0x1dc) returned 1
	[0103.116] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.116] SetEndOfFile (hFile=0x1bc) returned 1
	[0103.117] CloseHandle (hObject=0x1bc) returned 1
	[0103.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 1
	[0103.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0103.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0103.118] lstrlenW (lpString=".doc") returned 4
	[0103.118] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.118] lstrlenW (lpString=".docx") returned 5
	[0103.118] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.118] lstrlenW (lpString=".pdf") returned 4
	[0103.118] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.118] lstrlenW (lpString=".xls") returned 4
	[0103.118] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.118] lstrlenW (lpString=".xlsx") returned 5
	[0103.118] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.118] lstrlenW (lpString=".ppt") returned 4
	[0103.119] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0103.119] lstrlenW (lpString=".zip") returned 4
	[0103.119] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.119] lstrlenW (lpString=".rar") returned 4
	[0103.119] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.119] lstrlenW (lpString=".bz2") returned 4
	[0103.119] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.119] lstrlenW (lpString=".7z") returned 3
	[0103.119] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0103.119] lstrlenW (lpString=".dbf") returned 4
	[0103.119] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0103.119] lstrlenW (lpString=".1cd") returned 4
	[0103.119] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0103.119] lstrlenW (lpString=".jpg") returned 4
	[0103.119] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0103.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0103.119] lstrlenW (lpString=".doc") returned 4
	[0103.119] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.119] lstrlenW (lpString=".docx") returned 5
	[0103.119] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.119] lstrlenW (lpString=".pdf") returned 4
	[0103.120] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.120] lstrlenW (lpString=".xls") returned 4
	[0103.120] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.120] lstrlenW (lpString=".xlsx") returned 5
	[0103.120] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.120] lstrlenW (lpString=".ppt") returned 4
	[0103.120] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0103.120] lstrlenW (lpString=".zip") returned 4
	[0103.120] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.120] lstrlenW (lpString=".rar") returned 4
	[0103.120] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.120] lstrlenW (lpString=".bz2") returned 4
	[0103.120] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.120] lstrlenW (lpString=".7z") returned 3
	[0103.120] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0103.120] lstrlenW (lpString=".dbf") returned 4
	[0103.120] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0103.120] lstrlenW (lpString=".1cd") returned 4
	[0103.120] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0103.120] lstrlenW (lpString=".jpg") returned 4
	[0103.120] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.121] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.121] lstrlenW (lpString="Austin.eftx") returned 11
	[0103.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0103.123] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=26989) returned 1
	[0103.123] CloseHandle (hObject=0x1bc) returned 1
	[0103.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 0x20
	[0103.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0103.124] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.124] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0103.125] GetLastError () returned 0x0
	[0103.125] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x696d, lpOverlapped=0x0) returned 1
	[0103.128] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x6970, lpOverlapped=0x0) returned 1
	[0103.130] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.130] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0103.130] SetEndOfFile (hFile=0x1dc) returned 1
	[0103.130] CloseHandle (hObject=0x1dc) returned 1
	[0103.130] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.130] SetEndOfFile (hFile=0x1bc) returned 1
	[0103.131] CloseHandle (hObject=0x1bc) returned 1
	[0103.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 1
	[0103.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0103.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0103.132] lstrlenW (lpString=".doc") returned 4
	[0103.132] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.132] lstrlenW (lpString=".docx") returned 5
	[0103.132] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.132] lstrlenW (lpString=".pdf") returned 4
	[0103.132] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.132] lstrlenW (lpString=".xls") returned 4
	[0103.132] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.132] lstrlenW (lpString=".xlsx") returned 5
	[0103.132] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.132] lstrlenW (lpString=".ppt") returned 4
	[0103.132] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0103.133] lstrlenW (lpString=".zip") returned 4
	[0103.133] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.133] lstrlenW (lpString=".rar") returned 4
	[0103.133] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.133] lstrlenW (lpString=".bz2") returned 4
	[0103.133] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.133] lstrlenW (lpString=".7z") returned 3
	[0103.133] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0103.133] lstrlenW (lpString=".dbf") returned 4
	[0103.133] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0103.133] lstrlenW (lpString=".1cd") returned 4
	[0103.133] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0103.133] lstrlenW (lpString=".jpg") returned 4
	[0103.133] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0103.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0103.133] lstrlenW (lpString=".doc") returned 4
	[0103.133] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.133] lstrlenW (lpString=".docx") returned 5
	[0103.133] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.133] lstrlenW (lpString=".pdf") returned 4
	[0103.134] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.134] lstrlenW (lpString=".xls") returned 4
	[0103.134] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.134] lstrlenW (lpString=".xlsx") returned 5
	[0103.134] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.134] lstrlenW (lpString=".ppt") returned 4
	[0103.134] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0103.134] lstrlenW (lpString=".zip") returned 4
	[0103.134] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.134] lstrlenW (lpString=".rar") returned 4
	[0103.134] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.134] lstrlenW (lpString=".bz2") returned 4
	[0103.134] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.134] lstrlenW (lpString=".7z") returned 3
	[0103.134] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0103.134] lstrlenW (lpString=".dbf") returned 4
	[0103.134] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0103.134] lstrlenW (lpString=".1cd") returned 4
	[0103.134] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0103.134] lstrlenW (lpString=".jpg") returned 4
	[0103.134] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.135] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.135] lstrlenW (lpString="Black Tie.eftx") returned 14
	[0103.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.137] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=618119) returned 1
	[0103.137] CloseHandle (hObject=0x184) returned 1
	[0103.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 0x20
	[0103.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.137] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.138] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0103.138] GetLastError () returned 0x0
	[0103.138] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x96e87, lpOverlapped=0x0) returned 1
	[0103.160] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x96e90, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x96e90, lpOverlapped=0x0) returned 1
	[0103.177] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.177] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0103.177] SetEndOfFile (hFile=0x1bc) returned 1
	[0103.177] CloseHandle (hObject=0x1bc) returned 1
	[0103.177] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.177] SetEndOfFile (hFile=0x184) returned 1
	[0103.185] CloseHandle (hObject=0x184) returned 1
	[0103.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 1
	[0103.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0103.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0103.188] lstrlenW (lpString=".doc") returned 4
	[0103.188] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.188] lstrlenW (lpString=".docx") returned 5
	[0103.188] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.188] lstrlenW (lpString=".pdf") returned 4
	[0103.188] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.188] lstrlenW (lpString=".xls") returned 4
	[0103.188] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.188] lstrlenW (lpString=".xlsx") returned 5
	[0103.189] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.189] lstrlenW (lpString=".ppt") returned 4
	[0103.189] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0103.189] lstrlenW (lpString=".zip") returned 4
	[0103.189] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.189] lstrlenW (lpString=".rar") returned 4
	[0103.189] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.189] lstrlenW (lpString=".bz2") returned 4
	[0103.189] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.189] lstrlenW (lpString=".7z") returned 3
	[0103.189] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0103.189] lstrlenW (lpString=".dbf") returned 4
	[0103.189] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0103.189] lstrlenW (lpString=".1cd") returned 4
	[0103.189] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0103.189] lstrlenW (lpString=".jpg") returned 4
	[0103.189] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0103.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0103.189] lstrlenW (lpString=".doc") returned 4
	[0103.189] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.189] lstrlenW (lpString=".docx") returned 5
	[0103.190] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.190] lstrlenW (lpString=".pdf") returned 4
	[0103.190] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.190] lstrlenW (lpString=".xls") returned 4
	[0103.190] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.190] lstrlenW (lpString=".xlsx") returned 5
	[0103.190] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.190] lstrlenW (lpString=".ppt") returned 4
	[0103.190] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0103.190] lstrlenW (lpString=".zip") returned 4
	[0103.190] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.190] lstrlenW (lpString=".rar") returned 4
	[0103.190] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.190] lstrlenW (lpString=".bz2") returned 4
	[0103.190] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.190] lstrlenW (lpString=".7z") returned 3
	[0103.190] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0103.190] lstrlenW (lpString=".dbf") returned 4
	[0103.190] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0103.190] lstrlenW (lpString=".1cd") returned 4
	[0103.190] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0103.190] lstrlenW (lpString=".jpg") returned 4
	[0103.190] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.191] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.191] lstrlenW (lpString="Civic.eftx") returned 10
	[0103.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.193] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=42917) returned 1
	[0103.193] CloseHandle (hObject=0x1a8) returned 1
	[0103.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 0x20
	[0103.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.194] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.194] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0103.195] GetLastError () returned 0x0
	[0103.195] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xa7a5, lpOverlapped=0x0) returned 1
	[0103.198] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xa7b0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xa7b0, lpOverlapped=0x0) returned 1
	[0103.200] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.200] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0103.201] SetEndOfFile (hFile=0x1bc) returned 1
	[0103.201] CloseHandle (hObject=0x1bc) returned 1
	[0103.201] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.201] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.202] CloseHandle (hObject=0x1a8) returned 1
	[0103.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 1
	[0103.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0103.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0103.203] lstrlenW (lpString=".doc") returned 4
	[0103.203] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.203] lstrlenW (lpString=".docx") returned 5
	[0103.203] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.203] lstrlenW (lpString=".pdf") returned 4
	[0103.203] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.203] lstrlenW (lpString=".xls") returned 4
	[0103.203] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.203] lstrlenW (lpString=".xlsx") returned 5
	[0103.203] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.203] lstrlenW (lpString=".ppt") returned 4
	[0103.203] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0103.203] lstrlenW (lpString=".zip") returned 4
	[0103.203] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.203] lstrlenW (lpString=".rar") returned 4
	[0103.203] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.204] lstrlenW (lpString=".bz2") returned 4
	[0103.204] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.204] lstrlenW (lpString=".7z") returned 3
	[0103.204] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0103.204] lstrlenW (lpString=".dbf") returned 4
	[0103.204] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0103.204] lstrlenW (lpString=".1cd") returned 4
	[0103.204] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0103.204] lstrlenW (lpString=".jpg") returned 4
	[0103.204] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0103.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0103.204] lstrlenW (lpString=".doc") returned 4
	[0103.204] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.204] lstrlenW (lpString=".docx") returned 5
	[0103.204] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.204] lstrlenW (lpString=".pdf") returned 4
	[0103.204] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.204] lstrlenW (lpString=".xls") returned 4
	[0103.204] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.204] lstrlenW (lpString=".xlsx") returned 5
	[0103.204] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.204] lstrlenW (lpString=".ppt") returned 4
	[0103.205] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0103.205] lstrlenW (lpString=".zip") returned 4
	[0103.205] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.205] lstrlenW (lpString=".rar") returned 4
	[0103.205] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.205] lstrlenW (lpString=".bz2") returned 4
	[0103.205] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.205] lstrlenW (lpString=".7z") returned 3
	[0103.205] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0103.205] lstrlenW (lpString=".dbf") returned 4
	[0103.205] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0103.205] lstrlenW (lpString=".1cd") returned 4
	[0103.205] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0103.205] lstrlenW (lpString=".jpg") returned 4
	[0103.205] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.205] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.205] lstrlenW (lpString="Clarity.eftx") returned 12
	[0103.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.209] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=32818) returned 1
	[0103.209] CloseHandle (hObject=0x184) returned 1
	[0103.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 0x20
	[0103.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.209] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.209] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.210] GetLastError () returned 0x0
	[0103.210] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x8032, lpOverlapped=0x0) returned 1
	[0103.212] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x8040, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x8040, lpOverlapped=0x0) returned 1
	[0103.214] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.214] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.214] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.214] CloseHandle (hObject=0x1a8) returned 1
	[0103.214] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.214] SetEndOfFile (hFile=0x184) returned 1
	[0103.216] CloseHandle (hObject=0x184) returned 1
	[0103.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 1
	[0103.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0103.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0103.216] lstrlenW (lpString=".doc") returned 4
	[0103.216] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.216] lstrlenW (lpString=".docx") returned 5
	[0103.216] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.216] lstrlenW (lpString=".pdf") returned 4
	[0103.216] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.216] lstrlenW (lpString=".xls") returned 4
	[0103.216] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.216] lstrlenW (lpString=".xlsx") returned 5
	[0103.216] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.217] lstrlenW (lpString=".ppt") returned 4
	[0103.217] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0103.217] lstrlenW (lpString=".zip") returned 4
	[0103.217] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.217] lstrlenW (lpString=".rar") returned 4
	[0103.217] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.217] lstrlenW (lpString=".bz2") returned 4
	[0103.217] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.217] lstrlenW (lpString=".7z") returned 3
	[0103.217] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0103.217] lstrlenW (lpString=".dbf") returned 4
	[0103.217] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0103.217] lstrlenW (lpString=".1cd") returned 4
	[0103.217] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0103.217] lstrlenW (lpString=".jpg") returned 4
	[0103.217] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0103.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0103.217] lstrlenW (lpString=".doc") returned 4
	[0103.217] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.217] lstrlenW (lpString=".docx") returned 5
	[0103.217] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.217] lstrlenW (lpString=".pdf") returned 4
	[0103.217] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.217] lstrlenW (lpString=".xls") returned 4
	[0103.217] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.217] lstrlenW (lpString=".xlsx") returned 5
	[0103.217] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.217] lstrlenW (lpString=".ppt") returned 4
	[0103.218] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0103.218] lstrlenW (lpString=".zip") returned 4
	[0103.218] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.218] lstrlenW (lpString=".rar") returned 4
	[0103.218] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.218] lstrlenW (lpString=".bz2") returned 4
	[0103.218] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.218] lstrlenW (lpString=".7z") returned 3
	[0103.218] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0103.218] lstrlenW (lpString=".dbf") returned 4
	[0103.218] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0103.218] lstrlenW (lpString=".1cd") returned 4
	[0103.218] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0103.218] lstrlenW (lpString=".jpg") returned 4
	[0103.218] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.218] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.218] lstrlenW (lpString="Composite.eftx") returned 14
	[0103.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.223] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=533988) returned 1
	[0103.223] CloseHandle (hObject=0x184) returned 1
	[0103.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 0x20
	[0103.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.223] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.223] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.224] GetLastError () returned 0x0
	[0103.224] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x825e4, lpOverlapped=0x0) returned 1
	[0103.239] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x825f0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x825f0, lpOverlapped=0x0) returned 1
	[0103.251] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.251] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0103.252] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.252] CloseHandle (hObject=0x1a8) returned 1
	[0103.252] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.252] SetEndOfFile (hFile=0x184) returned 1
	[0103.258] CloseHandle (hObject=0x184) returned 1
	[0103.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 1
	[0103.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0103.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0103.259] lstrlenW (lpString=".doc") returned 4
	[0103.259] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.259] lstrlenW (lpString=".docx") returned 5
	[0103.259] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.259] lstrlenW (lpString=".pdf") returned 4
	[0103.259] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.259] lstrlenW (lpString=".xls") returned 4
	[0103.259] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.259] lstrlenW (lpString=".xlsx") returned 5
	[0103.259] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.259] lstrlenW (lpString=".ppt") returned 4
	[0103.259] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0103.259] lstrlenW (lpString=".zip") returned 4
	[0103.259] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.259] lstrlenW (lpString=".rar") returned 4
	[0103.259] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.259] lstrlenW (lpString=".bz2") returned 4
	[0103.259] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.259] lstrlenW (lpString=".7z") returned 3
	[0103.260] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0103.260] lstrlenW (lpString=".dbf") returned 4
	[0103.260] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0103.260] lstrlenW (lpString=".1cd") returned 4
	[0103.260] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0103.260] lstrlenW (lpString=".jpg") returned 4
	[0103.260] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0103.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0103.260] lstrlenW (lpString=".doc") returned 4
	[0103.260] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.260] lstrlenW (lpString=".docx") returned 5
	[0103.260] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.260] lstrlenW (lpString=".pdf") returned 4
	[0103.260] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.260] lstrlenW (lpString=".xls") returned 4
	[0103.260] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.260] lstrlenW (lpString=".xlsx") returned 5
	[0103.260] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.260] lstrlenW (lpString=".ppt") returned 4
	[0103.260] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0103.260] lstrlenW (lpString=".zip") returned 4
	[0103.260] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.260] lstrlenW (lpString=".rar") returned 4
	[0103.261] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.261] lstrlenW (lpString=".bz2") returned 4
	[0103.261] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.261] lstrlenW (lpString=".7z") returned 3
	[0103.261] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0103.261] lstrlenW (lpString=".dbf") returned 4
	[0103.261] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0103.261] lstrlenW (lpString=".1cd") returned 4
	[0103.261] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0103.261] lstrlenW (lpString=".jpg") returned 4
	[0103.261] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.261] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.261] lstrlenW (lpString="Concourse.eftx") returned 14
	[0103.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.264] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=22417) returned 1
	[0103.264] CloseHandle (hObject=0x1a8) returned 1
	[0103.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 0x20
	[0103.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.265] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.265] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.265] GetLastError () returned 0x0
	[0103.265] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x5791, lpOverlapped=0x0) returned 1
	[0103.268] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x57a0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x57a0, lpOverlapped=0x0) returned 1
	[0103.269] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.269] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0103.269] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.269] CloseHandle (hObject=0x1d8) returned 1
	[0103.269] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.269] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.270] CloseHandle (hObject=0x1a8) returned 1
	[0103.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 1
	[0103.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0103.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0103.271] lstrlenW (lpString=".doc") returned 4
	[0103.271] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.271] lstrlenW (lpString=".docx") returned 5
	[0103.271] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.271] lstrlenW (lpString=".pdf") returned 4
	[0103.271] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.271] lstrlenW (lpString=".xls") returned 4
	[0103.271] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.271] lstrlenW (lpString=".xlsx") returned 5
	[0103.271] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.271] lstrlenW (lpString=".ppt") returned 4
	[0103.271] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0103.271] lstrlenW (lpString=".zip") returned 4
	[0103.271] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.271] lstrlenW (lpString=".rar") returned 4
	[0103.271] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.271] lstrlenW (lpString=".bz2") returned 4
	[0103.271] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.272] lstrlenW (lpString=".7z") returned 3
	[0103.272] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0103.272] lstrlenW (lpString=".dbf") returned 4
	[0103.272] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0103.272] lstrlenW (lpString=".1cd") returned 4
	[0103.272] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0103.272] lstrlenW (lpString=".jpg") returned 4
	[0103.272] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0103.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0103.272] lstrlenW (lpString=".doc") returned 4
	[0103.272] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.272] lstrlenW (lpString=".docx") returned 5
	[0103.272] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.272] lstrlenW (lpString=".pdf") returned 4
	[0103.272] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.272] lstrlenW (lpString=".xls") returned 4
	[0103.272] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.272] lstrlenW (lpString=".xlsx") returned 5
	[0103.272] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.272] lstrlenW (lpString=".ppt") returned 4
	[0103.272] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0103.272] lstrlenW (lpString=".zip") returned 4
	[0103.273] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.273] lstrlenW (lpString=".rar") returned 4
	[0103.273] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.273] lstrlenW (lpString=".bz2") returned 4
	[0103.273] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.273] lstrlenW (lpString=".7z") returned 3
	[0103.273] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0103.273] lstrlenW (lpString=".dbf") returned 4
	[0103.273] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0103.273] lstrlenW (lpString=".1cd") returned 4
	[0103.273] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0103.273] lstrlenW (lpString=".jpg") returned 4
	[0103.273] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.273] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.273] lstrlenW (lpString="Couture.eftx") returned 12
	[0103.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.275] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1967905) returned 1
	[0103.275] CloseHandle (hObject=0x1a8) returned 1
	[0103.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx")) returned 0x20
	[0103.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0103.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.277] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1
	[0103.277] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0103.277] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0103.283] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xa0260, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0103.284] ReadFile (in: hFile=0x1a8, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0103.322] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.323] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x1a0721, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1
	[0103.323] ReadFile (in: hFile=0x1a8, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0103.392] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.392] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0103.426] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.426] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f50080
	[0103.430] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0103.430] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f50080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f50080*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0103.432] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xa0260, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0103.432] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f50080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f50080*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0103.435] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x1a0721, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1
	[0103.435] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f50080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f50080*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0103.437] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f50080 | out: hHeap=0x5e0000) returned 1
	[0103.437] CloseHandle (hObject=0x1a8) returned 1
	[0103.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0103.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0103.441] lstrlenW (lpString=".doc") returned 4
	[0103.441] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.441] lstrlenW (lpString=".docx") returned 5
	[0103.441] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.441] lstrlenW (lpString=".pdf") returned 4
	[0103.441] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.441] lstrlenW (lpString=".xls") returned 4
	[0103.441] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.441] lstrlenW (lpString=".xlsx") returned 5
	[0103.441] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.441] lstrlenW (lpString=".ppt") returned 4
	[0103.441] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0103.441] lstrlenW (lpString=".zip") returned 4
	[0103.441] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.441] lstrlenW (lpString=".rar") returned 4
	[0103.441] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.441] lstrlenW (lpString=".bz2") returned 4
	[0103.441] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.441] lstrlenW (lpString=".7z") returned 3
	[0103.441] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0103.441] lstrlenW (lpString=".dbf") returned 4
	[0103.441] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0103.441] lstrlenW (lpString=".1cd") returned 4
	[0103.442] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0103.442] lstrlenW (lpString=".jpg") returned 4
	[0103.442] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0103.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0103.442] lstrlenW (lpString=".doc") returned 4
	[0103.442] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.442] lstrlenW (lpString=".docx") returned 5
	[0103.442] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.442] lstrlenW (lpString=".pdf") returned 4
	[0103.442] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.442] lstrlenW (lpString=".xls") returned 4
	[0103.442] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.442] lstrlenW (lpString=".xlsx") returned 5
	[0103.442] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.442] lstrlenW (lpString=".ppt") returned 4
	[0103.442] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0103.442] lstrlenW (lpString=".zip") returned 4
	[0103.442] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.442] lstrlenW (lpString=".rar") returned 4
	[0103.442] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.442] lstrlenW (lpString=".bz2") returned 4
	[0103.442] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.442] lstrlenW (lpString=".7z") returned 3
	[0103.442] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0103.442] lstrlenW (lpString=".dbf") returned 4
	[0103.442] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0103.443] lstrlenW (lpString=".1cd") returned 4
	[0103.443] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0103.443] lstrlenW (lpString=".jpg") returned 4
	[0103.443] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.443] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.443] lstrlenW (lpString="Flow.eftx") returned 9
	[0103.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.457] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=26648) returned 1
	[0103.457] CloseHandle (hObject=0x1e4) returned 1
	[0103.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 0x20
	[0103.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.467] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.467] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0103.504] GetLastError () returned 0x0
	[0103.504] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x6818, lpOverlapped=0x0) returned 1
	[0103.514] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6820, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x6820, lpOverlapped=0x0) returned 1
	[0103.515] ReadFile (in: hFile=0x1a8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.515] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0103.515] SetEndOfFile (hFile=0x1bc) returned 1
	[0103.516] CloseHandle (hObject=0x1bc) returned 1
	[0103.516] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.516] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.517] CloseHandle (hObject=0x1a8) returned 1
	[0103.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 1
	[0103.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0103.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0103.521] lstrlenW (lpString=".doc") returned 4
	[0103.521] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.521] lstrlenW (lpString=".docx") returned 5
	[0103.521] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.521] lstrlenW (lpString=".pdf") returned 4
	[0103.521] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.521] lstrlenW (lpString=".xls") returned 4
	[0103.521] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.521] lstrlenW (lpString=".xlsx") returned 5
	[0103.521] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.521] lstrlenW (lpString=".ppt") returned 4
	[0103.521] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0103.521] lstrlenW (lpString=".zip") returned 4
	[0103.521] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.521] lstrlenW (lpString=".rar") returned 4
	[0103.521] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.521] lstrlenW (lpString=".bz2") returned 4
	[0103.521] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.521] lstrlenW (lpString=".7z") returned 3
	[0103.521] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0103.522] lstrlenW (lpString=".dbf") returned 4
	[0103.522] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0103.522] lstrlenW (lpString=".1cd") returned 4
	[0103.522] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0103.522] lstrlenW (lpString=".jpg") returned 4
	[0103.522] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0103.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0103.522] lstrlenW (lpString=".doc") returned 4
	[0103.522] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.522] lstrlenW (lpString=".docx") returned 5
	[0103.522] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.522] lstrlenW (lpString=".pdf") returned 4
	[0103.522] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.522] lstrlenW (lpString=".xls") returned 4
	[0103.522] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.522] lstrlenW (lpString=".xlsx") returned 5
	[0103.522] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.522] lstrlenW (lpString=".ppt") returned 4
	[0103.522] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0103.522] lstrlenW (lpString=".zip") returned 4
	[0103.522] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.522] lstrlenW (lpString=".rar") returned 4
	[0103.522] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.522] lstrlenW (lpString=".bz2") returned 4
	[0103.522] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.522] lstrlenW (lpString=".7z") returned 3
	[0103.523] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0103.523] lstrlenW (lpString=".dbf") returned 4
	[0103.523] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0103.523] lstrlenW (lpString=".1cd") returned 4
	[0103.523] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0103.523] lstrlenW (lpString=".jpg") returned 4
	[0103.523] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.523] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.523] lstrlenW (lpString="Hardcover.eftx") returned 14
	[0103.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.528] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=350689) returned 1
	[0103.528] CloseHandle (hObject=0x1a8) returned 1
	[0103.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 0x20
	[0103.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0103.533] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.533] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0103.542] GetLastError () returned 0x0
	[0103.542] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x559e1, lpOverlapped=0x0) returned 1
	[0103.554] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x559f0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x559f0, lpOverlapped=0x0) returned 1
	[0103.563] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.563] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0103.563] SetEndOfFile (hFile=0x1dc) returned 1
	[0103.567] CloseHandle (hObject=0x1dc) returned 1
	[0103.567] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.567] SetEndOfFile (hFile=0x1bc) returned 1
	[0103.570] CloseHandle (hObject=0x1bc) returned 1
	[0103.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 1
	[0103.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0103.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0103.571] lstrlenW (lpString=".doc") returned 4
	[0103.571] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.571] lstrlenW (lpString=".docx") returned 5
	[0103.571] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.571] lstrlenW (lpString=".pdf") returned 4
	[0103.571] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.571] lstrlenW (lpString=".xls") returned 4
	[0103.571] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.571] lstrlenW (lpString=".xlsx") returned 5
	[0103.571] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.571] lstrlenW (lpString=".ppt") returned 4
	[0103.571] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0103.572] lstrlenW (lpString=".zip") returned 4
	[0103.572] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.572] lstrlenW (lpString=".rar") returned 4
	[0103.572] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.572] lstrlenW (lpString=".bz2") returned 4
	[0103.572] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.572] lstrlenW (lpString=".7z") returned 3
	[0103.572] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0103.572] lstrlenW (lpString=".dbf") returned 4
	[0103.572] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0103.572] lstrlenW (lpString=".1cd") returned 4
	[0103.572] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0103.572] lstrlenW (lpString=".jpg") returned 4
	[0103.572] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0103.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0103.572] lstrlenW (lpString=".doc") returned 4
	[0103.572] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.572] lstrlenW (lpString=".docx") returned 5
	[0103.572] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.572] lstrlenW (lpString=".pdf") returned 4
	[0103.572] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.572] lstrlenW (lpString=".xls") returned 4
	[0103.572] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.572] lstrlenW (lpString=".xlsx") returned 5
	[0103.572] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.573] lstrlenW (lpString=".ppt") returned 4
	[0103.573] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0103.573] lstrlenW (lpString=".zip") returned 4
	[0103.573] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.573] lstrlenW (lpString=".rar") returned 4
	[0103.573] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.573] lstrlenW (lpString=".bz2") returned 4
	[0103.573] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.573] lstrlenW (lpString=".7z") returned 3
	[0103.573] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0103.573] lstrlenW (lpString=".dbf") returned 4
	[0103.573] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0103.573] lstrlenW (lpString=".1cd") returned 4
	[0103.573] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0103.573] lstrlenW (lpString=".jpg") returned 4
	[0103.573] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.573] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.573] lstrlenW (lpString="Horizon.eftx") returned 12
	[0103.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.604] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=211090) returned 1
	[0103.605] CloseHandle (hObject=0x1a8) returned 1
	[0103.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 0x20
	[0103.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.614] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.614] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.619] GetLastError () returned 0x0
	[0103.619] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x33892, lpOverlapped=0x0) returned 1
	[0103.636] WriteFile (in: hFile=0x184, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x338a0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x338a0, lpOverlapped=0x0) returned 1
	[0103.640] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.640] WriteFile (in: hFile=0x184, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.640] SetEndOfFile (hFile=0x184) returned 1
	[0103.641] CloseHandle (hObject=0x184) returned 1
	[0103.641] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.641] SetEndOfFile (hFile=0x1e8) returned 1
	[0103.643] CloseHandle (hObject=0x1e8) returned 1
	[0103.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 1
	[0103.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0103.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0103.644] lstrlenW (lpString=".doc") returned 4
	[0103.644] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.644] lstrlenW (lpString=".docx") returned 5
	[0103.644] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.644] lstrlenW (lpString=".pdf") returned 4
	[0103.644] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.644] lstrlenW (lpString=".xls") returned 4
	[0103.644] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.644] lstrlenW (lpString=".xlsx") returned 5
	[0103.645] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.645] lstrlenW (lpString=".ppt") returned 4
	[0103.645] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0103.645] lstrlenW (lpString=".zip") returned 4
	[0103.645] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.645] lstrlenW (lpString=".rar") returned 4
	[0103.645] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.645] lstrlenW (lpString=".bz2") returned 4
	[0103.645] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.645] lstrlenW (lpString=".7z") returned 3
	[0103.645] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0103.645] lstrlenW (lpString=".dbf") returned 4
	[0103.645] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0103.645] lstrlenW (lpString=".1cd") returned 4
	[0103.645] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0103.645] lstrlenW (lpString=".jpg") returned 4
	[0103.645] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0103.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0103.645] lstrlenW (lpString=".doc") returned 4
	[0103.645] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.645] lstrlenW (lpString=".docx") returned 5
	[0103.645] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.645] lstrlenW (lpString=".pdf") returned 4
	[0103.645] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.645] lstrlenW (lpString=".xls") returned 4
	[0103.646] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.646] lstrlenW (lpString=".xlsx") returned 5
	[0103.646] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.646] lstrlenW (lpString=".ppt") returned 4
	[0103.646] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0103.646] lstrlenW (lpString=".zip") returned 4
	[0103.646] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.646] lstrlenW (lpString=".rar") returned 4
	[0103.646] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.646] lstrlenW (lpString=".bz2") returned 4
	[0103.646] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.646] lstrlenW (lpString=".7z") returned 3
	[0103.646] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0103.646] lstrlenW (lpString=".dbf") returned 4
	[0103.646] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0103.646] lstrlenW (lpString=".1cd") returned 4
	[0103.646] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0103.646] lstrlenW (lpString=".jpg") returned 4
	[0103.646] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.647] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.647] lstrlenW (lpString="Module.eftx") returned 11
	[0103.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.699] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=43357) returned 1
	[0103.699] CloseHandle (hObject=0x1e8) returned 1
	[0103.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 0x20
	[0103.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.705] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.705] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.709] GetLastError () returned 0x0
	[0103.709] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xa95d, lpOverlapped=0x0) returned 1
	[0103.715] WriteFile (in: hFile=0x184, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xa960, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xa960, lpOverlapped=0x0) returned 1
	[0103.717] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.717] WriteFile (in: hFile=0x184, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0103.717] SetEndOfFile (hFile=0x184) returned 1
	[0103.717] CloseHandle (hObject=0x184) returned 1
	[0103.717] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.718] SetEndOfFile (hFile=0x1e8) returned 1
	[0103.719] CloseHandle (hObject=0x1e8) returned 1
	[0103.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 1
	[0103.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0103.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0103.720] lstrlenW (lpString=".doc") returned 4
	[0103.720] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.720] lstrlenW (lpString=".docx") returned 5
	[0103.720] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.720] lstrlenW (lpString=".pdf") returned 4
	[0103.720] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.720] lstrlenW (lpString=".xls") returned 4
	[0103.720] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.720] lstrlenW (lpString=".xlsx") returned 5
	[0103.720] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.720] lstrlenW (lpString=".ppt") returned 4
	[0103.720] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0103.720] lstrlenW (lpString=".zip") returned 4
	[0103.720] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.720] lstrlenW (lpString=".rar") returned 4
	[0103.720] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.720] lstrlenW (lpString=".bz2") returned 4
	[0103.720] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.720] lstrlenW (lpString=".7z") returned 3
	[0103.720] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0103.721] lstrlenW (lpString=".dbf") returned 4
	[0103.721] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0103.721] lstrlenW (lpString=".1cd") returned 4
	[0103.721] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0103.721] lstrlenW (lpString=".jpg") returned 4
	[0103.721] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0103.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0103.721] lstrlenW (lpString=".doc") returned 4
	[0103.721] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.721] lstrlenW (lpString=".docx") returned 5
	[0103.721] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.721] lstrlenW (lpString=".pdf") returned 4
	[0103.721] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.721] lstrlenW (lpString=".xls") returned 4
	[0103.721] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.721] lstrlenW (lpString=".xlsx") returned 5
	[0103.721] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.721] lstrlenW (lpString=".ppt") returned 4
	[0103.722] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0103.722] lstrlenW (lpString=".zip") returned 4
	[0103.722] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.722] lstrlenW (lpString=".rar") returned 4
	[0103.722] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.722] lstrlenW (lpString=".bz2") returned 4
	[0103.722] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.722] lstrlenW (lpString=".7z") returned 3
	[0103.722] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0103.722] lstrlenW (lpString=".dbf") returned 4
	[0103.722] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0103.722] lstrlenW (lpString=".1cd") returned 4
	[0103.722] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0103.722] lstrlenW (lpString=".jpg") returned 4
	[0103.722] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.723] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.723] lstrlenW (lpString="Newsprint.eftx") returned 14
	[0103.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.776] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=582401) returned 1
	[0103.776] CloseHandle (hObject=0x184) returned 1
	[0103.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 0x20
	[0103.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.802] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.802] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.808] GetLastError () returned 0x0
	[0103.808] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x8e301, lpOverlapped=0x0) returned 1
	[0103.836] WriteFile (in: hFile=0x184, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x8e310, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x8e310, lpOverlapped=0x0) returned 1
	[0103.850] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.850] WriteFile (in: hFile=0x184, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0103.851] SetEndOfFile (hFile=0x184) returned 1
	[0103.851] CloseHandle (hObject=0x184) returned 1
	[0103.851] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.851] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.871] CloseHandle (hObject=0x1d8) returned 1
	[0103.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 1
	[0103.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0103.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0103.872] lstrlenW (lpString=".doc") returned 4
	[0103.872] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.872] lstrlenW (lpString=".docx") returned 5
	[0103.872] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.872] lstrlenW (lpString=".pdf") returned 4
	[0103.872] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.872] lstrlenW (lpString=".xls") returned 4
	[0103.872] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.872] lstrlenW (lpString=".xlsx") returned 5
	[0103.872] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.872] lstrlenW (lpString=".ppt") returned 4
	[0103.873] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0103.873] lstrlenW (lpString=".zip") returned 4
	[0103.873] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.873] lstrlenW (lpString=".rar") returned 4
	[0103.873] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.873] lstrlenW (lpString=".bz2") returned 4
	[0103.873] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.873] lstrlenW (lpString=".7z") returned 3
	[0103.873] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0103.873] lstrlenW (lpString=".dbf") returned 4
	[0103.873] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0103.873] lstrlenW (lpString=".1cd") returned 4
	[0103.873] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0103.873] lstrlenW (lpString=".jpg") returned 4
	[0103.873] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0103.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0103.873] lstrlenW (lpString=".doc") returned 4
	[0103.873] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.873] lstrlenW (lpString=".docx") returned 5
	[0103.874] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.874] lstrlenW (lpString=".pdf") returned 4
	[0103.874] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.874] lstrlenW (lpString=".xls") returned 4
	[0103.874] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.874] lstrlenW (lpString=".xlsx") returned 5
	[0103.874] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.874] lstrlenW (lpString=".ppt") returned 4
	[0103.874] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0103.874] lstrlenW (lpString=".zip") returned 4
	[0103.874] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.874] lstrlenW (lpString=".rar") returned 4
	[0103.874] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.874] lstrlenW (lpString=".bz2") returned 4
	[0103.874] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.874] lstrlenW (lpString=".7z") returned 3
	[0103.874] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0103.874] lstrlenW (lpString=".dbf") returned 4
	[0103.874] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0103.874] lstrlenW (lpString=".1cd") returned 4
	[0103.875] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0103.875] lstrlenW (lpString=".jpg") returned 4
	[0103.875] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.875] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.875] lstrlenW (lpString="Origin.eftx") returned 11
	[0103.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.952] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=40941) returned 1
	[0103.952] CloseHandle (hObject=0x184) returned 1
	[0103.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 0x20
	[0103.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.970] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.970] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.980] GetLastError () returned 0x0
	[0103.980] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x9fed, lpOverlapped=0x0) returned 1
	[0104.002] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x9ff0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x9ff0, lpOverlapped=0x0) returned 1
	[0104.004] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.004] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0104.004] SetEndOfFile (hFile=0x1a8) returned 1
	[0104.004] CloseHandle (hObject=0x1a8) returned 1
	[0104.004] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.005] SetEndOfFile (hFile=0x1d8) returned 1
	[0104.006] CloseHandle (hObject=0x1d8) returned 1
	[0104.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 1
	[0104.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0104.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0104.007] lstrlenW (lpString=".doc") returned 4
	[0104.007] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.007] lstrlenW (lpString=".docx") returned 5
	[0104.007] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.008] lstrlenW (lpString=".pdf") returned 4
	[0104.008] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.008] lstrlenW (lpString=".xls") returned 4
	[0104.008] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.008] lstrlenW (lpString=".xlsx") returned 5
	[0104.008] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.008] lstrlenW (lpString=".ppt") returned 4
	[0104.008] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0104.008] lstrlenW (lpString=".zip") returned 4
	[0104.008] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.008] lstrlenW (lpString=".rar") returned 4
	[0104.008] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.008] lstrlenW (lpString=".bz2") returned 4
	[0104.008] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.008] lstrlenW (lpString=".7z") returned 3
	[0104.008] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0104.008] lstrlenW (lpString=".dbf") returned 4
	[0104.008] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0104.008] lstrlenW (lpString=".1cd") returned 4
	[0104.008] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0104.008] lstrlenW (lpString=".jpg") returned 4
	[0104.008] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0104.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0104.009] lstrlenW (lpString=".doc") returned 4
	[0104.009] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.009] lstrlenW (lpString=".docx") returned 5
	[0104.009] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.009] lstrlenW (lpString=".pdf") returned 4
	[0104.009] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.009] lstrlenW (lpString=".xls") returned 4
	[0104.009] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.009] lstrlenW (lpString=".xlsx") returned 5
	[0104.009] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.009] lstrlenW (lpString=".ppt") returned 4
	[0104.009] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0104.009] lstrlenW (lpString=".zip") returned 4
	[0104.009] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.009] lstrlenW (lpString=".rar") returned 4
	[0104.009] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.009] lstrlenW (lpString=".bz2") returned 4
	[0104.009] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.009] lstrlenW (lpString=".7z") returned 3
	[0104.009] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0104.009] lstrlenW (lpString=".dbf") returned 4
	[0104.009] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0104.010] lstrlenW (lpString=".1cd") returned 4
	[0104.010] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0104.010] lstrlenW (lpString=".jpg") returned 4
	[0104.010] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.010] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0104.010] lstrlenW (lpString="Pushpin.eftx") returned 12
	[0104.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.122] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=782121) returned 1
	[0104.122] CloseHandle (hObject=0x1e8) returned 1
	[0104.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 0x20
	[0104.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.133] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.133] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.139] GetLastError () returned 0x0
	[0104.139] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xbef29, lpOverlapped=0x0) returned 1
	[0104.160] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xbef30, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xbef30, lpOverlapped=0x0) returned 1
	[0104.178] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.179] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.179] SetEndOfFile (hFile=0x1d8) returned 1
	[0104.183] CloseHandle (hObject=0x1d8) returned 1
	[0104.183] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.183] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.190] CloseHandle (hObject=0x1e8) returned 1
	[0104.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 1
	[0104.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0104.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0104.191] lstrlenW (lpString=".doc") returned 4
	[0104.191] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.191] lstrlenW (lpString=".docx") returned 5
	[0104.191] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.191] lstrlenW (lpString=".pdf") returned 4
	[0104.191] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.191] lstrlenW (lpString=".xls") returned 4
	[0104.191] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.191] lstrlenW (lpString=".xlsx") returned 5
	[0104.191] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.191] lstrlenW (lpString=".ppt") returned 4
	[0104.191] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0104.191] lstrlenW (lpString=".zip") returned 4
	[0104.191] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.191] lstrlenW (lpString=".rar") returned 4
	[0104.191] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.191] lstrlenW (lpString=".bz2") returned 4
	[0104.191] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.191] lstrlenW (lpString=".7z") returned 3
	[0104.191] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0104.191] lstrlenW (lpString=".dbf") returned 4
	[0104.191] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0104.192] lstrlenW (lpString=".1cd") returned 4
	[0104.192] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0104.192] lstrlenW (lpString=".jpg") returned 4
	[0104.192] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0104.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0104.192] lstrlenW (lpString=".doc") returned 4
	[0104.192] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.192] lstrlenW (lpString=".docx") returned 5
	[0104.192] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.192] lstrlenW (lpString=".pdf") returned 4
	[0104.192] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.192] lstrlenW (lpString=".xls") returned 4
	[0104.192] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.192] lstrlenW (lpString=".xlsx") returned 5
	[0104.192] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.192] lstrlenW (lpString=".ppt") returned 4
	[0104.192] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0104.192] lstrlenW (lpString=".zip") returned 4
	[0104.192] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.192] lstrlenW (lpString=".rar") returned 4
	[0104.192] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.192] lstrlenW (lpString=".bz2") returned 4
	[0104.192] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.192] lstrlenW (lpString=".7z") returned 3
	[0104.192] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0104.192] lstrlenW (lpString=".dbf") returned 4
	[0104.192] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0104.193] lstrlenW (lpString=".1cd") returned 4
	[0104.193] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0104.193] lstrlenW (lpString=".jpg") returned 4
	[0104.193] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.193] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0104.193] lstrlenW (lpString="Slipstream.eftx") returned 15
	[0104.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.216] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=27789) returned 1
	[0104.216] CloseHandle (hObject=0x1d8) returned 1
	[0104.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 0x20
	[0104.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.278] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.278] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0104.290] GetLastError () returned 0x0
	[0104.290] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x6c8d, lpOverlapped=0x0) returned 1
	[0104.301] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x6c90, lpOverlapped=0x0) returned 1
	[0104.302] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.302] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0104.302] SetEndOfFile (hFile=0x1e4) returned 1
	[0104.303] CloseHandle (hObject=0x1e4) returned 1
	[0104.303] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.303] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.304] CloseHandle (hObject=0x1e8) returned 1
	[0104.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 1
	[0104.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0104.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0104.306] lstrlenW (lpString=".doc") returned 4
	[0104.306] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.306] lstrlenW (lpString=".docx") returned 5
	[0104.306] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.306] lstrlenW (lpString=".pdf") returned 4
	[0104.306] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.306] lstrlenW (lpString=".xls") returned 4
	[0104.306] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.306] lstrlenW (lpString=".xlsx") returned 5
	[0104.306] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.306] lstrlenW (lpString=".ppt") returned 4
	[0104.306] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0104.306] lstrlenW (lpString=".zip") returned 4
	[0104.306] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.306] lstrlenW (lpString=".rar") returned 4
	[0104.306] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.306] lstrlenW (lpString=".bz2") returned 4
	[0104.306] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.306] lstrlenW (lpString=".7z") returned 3
	[0104.306] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0104.306] lstrlenW (lpString=".dbf") returned 4
	[0104.306] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0104.306] lstrlenW (lpString=".1cd") returned 4
	[0104.306] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0104.306] lstrlenW (lpString=".jpg") returned 4
	[0104.306] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0104.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0104.307] lstrlenW (lpString=".doc") returned 4
	[0104.307] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.307] lstrlenW (lpString=".docx") returned 5
	[0104.307] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.307] lstrlenW (lpString=".pdf") returned 4
	[0104.307] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.307] lstrlenW (lpString=".xls") returned 4
	[0104.307] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.307] lstrlenW (lpString=".xlsx") returned 5
	[0104.307] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.307] lstrlenW (lpString=".ppt") returned 4
	[0104.307] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0104.307] lstrlenW (lpString=".zip") returned 4
	[0104.307] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.307] lstrlenW (lpString=".rar") returned 4
	[0104.307] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.307] lstrlenW (lpString=".bz2") returned 4
	[0104.307] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.307] lstrlenW (lpString=".7z") returned 3
	[0104.307] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0104.307] lstrlenW (lpString=".dbf") returned 4
	[0104.307] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0104.307] lstrlenW (lpString=".1cd") returned 4
	[0104.307] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0104.307] lstrlenW (lpString=".jpg") returned 4
	[0104.307] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.308] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0104.308] lstrlenW (lpString="Thatch.eftx") returned 11
	[0104.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0104.316] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=41295) returned 1
	[0104.316] CloseHandle (hObject=0x184) returned 1
	[0104.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 0x20
	[0104.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.352] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.352] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.364] GetLastError () returned 0x0
	[0104.364] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xa14f, lpOverlapped=0x0) returned 1
	[0104.368] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xa150, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xa150, lpOverlapped=0x0) returned 1
	[0104.370] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.370] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0104.371] SetEndOfFile (hFile=0x1d8) returned 1
	[0104.371] CloseHandle (hObject=0x1d8) returned 1
	[0104.371] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.371] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.372] CloseHandle (hObject=0x1e8) returned 1
	[0104.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 1
	[0104.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0104.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0104.373] lstrlenW (lpString=".doc") returned 4
	[0104.373] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.373] lstrlenW (lpString=".docx") returned 5
	[0104.373] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.373] lstrlenW (lpString=".pdf") returned 4
	[0104.373] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.373] lstrlenW (lpString=".xls") returned 4
	[0104.373] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.373] lstrlenW (lpString=".xlsx") returned 5
	[0104.373] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.373] lstrlenW (lpString=".ppt") returned 4
	[0104.373] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0104.373] lstrlenW (lpString=".zip") returned 4
	[0104.373] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.373] lstrlenW (lpString=".rar") returned 4
	[0104.373] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.373] lstrlenW (lpString=".bz2") returned 4
	[0104.373] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.373] lstrlenW (lpString=".7z") returned 3
	[0104.373] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0104.374] lstrlenW (lpString=".dbf") returned 4
	[0104.374] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0104.374] lstrlenW (lpString=".1cd") returned 4
	[0104.374] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0104.374] lstrlenW (lpString=".jpg") returned 4
	[0104.374] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0104.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0104.374] lstrlenW (lpString=".doc") returned 4
	[0104.374] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.374] lstrlenW (lpString=".docx") returned 5
	[0104.374] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.374] lstrlenW (lpString=".pdf") returned 4
	[0104.374] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.374] lstrlenW (lpString=".xls") returned 4
	[0104.374] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.374] lstrlenW (lpString=".xlsx") returned 5
	[0104.374] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.374] lstrlenW (lpString=".ppt") returned 4
	[0104.374] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0104.374] lstrlenW (lpString=".zip") returned 4
	[0104.374] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.374] lstrlenW (lpString=".rar") returned 4
	[0104.374] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.374] lstrlenW (lpString=".bz2") returned 4
	[0104.375] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.375] lstrlenW (lpString=".7z") returned 3
	[0104.375] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0104.375] lstrlenW (lpString=".dbf") returned 4
	[0104.375] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0104.375] lstrlenW (lpString=".1cd") returned 4
	[0104.375] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0104.375] lstrlenW (lpString=".jpg") returned 4
	[0104.375] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.375] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0104.375] lstrlenW (lpString="Trek.eftx") returned 9
	[0104.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.393] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=129924) returned 1
	[0104.393] CloseHandle (hObject=0x1a8) returned 1
	[0104.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 0x20
	[0104.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.450] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.450] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.461] GetLastError () returned 0x0
	[0104.461] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1fb84, lpOverlapped=0x0) returned 1
	[0104.474] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1fb90, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1fb90, lpOverlapped=0x0) returned 1
	[0104.477] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.477] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0104.478] SetEndOfFile (hFile=0x1dc) returned 1
	[0104.478] CloseHandle (hObject=0x1dc) returned 1
	[0104.478] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.478] SetEndOfFile (hFile=0x1c4) returned 1
	[0104.480] CloseHandle (hObject=0x1c4) returned 1
	[0104.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 1
	[0104.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0104.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0104.482] lstrlenW (lpString=".doc") returned 4
	[0104.482] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.482] lstrlenW (lpString=".docx") returned 5
	[0104.482] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.482] lstrlenW (lpString=".pdf") returned 4
	[0104.482] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.482] lstrlenW (lpString=".xls") returned 4
	[0104.482] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.482] lstrlenW (lpString=".xlsx") returned 5
	[0104.482] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.482] lstrlenW (lpString=".ppt") returned 4
	[0104.482] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0104.482] lstrlenW (lpString=".zip") returned 4
	[0104.482] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.482] lstrlenW (lpString=".rar") returned 4
	[0104.483] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.483] lstrlenW (lpString=".bz2") returned 4
	[0104.483] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.483] lstrlenW (lpString=".7z") returned 3
	[0104.483] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0104.483] lstrlenW (lpString=".dbf") returned 4
	[0104.483] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0104.483] lstrlenW (lpString=".1cd") returned 4
	[0104.483] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0104.483] lstrlenW (lpString=".jpg") returned 4
	[0104.483] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0104.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0104.483] lstrlenW (lpString=".doc") returned 4
	[0104.483] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.483] lstrlenW (lpString=".docx") returned 5
	[0104.483] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.483] lstrlenW (lpString=".pdf") returned 4
	[0104.483] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.483] lstrlenW (lpString=".xls") returned 4
	[0104.483] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.483] lstrlenW (lpString=".xlsx") returned 5
	[0104.483] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.483] lstrlenW (lpString=".ppt") returned 4
	[0104.484] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0104.484] lstrlenW (lpString=".zip") returned 4
	[0104.484] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.484] lstrlenW (lpString=".rar") returned 4
	[0104.484] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.484] lstrlenW (lpString=".bz2") returned 4
	[0104.484] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.484] lstrlenW (lpString=".7z") returned 3
	[0104.484] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0104.484] lstrlenW (lpString=".dbf") returned 4
	[0104.484] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0104.484] lstrlenW (lpString=".1cd") returned 4
	[0104.484] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0104.484] lstrlenW (lpString=".jpg") returned 4
	[0104.484] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.484] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0104.484] lstrlenW (lpString="Waveform.eftx") returned 13
	[0104.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.489] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=112504) returned 1
	[0104.490] CloseHandle (hObject=0x1c4) returned 1
	[0104.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 0x20
	[0104.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.528] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.528] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.532] GetLastError () returned 0x0
	[0104.532] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1b778, lpOverlapped=0x0) returned 1
	[0104.538] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1b780, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1b780, lpOverlapped=0x0) returned 1
	[0104.541] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.542] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0104.542] SetEndOfFile (hFile=0x1c4) returned 1
	[0104.542] CloseHandle (hObject=0x1c4) returned 1
	[0104.542] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.542] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.544] CloseHandle (hObject=0x1e8) returned 1
	[0104.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 1
	[0104.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0104.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0104.545] lstrlenW (lpString=".doc") returned 4
	[0104.545] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.545] lstrlenW (lpString=".docx") returned 5
	[0104.545] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.545] lstrlenW (lpString=".pdf") returned 4
	[0104.545] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.545] lstrlenW (lpString=".xls") returned 4
	[0104.545] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.545] lstrlenW (lpString=".xlsx") returned 5
	[0104.545] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.545] lstrlenW (lpString=".ppt") returned 4
	[0104.545] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0104.545] lstrlenW (lpString=".zip") returned 4
	[0104.545] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.545] lstrlenW (lpString=".rar") returned 4
	[0104.545] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.545] lstrlenW (lpString=".bz2") returned 4
	[0104.545] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.545] lstrlenW (lpString=".7z") returned 3
	[0104.545] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0104.545] lstrlenW (lpString=".dbf") returned 4
	[0104.545] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0104.545] lstrlenW (lpString=".1cd") returned 4
	[0104.546] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0104.546] lstrlenW (lpString=".jpg") returned 4
	[0104.546] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0104.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0104.546] lstrlenW (lpString=".doc") returned 4
	[0104.546] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.546] lstrlenW (lpString=".docx") returned 5
	[0104.546] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.546] lstrlenW (lpString=".pdf") returned 4
	[0104.546] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.546] lstrlenW (lpString=".xls") returned 4
	[0104.546] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.546] lstrlenW (lpString=".xlsx") returned 5
	[0104.546] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.546] lstrlenW (lpString=".ppt") returned 4
	[0104.546] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0104.546] lstrlenW (lpString=".zip") returned 4
	[0104.546] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.546] lstrlenW (lpString=".rar") returned 4
	[0104.546] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.546] lstrlenW (lpString=".bz2") returned 4
	[0104.546] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.547] lstrlenW (lpString=".7z") returned 3
	[0104.547] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0104.547] lstrlenW (lpString=".dbf") returned 4
	[0104.547] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0104.547] lstrlenW (lpString=".1cd") returned 4
	[0104.547] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0104.547] lstrlenW (lpString=".jpg") returned 4
	[0104.547] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.547] lstrcmpiW (lpString1=".MML", lpString2=".adobe") returned 1
	[0104.547] lstrlenW (lpString="CAGCAT10.MML") returned 12
	[0104.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.550] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=312400) returned 1
	[0104.550] CloseHandle (hObject=0x1e8) returned 1
	[0104.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 0x20
	[0104.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.555] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.555] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.558] GetLastError () returned 0x0
	[0104.558] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x4c450, lpOverlapped=0x0) returned 1
	[0104.582] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4c460, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x4c460, lpOverlapped=0x0) returned 1
	[0104.591] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.592] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.592] SetEndOfFile (hFile=0x1c4) returned 1
	[0104.592] CloseHandle (hObject=0x1c4) returned 1
	[0104.592] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.592] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.596] CloseHandle (hObject=0x1e8) returned 1
	[0104.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 1
	[0104.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0104.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0104.597] lstrlenW (lpString=".doc") returned 4
	[0104.597] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1
	[0104.597] lstrlenW (lpString=".docx") returned 5
	[0104.597] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1
	[0104.597] lstrlenW (lpString=".pdf") returned 4
	[0104.597] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1
	[0104.597] lstrlenW (lpString=".xls") returned 4
	[0104.597] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1
	[0104.597] lstrlenW (lpString=".xlsx") returned 5
	[0104.597] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1
	[0104.597] lstrlenW (lpString=".ppt") returned 4
	[0104.597] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1
	[0104.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0104.597] lstrlenW (lpString=".zip") returned 4
	[0104.597] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1
	[0104.597] lstrlenW (lpString=".rar") returned 4
	[0104.597] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1
	[0104.597] lstrlenW (lpString=".bz2") returned 4
	[0104.597] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1
	[0104.597] lstrlenW (lpString=".7z") returned 3
	[0104.597] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1
	[0104.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0104.597] lstrlenW (lpString=".dbf") returned 4
	[0104.597] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1
	[0104.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0104.598] lstrlenW (lpString=".1cd") returned 4
	[0104.598] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1
	[0104.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0104.598] lstrlenW (lpString=".jpg") returned 4
	[0104.598] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1
	[0104.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0104.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0104.598] lstrlenW (lpString=".doc") returned 4
	[0104.598] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1
	[0104.598] lstrlenW (lpString=".docx") returned 5
	[0104.598] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1
	[0104.598] lstrlenW (lpString=".pdf") returned 4
	[0104.598] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1
	[0104.598] lstrlenW (lpString=".xls") returned 4
	[0104.598] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1
	[0104.598] lstrlenW (lpString=".xlsx") returned 5
	[0104.598] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1
	[0104.598] lstrlenW (lpString=".ppt") returned 4
	[0104.598] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1
	[0104.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0104.598] lstrlenW (lpString=".zip") returned 4
	[0104.598] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1
	[0104.598] lstrlenW (lpString=".rar") returned 4
	[0104.598] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1
	[0104.598] lstrlenW (lpString=".bz2") returned 4
	[0104.598] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1
	[0104.598] lstrlenW (lpString=".7z") returned 3
	[0104.599] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1
	[0104.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0104.599] lstrlenW (lpString=".dbf") returned 4
	[0104.599] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1
	[0104.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0104.599] lstrlenW (lpString=".1cd") returned 4
	[0104.599] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1
	[0104.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0104.599] lstrlenW (lpString=".jpg") returned 4
	[0104.599] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1
	[0104.599] lstrcmpiW (lpString1=".MMW", lpString2=".adobe") returned 1
	[0104.599] lstrlenW (lpString="CAGCAT10.MMW") returned 12
	[0104.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.600] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=394200) returned 1
	[0104.600] CloseHandle (hObject=0x1e8) returned 1
	[0104.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 0x20
	[0104.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.601] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.601] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.602] GetLastError () returned 0x0
	[0104.602] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x603d8, lpOverlapped=0x0) returned 1
	[0104.613] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x603e0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x603e0, lpOverlapped=0x0) returned 1
	[0104.644] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.644] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.644] SetEndOfFile (hFile=0x1c4) returned 1
	[0104.644] CloseHandle (hObject=0x1c4) returned 1
	[0104.644] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.644] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.649] CloseHandle (hObject=0x1e8) returned 1
	[0104.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 1
	[0104.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0104.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0104.650] lstrlenW (lpString=".doc") returned 4
	[0104.650] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1
	[0104.650] lstrlenW (lpString=".docx") returned 5
	[0104.650] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1
	[0104.650] lstrlenW (lpString=".pdf") returned 4
	[0104.650] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1
	[0104.650] lstrlenW (lpString=".xls") returned 4
	[0104.650] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1
	[0104.650] lstrlenW (lpString=".xlsx") returned 5
	[0104.650] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1
	[0104.650] lstrlenW (lpString=".ppt") returned 4
	[0104.650] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1
	[0104.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0104.650] lstrlenW (lpString=".zip") returned 4
	[0104.650] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1
	[0104.650] lstrlenW (lpString=".rar") returned 4
	[0104.650] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1
	[0104.650] lstrlenW (lpString=".bz2") returned 4
	[0104.650] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1
	[0104.650] lstrlenW (lpString=".7z") returned 3
	[0104.650] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1
	[0104.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0104.651] lstrlenW (lpString=".dbf") returned 4
	[0104.651] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1
	[0104.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0104.651] lstrlenW (lpString=".1cd") returned 4
	[0104.651] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1
	[0104.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0104.651] lstrlenW (lpString=".jpg") returned 4
	[0104.651] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1
	[0104.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0104.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0104.651] lstrlenW (lpString=".doc") returned 4
	[0104.651] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1
	[0104.651] lstrlenW (lpString=".docx") returned 5
	[0104.651] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1
	[0104.651] lstrlenW (lpString=".pdf") returned 4
	[0104.651] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1
	[0104.651] lstrlenW (lpString=".xls") returned 4
	[0104.651] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1
	[0104.651] lstrlenW (lpString=".xlsx") returned 5
	[0104.651] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1
	[0104.651] lstrlenW (lpString=".ppt") returned 4
	[0104.651] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1
	[0104.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0104.651] lstrlenW (lpString=".zip") returned 4
	[0104.651] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1
	[0104.651] lstrlenW (lpString=".rar") returned 4
	[0104.651] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1
	[0104.651] lstrlenW (lpString=".bz2") returned 4
	[0104.651] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1
	[0104.652] lstrlenW (lpString=".7z") returned 3
	[0104.652] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1
	[0104.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0104.652] lstrlenW (lpString=".dbf") returned 4
	[0104.652] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1
	[0104.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0104.652] lstrlenW (lpString=".1cd") returned 4
	[0104.652] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1
	[0104.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0104.652] lstrlenW (lpString=".jpg") returned 4
	[0104.652] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1
	[0104.652] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0104.652] lstrlenW (lpString="AUTOSHAP.DLL") returned 12
	[0104.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.654] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=15776) returned 1
	[0104.654] CloseHandle (hObject=0x1e8) returned 1
	[0104.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll")) returned 0x20
	[0104.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.658] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.659] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.660] GetLastError () returned 0x0
	[0104.660] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x3da0, lpOverlapped=0x0) returned 1
	[0104.690] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x3db0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x3db0, lpOverlapped=0x0) returned 1
	[0104.691] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.691] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.692] SetEndOfFile (hFile=0x1c4) returned 1
	[0104.692] CloseHandle (hObject=0x1c4) returned 1
	[0104.692] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.692] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.693] CloseHandle (hObject=0x1e8) returned 1
	[0104.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll")) returned 1
	[0104.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0104.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0104.694] lstrlenW (lpString=".doc") returned 4
	[0104.694] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0104.694] lstrlenW (lpString=".docx") returned 5
	[0104.695] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1
	[0104.695] lstrlenW (lpString=".pdf") returned 4
	[0104.695] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0104.695] lstrlenW (lpString=".xls") returned 4
	[0104.695] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0104.695] lstrlenW (lpString=".xlsx") returned 5
	[0104.695] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1
	[0104.695] lstrlenW (lpString=".ppt") returned 4
	[0104.695] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0104.695] lstrlenW (lpString=".zip") returned 4
	[0104.695] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0104.695] lstrlenW (lpString=".rar") returned 4
	[0104.695] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0104.695] lstrlenW (lpString=".bz2") returned 4
	[0104.695] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0104.695] lstrlenW (lpString=".7z") returned 3
	[0104.695] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0104.695] lstrlenW (lpString=".dbf") returned 4
	[0104.696] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0104.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0104.696] lstrlenW (lpString=".1cd") returned 4
	[0104.696] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0104.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0104.696] lstrlenW (lpString=".jpg") returned 4
	[0104.696] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0104.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0104.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0104.696] lstrlenW (lpString=".doc") returned 4
	[0104.696] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0104.696] lstrlenW (lpString=".docx") returned 5
	[0104.696] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1
	[0104.696] lstrlenW (lpString=".pdf") returned 4
	[0104.696] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0104.696] lstrlenW (lpString=".xls") returned 4
	[0104.696] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0104.696] lstrlenW (lpString=".xlsx") returned 5
	[0104.697] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1
	[0104.697] lstrlenW (lpString=".ppt") returned 4
	[0104.697] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0104.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0104.697] lstrlenW (lpString=".zip") returned 4
	[0104.697] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0104.697] lstrlenW (lpString=".rar") returned 4
	[0104.697] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0104.697] lstrlenW (lpString=".bz2") returned 4
	[0104.697] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0104.697] lstrlenW (lpString=".7z") returned 3
	[0104.697] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0104.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0104.697] lstrlenW (lpString=".dbf") returned 4
	[0104.697] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0104.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0104.698] lstrlenW (lpString=".1cd") returned 4
	[0104.698] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0104.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0104.698] lstrlenW (lpString=".jpg") returned 4
	[0104.698] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0104.698] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0104.698] lstrlenW (lpString="LINES.DLL") returned 9
	[0104.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.707] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=15256) returned 1
	[0104.707] CloseHandle (hObject=0x1c4) returned 1
	[0104.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll")) returned 0x20
	[0104.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.711] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.712] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.713] GetLastError () returned 0x0
	[0104.713] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x3b98, lpOverlapped=0x0) returned 1
	[0104.717] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x3ba0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x3ba0, lpOverlapped=0x0) returned 1
	[0104.720] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.720] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0104.721] SetEndOfFile (hFile=0x1dc) returned 1
	[0104.721] CloseHandle (hObject=0x1dc) returned 1
	[0104.721] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.721] SetEndOfFile (hFile=0x1c4) returned 1
	[0104.723] CloseHandle (hObject=0x1c4) returned 1
	[0104.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll")) returned 1
	[0104.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0104.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0104.723] lstrlenW (lpString=".doc") returned 4
	[0104.723] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0104.724] lstrlenW (lpString=".docx") returned 5
	[0104.724] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0104.724] lstrlenW (lpString=".pdf") returned 4
	[0104.724] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0104.724] lstrlenW (lpString=".xls") returned 4
	[0104.724] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0104.724] lstrlenW (lpString=".xlsx") returned 5
	[0104.724] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0104.724] lstrlenW (lpString=".ppt") returned 4
	[0104.724] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0104.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0104.724] lstrlenW (lpString=".zip") returned 4
	[0104.724] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0104.724] lstrlenW (lpString=".rar") returned 4
	[0104.724] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0104.724] lstrlenW (lpString=".bz2") returned 4
	[0104.724] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0104.724] lstrlenW (lpString=".7z") returned 3
	[0104.724] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0104.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0104.725] lstrlenW (lpString=".dbf") returned 4
	[0104.725] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0104.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0104.725] lstrlenW (lpString=".1cd") returned 4
	[0104.725] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0104.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0104.725] lstrlenW (lpString=".jpg") returned 4
	[0104.725] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0104.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0104.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0104.725] lstrlenW (lpString=".doc") returned 4
	[0104.725] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0104.725] lstrlenW (lpString=".docx") returned 5
	[0104.725] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0104.725] lstrlenW (lpString=".pdf") returned 4
	[0104.725] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0104.726] lstrlenW (lpString=".xls") returned 4
	[0104.726] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0104.726] lstrlenW (lpString=".xlsx") returned 5
	[0104.726] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0104.726] lstrlenW (lpString=".ppt") returned 4
	[0104.726] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0104.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0104.726] lstrlenW (lpString=".zip") returned 4
	[0104.726] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0104.726] lstrlenW (lpString=".rar") returned 4
	[0104.726] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0104.726] lstrlenW (lpString=".bz2") returned 4
	[0104.726] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0104.726] lstrlenW (lpString=".7z") returned 3
	[0104.726] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0104.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0104.726] lstrlenW (lpString=".dbf") returned 4
	[0104.726] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0104.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0104.727] lstrlenW (lpString=".1cd") returned 4
	[0104.727] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0104.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0104.727] lstrlenW (lpString=".jpg") returned 4
	[0104.727] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0104.727] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0104.727] lstrlenW (lpString="OFFICE10.DLL") returned 12
	[0104.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.728] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=15776) returned 1
	[0104.728] CloseHandle (hObject=0x1c4) returned 1
	[0104.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll")) returned 0x20
	[0104.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.729] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.729] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.743] GetLastError () returned 0x0
	[0104.744] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x3da0, lpOverlapped=0x0) returned 1
	[0104.830] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x3db0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x3db0, lpOverlapped=0x0) returned 1
	[0104.832] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.832] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.832] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.832] CloseHandle (hObject=0x1e8) returned 1
	[0104.832] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.832] SetEndOfFile (hFile=0x1c4) returned 1
	[0104.834] CloseHandle (hObject=0x1c4) returned 1
	[0104.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll")) returned 1
	[0104.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0104.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0104.834] lstrlenW (lpString=".doc") returned 4
	[0104.834] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0104.834] lstrlenW (lpString=".docx") returned 5
	[0104.835] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0104.835] lstrlenW (lpString=".pdf") returned 4
	[0104.835] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0104.835] lstrlenW (lpString=".xls") returned 4
	[0104.835] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0104.835] lstrlenW (lpString=".xlsx") returned 5
	[0104.835] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0104.835] lstrlenW (lpString=".ppt") returned 4
	[0104.835] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0104.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0104.835] lstrlenW (lpString=".zip") returned 4
	[0104.835] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0104.835] lstrlenW (lpString=".rar") returned 4
	[0104.835] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0104.835] lstrlenW (lpString=".bz2") returned 4
	[0104.835] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0104.835] lstrlenW (lpString=".7z") returned 3
	[0104.835] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0104.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0104.835] lstrlenW (lpString=".dbf") returned 4
	[0104.835] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0104.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0104.835] lstrlenW (lpString=".1cd") returned 4
	[0104.835] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0104.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0104.835] lstrlenW (lpString=".jpg") returned 4
	[0104.836] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0104.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0104.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0104.836] lstrlenW (lpString=".doc") returned 4
	[0104.836] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0104.836] lstrlenW (lpString=".docx") returned 5
	[0104.836] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0104.836] lstrlenW (lpString=".pdf") returned 4
	[0104.836] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0104.836] lstrlenW (lpString=".xls") returned 4
	[0104.836] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0104.836] lstrlenW (lpString=".xlsx") returned 5
	[0104.836] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0104.836] lstrlenW (lpString=".ppt") returned 4
	[0104.836] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0104.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0104.836] lstrlenW (lpString=".zip") returned 4
	[0104.836] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0104.836] lstrlenW (lpString=".rar") returned 4
	[0104.836] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0104.836] lstrlenW (lpString=".bz2") returned 4
	[0104.836] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0104.836] lstrlenW (lpString=".7z") returned 3
	[0104.837] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0104.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0104.837] lstrlenW (lpString=".dbf") returned 4
	[0104.837] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0104.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0104.837] lstrlenW (lpString=".1cd") returned 4
	[0104.837] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0104.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0104.837] lstrlenW (lpString=".jpg") returned 4
	[0104.837] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0104.837] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0104.837] lstrlenW (lpString="ACCDDSUI.DLL") returned 12
	[0104.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.839] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=21424) returned 1
	[0104.839] CloseHandle (hObject=0x1c4) returned 1
	[0104.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll")) returned 0x20
	[0104.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.840] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.840] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.841] GetLastError () returned 0x0
	[0104.841] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x53b0, lpOverlapped=0x0) returned 1
	[0104.896] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x53c0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x53c0, lpOverlapped=0x0) returned 1
	[0104.898] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.898] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.898] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.898] CloseHandle (hObject=0x1e8) returned 1
	[0104.898] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.898] SetEndOfFile (hFile=0x1c4) returned 1
	[0104.900] CloseHandle (hObject=0x1c4) returned 1
	[0104.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll")) returned 1
	[0104.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0104.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0104.900] lstrlenW (lpString=".doc") returned 4
	[0104.900] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0104.901] lstrlenW (lpString=".docx") returned 5
	[0104.901] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0104.901] lstrlenW (lpString=".pdf") returned 4
	[0104.901] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0104.901] lstrlenW (lpString=".xls") returned 4
	[0104.901] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0104.901] lstrlenW (lpString=".xlsx") returned 5
	[0104.901] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0104.901] lstrlenW (lpString=".ppt") returned 4
	[0104.901] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0104.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0104.901] lstrlenW (lpString=".zip") returned 4
	[0104.901] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0104.901] lstrlenW (lpString=".rar") returned 4
	[0104.901] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0104.901] lstrlenW (lpString=".bz2") returned 4
	[0104.901] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0104.901] lstrlenW (lpString=".7z") returned 3
	[0104.901] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0104.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0104.901] lstrlenW (lpString=".dbf") returned 4
	[0104.901] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0104.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0104.901] lstrlenW (lpString=".1cd") returned 4
	[0104.901] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0104.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0104.901] lstrlenW (lpString=".jpg") returned 4
	[0104.901] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0104.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0104.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0104.902] lstrlenW (lpString=".doc") returned 4
	[0104.902] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0104.902] lstrlenW (lpString=".docx") returned 5
	[0104.902] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0104.902] lstrlenW (lpString=".pdf") returned 4
	[0104.902] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0104.902] lstrlenW (lpString=".xls") returned 4
	[0104.902] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0104.902] lstrlenW (lpString=".xlsx") returned 5
	[0104.902] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0104.902] lstrlenW (lpString=".ppt") returned 4
	[0104.902] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0104.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0104.902] lstrlenW (lpString=".zip") returned 4
	[0104.902] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0104.902] lstrlenW (lpString=".rar") returned 4
	[0104.902] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0104.902] lstrlenW (lpString=".bz2") returned 4
	[0104.902] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0104.902] lstrlenW (lpString=".7z") returned 3
	[0104.902] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0104.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0104.902] lstrlenW (lpString=".dbf") returned 4
	[0104.902] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0104.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0104.902] lstrlenW (lpString=".1cd") returned 4
	[0104.902] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0104.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0104.902] lstrlenW (lpString=".jpg") returned 4
	[0104.902] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0104.903] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0104.903] lstrlenW (lpString="ACCVDTUI.DLL") returned 12
	[0104.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.929] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=158600) returned 1
	[0104.929] CloseHandle (hObject=0x1c4) returned 1
	[0104.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll")) returned 0x20
	[0104.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.937] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.937] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0104.942] GetLastError () returned 0x0
	[0104.942] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x26b88, lpOverlapped=0x0) returned 1
	[0105.085] WriteFile (in: hFile=0x1f0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x26b90, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x26b90, lpOverlapped=0x0) returned 1
	[0105.089] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.089] WriteFile (in: hFile=0x1f0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.090] SetEndOfFile (hFile=0x1f0) returned 1
	[0105.090] CloseHandle (hObject=0x1f0) returned 1
	[0105.090] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.090] SetEndOfFile (hFile=0x1c4) returned 1
	[0105.092] CloseHandle (hObject=0x1c4) returned 1
	[0105.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll")) returned 1
	[0105.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0105.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0105.093] lstrlenW (lpString=".doc") returned 4
	[0105.093] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0105.093] lstrlenW (lpString=".docx") returned 5
	[0105.093] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0105.093] lstrlenW (lpString=".pdf") returned 4
	[0105.093] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0105.093] lstrlenW (lpString=".xls") returned 4
	[0105.093] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0105.093] lstrlenW (lpString=".xlsx") returned 5
	[0105.093] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0105.093] lstrlenW (lpString=".ppt") returned 4
	[0105.093] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0105.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0105.093] lstrlenW (lpString=".zip") returned 4
	[0105.093] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0105.094] lstrlenW (lpString=".rar") returned 4
	[0105.094] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0105.094] lstrlenW (lpString=".bz2") returned 4
	[0105.094] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0105.094] lstrlenW (lpString=".7z") returned 3
	[0105.094] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0105.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0105.094] lstrlenW (lpString=".dbf") returned 4
	[0105.094] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0105.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0105.094] lstrlenW (lpString=".1cd") returned 4
	[0105.094] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0105.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0105.094] lstrlenW (lpString=".jpg") returned 4
	[0105.094] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0105.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0105.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0105.094] lstrlenW (lpString=".doc") returned 4
	[0105.094] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0105.094] lstrlenW (lpString=".docx") returned 5
	[0105.094] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0105.094] lstrlenW (lpString=".pdf") returned 4
	[0105.094] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0105.095] lstrlenW (lpString=".xls") returned 4
	[0105.095] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0105.095] lstrlenW (lpString=".xlsx") returned 5
	[0105.095] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0105.095] lstrlenW (lpString=".ppt") returned 4
	[0105.095] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0105.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0105.095] lstrlenW (lpString=".zip") returned 4
	[0105.095] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0105.095] lstrlenW (lpString=".rar") returned 4
	[0105.095] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0105.095] lstrlenW (lpString=".bz2") returned 4
	[0105.095] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0105.095] lstrlenW (lpString=".7z") returned 3
	[0105.095] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0105.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0105.095] lstrlenW (lpString=".dbf") returned 4
	[0105.095] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0105.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0105.095] lstrlenW (lpString=".1cd") returned 4
	[0105.095] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0105.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0105.095] lstrlenW (lpString=".jpg") returned 4
	[0105.095] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0105.096] lstrcmpiW (lpString1=".VSL", lpString2=".adobe") returned 1
	[0105.096] lstrlenW (lpString="AEC.VSL") returned 7
	[0105.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.114] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=69496) returned 1
	[0105.114] CloseHandle (hObject=0x1d8) returned 1
	[0105.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 0x20
	[0105.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.115] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.115] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.116] GetLastError () returned 0x0
	[0105.117] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x10f78, lpOverlapped=0x0) returned 1
	[0105.121] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x10f80, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x10f80, lpOverlapped=0x0) returned 1
	[0105.123] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.123] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0105.124] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.124] CloseHandle (hObject=0x1f4) returned 1
	[0105.124] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.124] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.126] CloseHandle (hObject=0x1d8) returned 1
	[0105.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 1
	[0105.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0105.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0105.126] lstrlenW (lpString=".doc") returned 4
	[0105.126] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0105.127] lstrlenW (lpString=".docx") returned 5
	[0105.127] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1
	[0105.127] lstrlenW (lpString=".pdf") returned 4
	[0105.127] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0105.127] lstrlenW (lpString=".xls") returned 4
	[0105.127] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0105.127] lstrlenW (lpString=".xlsx") returned 5
	[0105.127] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1
	[0105.127] lstrlenW (lpString=".ppt") returned 4
	[0105.127] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0105.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0105.127] lstrlenW (lpString=".zip") returned 4
	[0105.127] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0105.127] lstrlenW (lpString=".rar") returned 4
	[0105.127] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0105.127] lstrlenW (lpString=".bz2") returned 4
	[0105.127] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0105.127] lstrlenW (lpString=".7z") returned 3
	[0105.127] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0105.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0105.127] lstrlenW (lpString=".dbf") returned 4
	[0105.127] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0105.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0105.127] lstrlenW (lpString=".1cd") returned 4
	[0105.127] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0105.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0105.127] lstrlenW (lpString=".jpg") returned 4
	[0105.128] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0105.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0105.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0105.128] lstrlenW (lpString=".doc") returned 4
	[0105.128] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0105.128] lstrlenW (lpString=".docx") returned 5
	[0105.128] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1
	[0105.128] lstrlenW (lpString=".pdf") returned 4
	[0105.128] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0105.128] lstrlenW (lpString=".xls") returned 4
	[0105.128] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0105.128] lstrlenW (lpString=".xlsx") returned 5
	[0105.128] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1
	[0105.128] lstrlenW (lpString=".ppt") returned 4
	[0105.128] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0105.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0105.128] lstrlenW (lpString=".zip") returned 4
	[0105.128] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0105.128] lstrlenW (lpString=".rar") returned 4
	[0105.128] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0105.128] lstrlenW (lpString=".bz2") returned 4
	[0105.128] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0105.128] lstrlenW (lpString=".7z") returned 3
	[0105.128] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0105.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0105.128] lstrlenW (lpString=".dbf") returned 4
	[0105.128] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0105.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0105.128] lstrlenW (lpString=".1cd") returned 4
	[0105.128] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0105.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0105.129] lstrlenW (lpString=".jpg") returned 4
	[0105.129] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0105.129] lstrcmpiW (lpString1=".VSL", lpString2=".adobe") returned 1
	[0105.129] lstrlenW (lpString="AECUTILS.VSL") returned 12
	[0105.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.158] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=41864) returned 1
	[0105.158] CloseHandle (hObject=0x1dc) returned 1
	[0105.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 0x20
	[0105.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0105.165] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.165] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0105.192] GetLastError () returned 0x0
	[0105.192] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xa388, lpOverlapped=0x0) returned 1
	[0105.221] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xa390, lpOverlapped=0x0) returned 1
	[0105.223] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.223] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.223] SetEndOfFile (hFile=0x1c4) returned 1
	[0105.223] CloseHandle (hObject=0x1c4) returned 1
	[0105.223] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.223] SetEndOfFile (hFile=0x1e0) returned 1
	[0105.225] CloseHandle (hObject=0x1e0) returned 1
	[0105.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 1
	[0105.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0105.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0105.225] lstrlenW (lpString=".doc") returned 4
	[0105.225] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0105.225] lstrlenW (lpString=".docx") returned 5
	[0105.225] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1
	[0105.225] lstrlenW (lpString=".pdf") returned 4
	[0105.225] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0105.225] lstrlenW (lpString=".xls") returned 4
	[0105.225] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0105.226] lstrlenW (lpString=".xlsx") returned 5
	[0105.226] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1
	[0105.226] lstrlenW (lpString=".ppt") returned 4
	[0105.226] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0105.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0105.226] lstrlenW (lpString=".zip") returned 4
	[0105.226] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0105.226] lstrlenW (lpString=".rar") returned 4
	[0105.226] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0105.226] lstrlenW (lpString=".bz2") returned 4
	[0105.226] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0105.226] lstrlenW (lpString=".7z") returned 3
	[0105.226] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0105.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0105.226] lstrlenW (lpString=".dbf") returned 4
	[0105.226] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0105.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0105.226] lstrlenW (lpString=".1cd") returned 4
	[0105.226] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0105.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0105.226] lstrlenW (lpString=".jpg") returned 4
	[0105.226] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0105.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0105.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0105.226] lstrlenW (lpString=".doc") returned 4
	[0105.227] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0105.227] lstrlenW (lpString=".docx") returned 5
	[0105.227] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1
	[0105.227] lstrlenW (lpString=".pdf") returned 4
	[0105.227] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0105.227] lstrlenW (lpString=".xls") returned 4
	[0105.227] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0105.227] lstrlenW (lpString=".xlsx") returned 5
	[0105.227] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1
	[0105.227] lstrlenW (lpString=".ppt") returned 4
	[0105.227] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0105.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0105.227] lstrlenW (lpString=".zip") returned 4
	[0105.227] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0105.227] lstrlenW (lpString=".rar") returned 4
	[0105.227] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0105.227] lstrlenW (lpString=".bz2") returned 4
	[0105.227] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0105.227] lstrlenW (lpString=".7z") returned 3
	[0105.227] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0105.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0105.227] lstrlenW (lpString=".dbf") returned 4
	[0105.227] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0105.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0105.228] lstrlenW (lpString=".1cd") returned 4
	[0105.228] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0105.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0105.228] lstrlenW (lpString=".jpg") returned 4
	[0105.228] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0105.228] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0105.228] lstrlenW (lpString="BCSRuntimeRes.dll") returned 17
	[0105.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0105.229] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=24960) returned 1
	[0105.229] CloseHandle (hObject=0x1e0) returned 1
	[0105.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll")) returned 0x20
	[0105.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0105.230] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.230] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0105.231] GetLastError () returned 0x0
	[0105.231] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x6180, lpOverlapped=0x0) returned 1
	[0105.283] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6190, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x6190, lpOverlapped=0x0) returned 1
	[0105.285] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.285] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0105.285] SetEndOfFile (hFile=0x1c4) returned 1
	[0105.285] CloseHandle (hObject=0x1c4) returned 1
	[0105.285] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.285] SetEndOfFile (hFile=0x1e0) returned 1
	[0105.286] CloseHandle (hObject=0x1e0) returned 1
	[0105.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll")) returned 1
	[0105.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0105.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0105.287] lstrlenW (lpString=".doc") returned 4
	[0105.287] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0105.287] lstrlenW (lpString=".docx") returned 5
	[0105.287] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0105.287] lstrlenW (lpString=".pdf") returned 4
	[0105.287] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0105.287] lstrlenW (lpString=".xls") returned 4
	[0105.287] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0105.287] lstrlenW (lpString=".xlsx") returned 5
	[0105.287] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0105.287] lstrlenW (lpString=".ppt") returned 4
	[0105.287] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0105.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0105.288] lstrlenW (lpString=".zip") returned 4
	[0105.288] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0105.288] lstrlenW (lpString=".rar") returned 4
	[0105.288] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0105.288] lstrlenW (lpString=".bz2") returned 4
	[0105.288] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0105.288] lstrlenW (lpString=".7z") returned 3
	[0105.288] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0105.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0105.288] lstrlenW (lpString=".dbf") returned 4
	[0105.288] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0105.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0105.288] lstrlenW (lpString=".1cd") returned 4
	[0105.288] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0105.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0105.288] lstrlenW (lpString=".jpg") returned 4
	[0105.288] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0105.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0105.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0105.288] lstrlenW (lpString=".doc") returned 4
	[0105.288] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0105.288] lstrlenW (lpString=".docx") returned 5
	[0105.288] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0105.288] lstrlenW (lpString=".pdf") returned 4
	[0105.288] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0105.289] lstrlenW (lpString=".xls") returned 4
	[0105.289] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0105.289] lstrlenW (lpString=".xlsx") returned 5
	[0105.289] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0105.289] lstrlenW (lpString=".ppt") returned 4
	[0105.289] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0105.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0105.289] lstrlenW (lpString=".zip") returned 4
	[0105.289] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0105.289] lstrlenW (lpString=".rar") returned 4
	[0105.289] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0105.289] lstrlenW (lpString=".bz2") returned 4
	[0105.289] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0105.289] lstrlenW (lpString=".7z") returned 3
	[0105.289] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0105.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0105.289] lstrlenW (lpString=".dbf") returned 4
	[0105.289] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0105.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0105.289] lstrlenW (lpString=".1cd") returned 4
	[0105.289] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0105.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0105.289] lstrlenW (lpString=".jpg") returned 4
	[0105.289] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0105.290] lstrcmpiW (lpString1=".VSL", lpString2=".adobe") returned 1
	[0105.290] lstrlenW (lpString="BSTORM.VSL") returned 10
	[0105.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0105.313] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=45968) returned 1
	[0105.313] CloseHandle (hObject=0x1e0) returned 1
	[0105.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 0x20
	[0105.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0105.314] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.314] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0105.315] GetLastError () returned 0x0
	[0105.315] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xb390, lpOverlapped=0x0) returned 1
	[0105.342] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xb3a0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xb3a0, lpOverlapped=0x0) returned 1
	[0105.343] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.344] WriteFile (in: hFile=0x1c4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0105.344] SetEndOfFile (hFile=0x1c4) returned 1
	[0105.344] CloseHandle (hObject=0x1c4) returned 1
	[0105.344] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.344] SetEndOfFile (hFile=0x1e0) returned 1
	[0105.345] CloseHandle (hObject=0x1e0) returned 1
	[0105.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 1
	[0105.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0105.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0105.350] lstrlenW (lpString=".doc") returned 4
	[0105.350] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0105.350] lstrlenW (lpString=".docx") returned 5
	[0105.350] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1
	[0105.350] lstrlenW (lpString=".pdf") returned 4
	[0105.350] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0105.350] lstrlenW (lpString=".xls") returned 4
	[0105.350] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0105.350] lstrlenW (lpString=".xlsx") returned 5
	[0105.351] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1
	[0105.351] lstrlenW (lpString=".ppt") returned 4
	[0105.351] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0105.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0105.351] lstrlenW (lpString=".zip") returned 4
	[0105.351] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0105.351] lstrlenW (lpString=".rar") returned 4
	[0105.351] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0105.351] lstrlenW (lpString=".bz2") returned 4
	[0105.351] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0105.351] lstrlenW (lpString=".7z") returned 3
	[0105.351] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0105.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0105.351] lstrlenW (lpString=".dbf") returned 4
	[0105.351] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0105.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0105.351] lstrlenW (lpString=".1cd") returned 4
	[0105.351] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0105.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0105.351] lstrlenW (lpString=".jpg") returned 4
	[0105.351] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0105.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0105.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0105.351] lstrlenW (lpString=".doc") returned 4
	[0105.352] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0105.352] lstrlenW (lpString=".docx") returned 5
	[0105.352] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1
	[0105.352] lstrlenW (lpString=".pdf") returned 4
	[0105.352] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0105.352] lstrlenW (lpString=".xls") returned 4
	[0105.352] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0105.352] lstrlenW (lpString=".xlsx") returned 5
	[0105.352] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1
	[0105.352] lstrlenW (lpString=".ppt") returned 4
	[0105.352] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0105.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0105.352] lstrlenW (lpString=".zip") returned 4
	[0105.352] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0105.352] lstrlenW (lpString=".rar") returned 4
	[0105.352] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0105.352] lstrlenW (lpString=".bz2") returned 4
	[0105.352] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0105.352] lstrlenW (lpString=".7z") returned 3
	[0105.352] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0105.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0105.352] lstrlenW (lpString=".dbf") returned 4
	[0105.352] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0105.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0105.352] lstrlenW (lpString=".1cd") returned 4
	[0105.352] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0105.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0105.353] lstrlenW (lpString=".jpg") returned 4
	[0105.353] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0105.353] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0105.353] lstrlenW (lpString="CERTINTL.DLL") returned 12
	[0105.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.361] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=12176) returned 1
	[0105.361] CloseHandle (hObject=0x1dc) returned 1
	[0105.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll")) returned 0x20
	[0105.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0105.369] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.369] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0105.376] GetLastError () returned 0x0
	[0105.376] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x2f90, lpOverlapped=0x0) returned 1
	[0105.401] WriteFile (in: hFile=0x1ec, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2fa0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2fa0, lpOverlapped=0x0) returned 1
	[0105.403] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.403] WriteFile (in: hFile=0x1ec, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.403] SetEndOfFile (hFile=0x1ec) returned 1
	[0105.403] CloseHandle (hObject=0x1ec) returned 1
	[0105.403] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.404] SetEndOfFile (hFile=0x1e0) returned 1
	[0105.404] CloseHandle (hObject=0x1e0) returned 1
	[0105.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll")) returned 1
	[0105.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0105.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0105.405] lstrlenW (lpString=".doc") returned 4
	[0105.405] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0105.405] lstrlenW (lpString=".docx") returned 5
	[0105.405] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0105.405] lstrlenW (lpString=".pdf") returned 4
	[0105.405] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0105.405] lstrlenW (lpString=".xls") returned 4
	[0105.405] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0105.405] lstrlenW (lpString=".xlsx") returned 5
	[0105.405] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0105.405] lstrlenW (lpString=".ppt") returned 4
	[0105.406] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0105.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0105.406] lstrlenW (lpString=".zip") returned 4
	[0105.406] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0105.406] lstrlenW (lpString=".rar") returned 4
	[0105.406] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0105.406] lstrlenW (lpString=".bz2") returned 4
	[0105.406] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0105.406] lstrlenW (lpString=".7z") returned 3
	[0105.406] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0105.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0105.406] lstrlenW (lpString=".dbf") returned 4
	[0105.406] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0105.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0105.406] lstrlenW (lpString=".1cd") returned 4
	[0105.406] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0105.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0105.406] lstrlenW (lpString=".jpg") returned 4
	[0105.406] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0105.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0105.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0105.406] lstrlenW (lpString=".doc") returned 4
	[0105.406] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0105.406] lstrlenW (lpString=".docx") returned 5
	[0105.406] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0105.407] lstrlenW (lpString=".pdf") returned 4
	[0105.407] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0105.407] lstrlenW (lpString=".xls") returned 4
	[0105.407] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0105.407] lstrlenW (lpString=".xlsx") returned 5
	[0105.407] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0105.407] lstrlenW (lpString=".ppt") returned 4
	[0105.407] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0105.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0105.407] lstrlenW (lpString=".zip") returned 4
	[0105.407] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0105.407] lstrlenW (lpString=".rar") returned 4
	[0105.407] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0105.407] lstrlenW (lpString=".bz2") returned 4
	[0105.407] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0105.407] lstrlenW (lpString=".7z") returned 3
	[0105.407] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0105.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0105.407] lstrlenW (lpString=".dbf") returned 4
	[0105.407] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0105.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0105.407] lstrlenW (lpString=".1cd") returned 4
	[0105.407] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0105.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0105.407] lstrlenW (lpString=".jpg") returned 4
	[0105.407] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0105.408] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0105.408] lstrlenW (lpString="CMAXRES.DLL") returned 11
	[0105.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.439] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=35216) returned 1
	[0105.439] CloseHandle (hObject=0x1f4) returned 1
	[0105.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll")) returned 0x20
	[0105.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0105.449] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.449] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.454] GetLastError () returned 0x0
	[0105.454] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x8990, lpOverlapped=0x0) returned 1
	[0105.489] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x89a0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x89a0, lpOverlapped=0x0) returned 1
	[0105.491] ReadFile (in: hFile=0x1c4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.491] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.491] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.491] CloseHandle (hObject=0x1d8) returned 1
	[0105.491] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.491] SetEndOfFile (hFile=0x1c4) returned 1
	[0105.492] CloseHandle (hObject=0x1c4) returned 1
	[0105.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll")) returned 1
	[0105.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0105.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0105.510] lstrlenW (lpString=".doc") returned 4
	[0105.510] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0105.510] lstrlenW (lpString=".docx") returned 5
	[0105.510] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0105.510] lstrlenW (lpString=".pdf") returned 4
	[0105.510] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0105.510] lstrlenW (lpString=".xls") returned 4
	[0105.510] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0105.511] lstrlenW (lpString=".xlsx") returned 5
	[0105.511] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0105.511] lstrlenW (lpString=".ppt") returned 4
	[0105.511] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0105.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0105.511] lstrlenW (lpString=".zip") returned 4
	[0105.511] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0105.511] lstrlenW (lpString=".rar") returned 4
	[0105.511] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0105.511] lstrlenW (lpString=".bz2") returned 4
	[0105.511] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0105.511] lstrlenW (lpString=".7z") returned 3
	[0105.511] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0105.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0105.511] lstrlenW (lpString=".dbf") returned 4
	[0105.511] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0105.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0105.511] lstrlenW (lpString=".1cd") returned 4
	[0105.511] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0105.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0105.511] lstrlenW (lpString=".jpg") returned 4
	[0105.511] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0105.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0105.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0105.512] lstrlenW (lpString=".doc") returned 4
	[0105.512] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0105.512] lstrlenW (lpString=".docx") returned 5
	[0105.512] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0105.512] lstrlenW (lpString=".pdf") returned 4
	[0105.512] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0105.512] lstrlenW (lpString=".xls") returned 4
	[0105.512] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0105.512] lstrlenW (lpString=".xlsx") returned 5
	[0105.512] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0105.512] lstrlenW (lpString=".ppt") returned 4
	[0105.512] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0105.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0105.512] lstrlenW (lpString=".zip") returned 4
	[0105.512] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0105.512] lstrlenW (lpString=".rar") returned 4
	[0105.512] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0105.512] lstrlenW (lpString=".bz2") returned 4
	[0105.512] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0105.512] lstrlenW (lpString=".7z") returned 3
	[0105.512] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0105.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0105.512] lstrlenW (lpString=".dbf") returned 4
	[0105.512] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0105.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0105.512] lstrlenW (lpString=".1cd") returned 4
	[0105.512] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0105.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0105.513] lstrlenW (lpString=".jpg") returned 4
	[0105.513] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0105.513] lstrcmpiW (lpString1=".VSL", lpString2=".adobe") returned 1
	[0105.513] lstrlenW (lpString="DBWIZ.VSL") returned 9
	[0105.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.525] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=164216) returned 1
	[0105.525] CloseHandle (hObject=0x1dc) returned 1
	[0105.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 0x20
	[0105.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.532] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.532] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0105.537] GetLastError () returned 0x0
	[0105.537] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x28178, lpOverlapped=0x0) returned 1
	[0105.561] WriteFile (in: hFile=0x1f0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x28180, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x28180, lpOverlapped=0x0) returned 1
	[0105.564] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.564] WriteFile (in: hFile=0x1f0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0105.564] SetEndOfFile (hFile=0x1f0) returned 1
	[0105.564] CloseHandle (hObject=0x1f0) returned 1
	[0105.564] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.564] SetEndOfFile (hFile=0x1e8) returned 1
	[0105.566] CloseHandle (hObject=0x1e8) returned 1
	[0105.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 1
	[0105.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0105.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0105.588] lstrlenW (lpString=".doc") returned 4
	[0105.588] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0105.588] lstrlenW (lpString=".docx") returned 5
	[0105.588] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1
	[0105.588] lstrlenW (lpString=".pdf") returned 4
	[0105.588] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0105.588] lstrlenW (lpString=".xls") returned 4
	[0105.588] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0105.588] lstrlenW (lpString=".xlsx") returned 5
	[0105.588] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1
	[0105.588] lstrlenW (lpString=".ppt") returned 4
	[0105.589] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0105.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0105.589] lstrlenW (lpString=".zip") returned 4
	[0105.589] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0105.589] lstrlenW (lpString=".rar") returned 4
	[0105.589] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0105.589] lstrlenW (lpString=".bz2") returned 4
	[0105.589] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0105.589] lstrlenW (lpString=".7z") returned 3
	[0105.589] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0105.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0105.589] lstrlenW (lpString=".dbf") returned 4
	[0105.589] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0105.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0105.589] lstrlenW (lpString=".1cd") returned 4
	[0105.589] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0105.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0105.589] lstrlenW (lpString=".jpg") returned 4
	[0105.589] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0105.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0105.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0105.589] lstrlenW (lpString=".doc") returned 4
	[0105.589] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0105.590] lstrlenW (lpString=".docx") returned 5
	[0105.590] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1
	[0105.590] lstrlenW (lpString=".pdf") returned 4
	[0105.590] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0105.590] lstrlenW (lpString=".xls") returned 4
	[0105.590] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0105.590] lstrlenW (lpString=".xlsx") returned 5
	[0105.590] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1
	[0105.590] lstrlenW (lpString=".ppt") returned 4
	[0105.590] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0105.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0105.590] lstrlenW (lpString=".zip") returned 4
	[0105.590] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0105.590] lstrlenW (lpString=".rar") returned 4
	[0105.590] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0105.590] lstrlenW (lpString=".bz2") returned 4
	[0105.590] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0105.590] lstrlenW (lpString=".7z") returned 3
	[0105.590] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0105.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0105.591] lstrlenW (lpString=".dbf") returned 4
	[0105.591] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0105.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0105.591] lstrlenW (lpString=".1cd") returned 4
	[0105.591] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0105.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0105.591] lstrlenW (lpString=".jpg") returned 4
	[0105.591] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0105.591] lstrcmpiW (lpString1=".gta", lpString2=".adobe") returned 1
	[0105.591] lstrlenW (lpString="Discussion14.gta") returned 16
	[0105.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.612] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=362441) returned 1
	[0105.612] CloseHandle (hObject=0x1f4) returned 1
	[0105.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 0x20
	[0105.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.618] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.618] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.622] GetLastError () returned 0x0
	[0105.622] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x587c9, lpOverlapped=0x0) returned 1
	[0105.634] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x587d0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x587d0, lpOverlapped=0x0) returned 1
	[0105.642] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.643] WriteFile (in: hFile=0x1dc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0105.643] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.643] CloseHandle (hObject=0x1dc) returned 1
	[0105.643] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.643] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.647] CloseHandle (hObject=0x1f4) returned 1
	[0105.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 1
	[0105.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0105.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0105.648] lstrlenW (lpString=".doc") returned 4
	[0105.648] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1
	[0105.648] lstrlenW (lpString=".docx") returned 5
	[0105.648] lstrcmpiW (lpString1=".docx", lpString2="4.gta") returned -1
	[0105.648] lstrlenW (lpString=".pdf") returned 4
	[0105.648] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1
	[0105.648] lstrlenW (lpString=".xls") returned 4
	[0105.648] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1
	[0105.648] lstrlenW (lpString=".xlsx") returned 5
	[0105.648] lstrcmpiW (lpString1=".xlsx", lpString2="4.gta") returned -1
	[0105.648] lstrlenW (lpString=".ppt") returned 4
	[0105.648] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1
	[0105.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0105.648] lstrlenW (lpString=".zip") returned 4
	[0105.648] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1
	[0105.648] lstrlenW (lpString=".rar") returned 4
	[0105.648] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1
	[0105.648] lstrlenW (lpString=".bz2") returned 4
	[0105.648] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1
	[0105.648] lstrlenW (lpString=".7z") returned 3
	[0105.648] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1
	[0105.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0105.648] lstrlenW (lpString=".dbf") returned 4
	[0105.648] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1
	[0105.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0105.649] lstrlenW (lpString=".1cd") returned 4
	[0105.649] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1
	[0105.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0105.649] lstrlenW (lpString=".jpg") returned 4
	[0105.649] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1
	[0105.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0105.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0105.649] lstrlenW (lpString=".doc") returned 4
	[0105.649] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1
	[0105.649] lstrlenW (lpString=".docx") returned 5
	[0105.649] lstrcmpiW (lpString1=".docx", lpString2="4.gta") returned -1
	[0105.649] lstrlenW (lpString=".pdf") returned 4
	[0105.649] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1
	[0105.649] lstrlenW (lpString=".xls") returned 4
	[0105.649] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1
	[0105.649] lstrlenW (lpString=".xlsx") returned 5
	[0105.649] lstrcmpiW (lpString1=".xlsx", lpString2="4.gta") returned -1
	[0105.649] lstrlenW (lpString=".ppt") returned 4
	[0105.649] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1
	[0105.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0105.649] lstrlenW (lpString=".zip") returned 4
	[0105.649] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1
	[0105.649] lstrlenW (lpString=".rar") returned 4
	[0105.649] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1
	[0105.649] lstrlenW (lpString=".bz2") returned 4
	[0105.649] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1
	[0105.649] lstrlenW (lpString=".7z") returned 3
	[0105.649] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1
	[0105.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0105.650] lstrlenW (lpString=".dbf") returned 4
	[0105.650] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1
	[0105.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0105.650] lstrlenW (lpString=".1cd") returned 4
	[0105.650] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1
	[0105.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0105.650] lstrlenW (lpString=".jpg") returned 4
	[0105.650] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1
	[0105.650] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0105.650] lstrlenW (lpString="DL_RES.DLL") returned 10
	[0105.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 56
	os_tid = 0xb90

	[0073.173] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x6a0628
	[0073.173] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x6b0630
	[0073.174] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630950
	[0073.174] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x6c0650
	[0073.174] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630968
	[0073.174] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3640020
	[0073.174] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630980
	[0073.174] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630980, Size=0x20) returned 0x6162d8
	[0073.174] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630980
	[0073.174] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630980, Size=0x20) returned 0x6162b0
	[0073.174] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0073.174] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0073.174] Wow64DisableWow64FsRedirection (in: OldValue=0x2c9ff58 | out: OldValue=0x2c9ff58*=0x0) returned 1
	[0073.174] lstrlenW (lpString="kernel32.dll") returned 12
	[0073.175] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162d8 | out: hHeap=0x5e0000) returned 1
	[0073.175] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0073.175] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162b0 | out: hHeap=0x5e0000) returned 1
	[0073.175] Sleep (dwMilliseconds=0x64) 
	[0073.724] Sleep (dwMilliseconds=0x64) 
	[0074.271] lstrcmpiW (lpString1=".BAK", lpString2=".adobe") returned 1
	[0074.271] lstrlenW (lpString="BOOTSECT.BAK") returned 12
	[0074.271] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0074.438] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=8192) returned 1
	[0074.438] CloseHandle (hObject=0x160) returned 1
	[0074.438] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27
	[0074.438] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\bootsect.bak.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.438] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1
	[0074.438] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0074.438] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.439] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.439] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\bootsect.bak.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0074.439] GetLastError () returned 0x0
	[0074.439] ReadFile (in: hFile=0x160, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x2000, lpOverlapped=0x0) returned 1
	[0074.455] WriteFile (in: hFile=0x16c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2010, lpOverlapped=0x0) returned 1
	[0074.456] ReadFile (in: hFile=0x160, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0074.456] WriteFile (in: hFile=0x16c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0074.456] SetEndOfFile (hFile=0x16c) returned 1
	[0074.456] CloseHandle (hObject=0x16c) returned 1
	[0074.459] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.459] SetEndOfFile (hFile=0x160) returned 1
	[0074.460] CloseHandle (hObject=0x160) returned 1
	[0074.461] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x27) returned 1
	[0074.461] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1
	[0074.461] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0074.461] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0074.461] lstrlenW (lpString=".doc") returned 4
	[0074.461] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1
	[0074.461] lstrlenW (lpString=".docx") returned 5
	[0074.462] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1
	[0074.462] lstrlenW (lpString=".pdf") returned 4
	[0074.462] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1
	[0074.462] lstrlenW (lpString=".xls") returned 4
	[0074.462] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1
	[0074.462] lstrlenW (lpString=".xlsx") returned 5
	[0074.462] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1
	[0074.462] lstrlenW (lpString=".ppt") returned 4
	[0074.462] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1
	[0074.462] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0074.462] lstrlenW (lpString=".zip") returned 4
	[0074.462] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1
	[0074.462] lstrlenW (lpString=".rar") returned 4
	[0074.462] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1
	[0074.462] lstrlenW (lpString=".bz2") returned 4
	[0074.462] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1
	[0074.462] lstrlenW (lpString=".7z") returned 3
	[0074.462] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1
	[0074.462] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0074.462] lstrlenW (lpString=".dbf") returned 4
	[0074.462] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1
	[0074.462] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0074.462] lstrlenW (lpString=".1cd") returned 4
	[0074.462] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1
	[0074.462] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0074.463] lstrlenW (lpString=".jpg") returned 4
	[0074.463] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1
	[0074.463] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0074.463] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0074.463] lstrlenW (lpString=".doc") returned 4
	[0074.463] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1
	[0074.463] lstrlenW (lpString=".docx") returned 5
	[0074.463] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1
	[0074.463] lstrlenW (lpString=".pdf") returned 4
	[0074.463] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1
	[0074.463] lstrlenW (lpString=".xls") returned 4
	[0074.463] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1
	[0074.463] lstrlenW (lpString=".xlsx") returned 5
	[0074.463] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1
	[0074.463] lstrlenW (lpString=".ppt") returned 4
	[0074.463] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1
	[0074.463] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0074.463] lstrlenW (lpString=".zip") returned 4
	[0074.463] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1
	[0074.463] lstrlenW (lpString=".rar") returned 4
	[0074.463] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1
	[0074.463] lstrlenW (lpString=".bz2") returned 4
	[0074.463] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1
	[0074.463] lstrlenW (lpString=".7z") returned 3
	[0074.463] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1
	[0074.463] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0074.463] lstrlenW (lpString=".dbf") returned 4
	[0074.463] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1
	[0074.464] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0074.464] lstrlenW (lpString=".1cd") returned 4
	[0074.464] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1
	[0074.464] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0074.464] lstrlenW (lpString=".jpg") returned 4
	[0074.464] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1
	[0074.464] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0074.464] lstrlenW (lpString="Setup.xml") returned 9
	[0074.464] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0075.646] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2296) returned 1
	[0075.646] CloseHandle (hObject=0x160) returned 1
	[0075.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0075.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.715] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0075.715] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.715] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.715] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.749] GetLastError () returned 0x0
	[0075.749] ReadFile (in: hFile=0x160, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x8f8, lpOverlapped=0x0) returned 1
	[0075.758] WriteFile (in: hFile=0x1ac, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x900, lpOverlapped=0x0) returned 1
	[0075.759] ReadFile (in: hFile=0x160, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0075.759] WriteFile (in: hFile=0x1ac, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0075.760] SetEndOfFile (hFile=0x1ac) returned 1
	[0075.773] CloseHandle (hObject=0x1ac) returned 1
	[0075.775] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.775] SetEndOfFile (hFile=0x160) returned 1
	[0075.780] CloseHandle (hObject=0x160) returned 1
	[0075.791] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.812] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0075.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.853] lstrlenW (lpString=".doc") returned 4
	[0075.853] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.853] lstrlenW (lpString=".docx") returned 5
	[0075.853] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0075.853] lstrlenW (lpString=".pdf") returned 4
	[0075.853] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.853] lstrlenW (lpString=".xls") returned 4
	[0075.853] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.853] lstrlenW (lpString=".xlsx") returned 5
	[0075.853] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0075.853] lstrlenW (lpString=".ppt") returned 4
	[0075.853] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.853] lstrlenW (lpString=".zip") returned 4
	[0075.853] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.853] lstrlenW (lpString=".rar") returned 4
	[0075.853] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.853] lstrlenW (lpString=".bz2") returned 4
	[0075.853] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.853] lstrlenW (lpString=".7z") returned 3
	[0075.853] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.853] lstrlenW (lpString=".dbf") returned 4
	[0075.853] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.853] lstrlenW (lpString=".1cd") returned 4
	[0075.853] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.854] lstrlenW (lpString=".jpg") returned 4
	[0075.854] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.854] lstrlenW (lpString=".doc") returned 4
	[0075.854] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.854] lstrlenW (lpString=".docx") returned 5
	[0075.854] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0075.854] lstrlenW (lpString=".pdf") returned 4
	[0075.854] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.854] lstrlenW (lpString=".xls") returned 4
	[0075.854] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.854] lstrlenW (lpString=".xlsx") returned 5
	[0075.854] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0075.854] lstrlenW (lpString=".ppt") returned 4
	[0075.854] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.854] lstrlenW (lpString=".zip") returned 4
	[0075.854] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.854] lstrlenW (lpString=".rar") returned 4
	[0075.854] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.854] lstrlenW (lpString=".bz2") returned 4
	[0075.854] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.854] lstrlenW (lpString=".7z") returned 3
	[0075.854] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.854] lstrlenW (lpString=".dbf") returned 4
	[0075.854] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.854] lstrlenW (lpString=".1cd") returned 4
	[0075.855] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.855] lstrlenW (lpString=".jpg") returned 4
	[0075.855] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.855] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0075.855] lstrlenW (lpString="Proof.xml") returned 9
	[0075.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.855] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1458) returned 1
	[0075.855] CloseHandle (hObject=0x1ac) returned 1
	[0075.855] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020
	[0075.855] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.856] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.856] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.856] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.856] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0075.856] GetLastError () returned 0x0
	[0075.856] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x5b2, lpOverlapped=0x0) returned 1
	[0075.894] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0075.895] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0075.895] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0075.895] SetEndOfFile (hFile=0x194) returned 1
	[0075.896] CloseHandle (hObject=0x194) returned 1
	[0075.902] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.902] SetEndOfFile (hFile=0x1ac) returned 1
	[0075.903] CloseHandle (hObject=0x1ac) returned 1
	[0075.903] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.904] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1
	[0075.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0075.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0075.904] lstrlenW (lpString=".doc") returned 4
	[0075.904] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.904] lstrlenW (lpString=".docx") returned 5
	[0075.904] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0075.904] lstrlenW (lpString=".pdf") returned 4
	[0075.904] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.904] lstrlenW (lpString=".xls") returned 4
	[0075.904] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.905] lstrlenW (lpString=".xlsx") returned 5
	[0075.905] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0075.905] lstrlenW (lpString=".ppt") returned 4
	[0075.905] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0075.905] lstrlenW (lpString=".zip") returned 4
	[0075.905] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.905] lstrlenW (lpString=".rar") returned 4
	[0075.905] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.905] lstrlenW (lpString=".bz2") returned 4
	[0075.905] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.905] lstrlenW (lpString=".7z") returned 3
	[0075.905] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0075.905] lstrlenW (lpString=".dbf") returned 4
	[0075.905] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0075.905] lstrlenW (lpString=".1cd") returned 4
	[0075.905] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0075.905] lstrlenW (lpString=".jpg") returned 4
	[0075.905] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0075.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0075.905] lstrlenW (lpString=".doc") returned 4
	[0075.905] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.905] lstrlenW (lpString=".docx") returned 5
	[0075.906] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0075.906] lstrlenW (lpString=".pdf") returned 4
	[0075.906] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.906] lstrlenW (lpString=".xls") returned 4
	[0075.906] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.906] lstrlenW (lpString=".xlsx") returned 5
	[0075.906] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0075.906] lstrlenW (lpString=".ppt") returned 4
	[0075.906] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0075.906] lstrlenW (lpString=".zip") returned 4
	[0075.906] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.906] lstrlenW (lpString=".rar") returned 4
	[0075.906] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.906] lstrlenW (lpString=".bz2") returned 4
	[0075.906] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.906] lstrlenW (lpString=".7z") returned 3
	[0075.906] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0075.906] lstrlenW (lpString=".dbf") returned 4
	[0075.906] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0075.906] lstrlenW (lpString=".1cd") returned 4
	[0075.906] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0075.906] lstrlenW (lpString=".jpg") returned 4
	[0075.906] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.907] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0075.907] lstrlenW (lpString="Setup.xml") returned 9
	[0075.907] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.907] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5884) returned 1
	[0075.907] CloseHandle (hObject=0x1ac) returned 1
	[0075.907] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0075.907] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.908] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.908] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.908] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.908] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0075.908] GetLastError () returned 0x0
	[0075.908] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x16fc, lpOverlapped=0x0) returned 1
	[0075.968] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1700, lpOverlapped=0x0) returned 1
	[0075.969] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0075.969] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0075.969] SetEndOfFile (hFile=0x194) returned 1
	[0075.970] CloseHandle (hObject=0x194) returned 1
	[0075.971] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.971] SetEndOfFile (hFile=0x1ac) returned 1
	[0075.972] CloseHandle (hObject=0x1ac) returned 1
	[0075.972] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.972] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0075.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.972] lstrlenW (lpString=".doc") returned 4
	[0075.972] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.972] lstrlenW (lpString=".docx") returned 5
	[0075.972] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0075.972] lstrlenW (lpString=".pdf") returned 4
	[0075.972] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.973] lstrlenW (lpString=".xls") returned 4
	[0075.973] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.973] lstrlenW (lpString=".xlsx") returned 5
	[0075.973] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0075.973] lstrlenW (lpString=".ppt") returned 4
	[0075.973] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.973] lstrlenW (lpString=".zip") returned 4
	[0075.973] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.973] lstrlenW (lpString=".rar") returned 4
	[0075.973] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.973] lstrlenW (lpString=".bz2") returned 4
	[0075.973] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.973] lstrlenW (lpString=".7z") returned 3
	[0075.973] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.973] lstrlenW (lpString=".dbf") returned 4
	[0075.973] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.973] lstrlenW (lpString=".1cd") returned 4
	[0075.973] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.973] lstrlenW (lpString=".jpg") returned 4
	[0075.973] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.973] lstrlenW (lpString=".doc") returned 4
	[0075.973] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.973] lstrlenW (lpString=".docx") returned 5
	[0075.973] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0075.973] lstrlenW (lpString=".pdf") returned 4
	[0075.973] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.974] lstrlenW (lpString=".xls") returned 4
	[0075.974] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.974] lstrlenW (lpString=".xlsx") returned 5
	[0075.974] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0075.974] lstrlenW (lpString=".ppt") returned 4
	[0075.974] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.974] lstrlenW (lpString=".zip") returned 4
	[0075.974] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.974] lstrlenW (lpString=".rar") returned 4
	[0075.974] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.974] lstrlenW (lpString=".bz2") returned 4
	[0075.974] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.974] lstrlenW (lpString=".7z") returned 3
	[0075.974] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.974] lstrlenW (lpString=".dbf") returned 4
	[0075.974] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.974] lstrlenW (lpString=".1cd") returned 4
	[0075.974] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.974] lstrlenW (lpString=".jpg") returned 4
	[0075.974] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.974] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0075.974] lstrlenW (lpString="InfoPathMUI.xml") returned 15
	[0075.975] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.976] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1231) returned 1
	[0075.976] CloseHandle (hObject=0x1ac) returned 1
	[0075.976] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020
	[0075.976] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.976] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.976] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.976] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.976] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0075.976] GetLastError () returned 0x0
	[0075.976] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x4cf, lpOverlapped=0x0) returned 1
	[0076.054] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4d0, lpOverlapped=0x0) returned 1
	[0076.055] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0076.056] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0076.056] SetEndOfFile (hFile=0x194) returned 1
	[0076.056] CloseHandle (hObject=0x194) returned 1
	[0076.057] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.057] SetEndOfFile (hFile=0x1ac) returned 1
	[0076.058] CloseHandle (hObject=0x1ac) returned 1
	[0076.058] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0076.058] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1
	[0076.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0076.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0076.059] lstrlenW (lpString=".doc") returned 4
	[0076.059] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0076.059] lstrlenW (lpString=".docx") returned 5
	[0076.059] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0076.059] lstrlenW (lpString=".pdf") returned 4
	[0076.059] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0076.059] lstrlenW (lpString=".xls") returned 4
	[0076.059] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0076.059] lstrlenW (lpString=".xlsx") returned 5
	[0076.059] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0076.059] lstrlenW (lpString=".ppt") returned 4
	[0076.059] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0076.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0076.059] lstrlenW (lpString=".zip") returned 4
	[0076.059] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0076.059] lstrlenW (lpString=".rar") returned 4
	[0076.059] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0076.059] lstrlenW (lpString=".bz2") returned 4
	[0076.059] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0076.059] lstrlenW (lpString=".7z") returned 3
	[0076.060] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0076.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0076.060] lstrlenW (lpString=".dbf") returned 4
	[0076.060] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0076.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0076.060] lstrlenW (lpString=".1cd") returned 4
	[0076.060] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0076.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0076.060] lstrlenW (lpString=".jpg") returned 4
	[0076.060] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0076.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0076.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0076.060] lstrlenW (lpString=".doc") returned 4
	[0076.060] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0076.060] lstrlenW (lpString=".docx") returned 5
	[0076.060] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0076.060] lstrlenW (lpString=".pdf") returned 4
	[0076.060] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0076.060] lstrlenW (lpString=".xls") returned 4
	[0076.060] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0076.060] lstrlenW (lpString=".xlsx") returned 5
	[0076.060] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0076.060] lstrlenW (lpString=".ppt") returned 4
	[0076.060] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0076.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0076.061] lstrlenW (lpString=".zip") returned 4
	[0076.061] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0076.061] lstrlenW (lpString=".rar") returned 4
	[0076.061] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0076.061] lstrlenW (lpString=".bz2") returned 4
	[0076.061] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0076.061] lstrlenW (lpString=".7z") returned 3
	[0076.061] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0076.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0076.061] lstrlenW (lpString=".dbf") returned 4
	[0076.061] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0076.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0076.061] lstrlenW (lpString=".1cd") returned 4
	[0076.061] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0076.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0076.061] lstrlenW (lpString=".jpg") returned 4
	[0076.061] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0076.061] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0076.061] lstrlenW (lpString="OneNoteMUI.xml") returned 14
	[0076.061] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0076.063] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1606) returned 1
	[0076.063] CloseHandle (hObject=0x1ac) returned 1
	[0076.063] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020
	[0076.063] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0076.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0076.063] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.063] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0076.064] GetLastError () returned 0x0
	[0076.064] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x646, lpOverlapped=0x0) returned 1
	[0076.142] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x650, lpOverlapped=0x0) returned 1
	[0076.143] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0076.143] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0076.143] SetEndOfFile (hFile=0x194) returned 1
	[0076.143] CloseHandle (hObject=0x194) returned 1
	[0076.144] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.144] SetEndOfFile (hFile=0x1ac) returned 1
	[0076.145] CloseHandle (hObject=0x1ac) returned 1
	[0076.145] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0076.145] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1
	[0076.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0076.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0076.169] lstrlenW (lpString=".doc") returned 4
	[0076.169] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0076.169] lstrlenW (lpString=".docx") returned 5
	[0076.169] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0076.169] lstrlenW (lpString=".pdf") returned 4
	[0076.169] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0076.169] lstrlenW (lpString=".xls") returned 4
	[0076.169] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0076.169] lstrlenW (lpString=".xlsx") returned 5
	[0076.169] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0076.169] lstrlenW (lpString=".ppt") returned 4
	[0076.169] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0076.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0076.169] lstrlenW (lpString=".zip") returned 4
	[0076.169] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0076.169] lstrlenW (lpString=".rar") returned 4
	[0076.169] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0076.169] lstrlenW (lpString=".bz2") returned 4
	[0076.169] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0076.169] lstrlenW (lpString=".7z") returned 3
	[0076.169] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0076.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0076.169] lstrlenW (lpString=".dbf") returned 4
	[0076.169] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0076.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0076.170] lstrlenW (lpString=".1cd") returned 4
	[0076.170] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0076.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0076.170] lstrlenW (lpString=".jpg") returned 4
	[0076.170] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0076.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0076.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0076.170] lstrlenW (lpString=".doc") returned 4
	[0076.170] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0076.170] lstrlenW (lpString=".docx") returned 5
	[0076.170] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0076.170] lstrlenW (lpString=".pdf") returned 4
	[0076.170] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0076.170] lstrlenW (lpString=".xls") returned 4
	[0076.170] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0076.170] lstrlenW (lpString=".xlsx") returned 5
	[0076.170] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0076.170] lstrlenW (lpString=".ppt") returned 4
	[0076.170] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0076.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0076.170] lstrlenW (lpString=".zip") returned 4
	[0076.170] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0076.170] lstrlenW (lpString=".rar") returned 4
	[0076.170] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0076.170] lstrlenW (lpString=".bz2") returned 4
	[0076.170] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0076.171] lstrlenW (lpString=".7z") returned 3
	[0076.171] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0076.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0076.171] lstrlenW (lpString=".dbf") returned 4
	[0076.171] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0076.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0076.171] lstrlenW (lpString=".1cd") returned 4
	[0076.171] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0076.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0076.171] lstrlenW (lpString=".jpg") returned 4
	[0076.171] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0076.171] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0076.171] lstrlenW (lpString="ProjectMUI.xml") returned 14
	[0076.171] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0076.253] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1452) returned 1
	[0076.253] CloseHandle (hObject=0x19c) returned 1
	[0076.253] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020
	[0076.253] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0076.253] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0076.253] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.253] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.253] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0076.254] GetLastError () returned 0x0
	[0076.254] ReadFile (in: hFile=0x19c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x5ac, lpOverlapped=0x0) returned 1
	[0076.363] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0076.364] ReadFile (in: hFile=0x19c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0076.364] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0076.364] SetEndOfFile (hFile=0x1b0) returned 1
	[0076.364] CloseHandle (hObject=0x1b0) returned 1
	[0076.365] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.365] SetEndOfFile (hFile=0x19c) returned 1
	[0076.366] CloseHandle (hObject=0x19c) returned 1
	[0076.366] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0076.366] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1
	[0076.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0076.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0076.366] lstrlenW (lpString=".doc") returned 4
	[0076.366] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0076.366] lstrlenW (lpString=".docx") returned 5
	[0076.366] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0076.366] lstrlenW (lpString=".pdf") returned 4
	[0076.366] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0076.367] lstrlenW (lpString=".xls") returned 4
	[0076.367] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0076.367] lstrlenW (lpString=".xlsx") returned 5
	[0076.367] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0076.367] lstrlenW (lpString=".ppt") returned 4
	[0076.367] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0076.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0076.367] lstrlenW (lpString=".zip") returned 4
	[0076.367] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0076.367] lstrlenW (lpString=".rar") returned 4
	[0076.367] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0076.367] lstrlenW (lpString=".bz2") returned 4
	[0076.367] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0076.367] lstrlenW (lpString=".7z") returned 3
	[0076.367] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0076.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0076.367] lstrlenW (lpString=".dbf") returned 4
	[0076.367] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0076.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0076.367] lstrlenW (lpString=".1cd") returned 4
	[0076.367] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0076.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0076.367] lstrlenW (lpString=".jpg") returned 4
	[0076.367] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0076.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0076.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0076.367] lstrlenW (lpString=".doc") returned 4
	[0076.367] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0076.367] lstrlenW (lpString=".docx") returned 5
	[0076.368] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0076.368] lstrlenW (lpString=".pdf") returned 4
	[0076.368] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0076.368] lstrlenW (lpString=".xls") returned 4
	[0076.368] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0076.368] lstrlenW (lpString=".xlsx") returned 5
	[0076.368] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0076.368] lstrlenW (lpString=".ppt") returned 4
	[0076.368] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0076.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0076.368] lstrlenW (lpString=".zip") returned 4
	[0076.368] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0076.368] lstrlenW (lpString=".rar") returned 4
	[0076.368] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0076.368] lstrlenW (lpString=".bz2") returned 4
	[0076.368] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0076.368] lstrlenW (lpString=".7z") returned 3
	[0076.368] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0076.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0076.368] lstrlenW (lpString=".dbf") returned 4
	[0076.368] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0076.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0076.368] lstrlenW (lpString=".1cd") returned 4
	[0076.368] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0076.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0076.368] lstrlenW (lpString=".jpg") returned 4
	[0076.368] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0076.368] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0076.368] lstrlenW (lpString="GrooveMUI.xml") returned 13
	[0076.369] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0077.854] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=913) returned 1
	[0077.854] CloseHandle (hObject=0x19c) returned 1
	[0077.854] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020
	[0078.682] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0078.682] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0078.696] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.696] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.696] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0078.767] GetLastError () returned 0x0
	[0078.767] ReadFile (in: hFile=0x174, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x391, lpOverlapped=0x0) returned 1
	[0078.834] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3a0, lpOverlapped=0x0) returned 1
	[0078.835] ReadFile (in: hFile=0x174, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0078.835] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0078.835] SetEndOfFile (hFile=0x194) returned 1
	[0078.835] CloseHandle (hObject=0x194) returned 1
	[0078.836] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.836] SetEndOfFile (hFile=0x174) returned 1
	[0078.837] CloseHandle (hObject=0x174) returned 1
	[0078.837] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0078.837] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1
	[0078.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0078.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0078.838] lstrlenW (lpString=".doc") returned 4
	[0078.838] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.838] lstrlenW (lpString=".docx") returned 5
	[0078.838] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0078.838] lstrlenW (lpString=".pdf") returned 4
	[0078.838] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.838] lstrlenW (lpString=".xls") returned 4
	[0078.838] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.838] lstrlenW (lpString=".xlsx") returned 5
	[0078.838] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0078.838] lstrlenW (lpString=".ppt") returned 4
	[0078.838] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0078.838] lstrlenW (lpString=".zip") returned 4
	[0078.838] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.838] lstrlenW (lpString=".rar") returned 4
	[0078.838] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.838] lstrlenW (lpString=".bz2") returned 4
	[0078.838] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.838] lstrlenW (lpString=".7z") returned 3
	[0078.838] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0078.838] lstrlenW (lpString=".dbf") returned 4
	[0078.838] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0078.838] lstrlenW (lpString=".1cd") returned 4
	[0078.838] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0078.839] lstrlenW (lpString=".jpg") returned 4
	[0078.839] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0078.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0078.839] lstrlenW (lpString=".doc") returned 4
	[0078.839] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.839] lstrlenW (lpString=".docx") returned 5
	[0078.839] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0078.839] lstrlenW (lpString=".pdf") returned 4
	[0078.839] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.839] lstrlenW (lpString=".xls") returned 4
	[0078.839] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.839] lstrlenW (lpString=".xlsx") returned 5
	[0078.839] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0078.839] lstrlenW (lpString=".ppt") returned 4
	[0078.839] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0078.839] lstrlenW (lpString=".zip") returned 4
	[0078.839] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.839] lstrlenW (lpString=".rar") returned 4
	[0078.839] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.839] lstrlenW (lpString=".bz2") returned 4
	[0078.839] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.839] lstrlenW (lpString=".7z") returned 3
	[0078.839] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0078.839] lstrlenW (lpString=".dbf") returned 4
	[0078.839] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0078.839] lstrlenW (lpString=".1cd") returned 4
	[0078.839] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0078.840] lstrlenW (lpString=".jpg") returned 4
	[0078.840] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.840] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0078.840] lstrlenW (lpString="OfficeMUISet.xml") returned 16
	[0078.840] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0080.236] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=819) returned 1
	[0080.236] CloseHandle (hObject=0x194) returned 1
	[0080.236] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020
	[0081.418] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.431] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0081.481] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.481] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.482] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0081.501] GetLastError () returned 0x0
	[0081.501] ReadFile (in: hFile=0x19c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x333, lpOverlapped=0x0) returned 1
	[0081.504] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x340, lpOverlapped=0x0) returned 1
	[0081.505] ReadFile (in: hFile=0x19c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.505] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0081.505] SetEndOfFile (hFile=0x174) returned 1
	[0081.506] CloseHandle (hObject=0x174) returned 1
	[0081.506] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.506] SetEndOfFile (hFile=0x19c) returned 1
	[0081.508] CloseHandle (hObject=0x19c) returned 1
	[0081.508] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.511] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1
	[0081.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.522] lstrlenW (lpString=".doc") returned 4
	[0081.522] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.522] lstrlenW (lpString=".docx") returned 5
	[0081.522] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0081.522] lstrlenW (lpString=".pdf") returned 4
	[0081.522] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.522] lstrlenW (lpString=".xls") returned 4
	[0081.522] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.522] lstrlenW (lpString=".xlsx") returned 5
	[0081.522] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0081.522] lstrlenW (lpString=".ppt") returned 4
	[0081.522] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.522] lstrlenW (lpString=".zip") returned 4
	[0081.522] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.522] lstrlenW (lpString=".rar") returned 4
	[0081.522] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.522] lstrlenW (lpString=".bz2") returned 4
	[0081.522] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.522] lstrlenW (lpString=".7z") returned 3
	[0081.522] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.522] lstrlenW (lpString=".dbf") returned 4
	[0081.522] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.523] lstrlenW (lpString=".1cd") returned 4
	[0081.523] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.523] lstrlenW (lpString=".jpg") returned 4
	[0081.523] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.523] lstrlenW (lpString=".doc") returned 4
	[0081.523] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.523] lstrlenW (lpString=".docx") returned 5
	[0081.523] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0081.523] lstrlenW (lpString=".pdf") returned 4
	[0081.523] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.523] lstrlenW (lpString=".xls") returned 4
	[0081.523] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.523] lstrlenW (lpString=".xlsx") returned 5
	[0081.523] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0081.523] lstrlenW (lpString=".ppt") returned 4
	[0081.523] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.523] lstrlenW (lpString=".zip") returned 4
	[0081.523] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.523] lstrlenW (lpString=".rar") returned 4
	[0081.523] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.523] lstrlenW (lpString=".bz2") returned 4
	[0081.523] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.523] lstrlenW (lpString=".7z") returned 3
	[0081.523] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.523] lstrlenW (lpString=".dbf") returned 4
	[0081.523] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.524] lstrlenW (lpString=".1cd") returned 4
	[0081.524] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.524] lstrlenW (lpString=".jpg") returned 4
	[0081.524] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.524] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0081.524] lstrlenW (lpString="AccessMUI.xml") returned 13
	[0081.524] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.526] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1349) returned 1
	[0081.526] CloseHandle (hObject=0x184) returned 1
	[0081.527] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020
	[0081.528] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.529] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.529] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.529] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.529] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0081.530] GetLastError () returned 0x0
	[0081.530] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x545, lpOverlapped=0x0) returned 1
	[0081.531] WriteFile (in: hFile=0x19c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0081.532] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.532] WriteFile (in: hFile=0x19c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0081.532] SetEndOfFile (hFile=0x19c) returned 1
	[0081.532] CloseHandle (hObject=0x19c) returned 1
	[0081.533] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.533] SetEndOfFile (hFile=0x184) returned 1
	[0081.533] CloseHandle (hObject=0x184) returned 1
	[0081.534] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.534] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1
	[0081.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0081.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0081.534] lstrlenW (lpString=".doc") returned 4
	[0081.534] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.534] lstrlenW (lpString=".docx") returned 5
	[0081.534] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0081.534] lstrlenW (lpString=".pdf") returned 4
	[0081.534] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.534] lstrlenW (lpString=".xls") returned 4
	[0081.534] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.534] lstrlenW (lpString=".xlsx") returned 5
	[0081.535] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0081.535] lstrlenW (lpString=".ppt") returned 4
	[0081.535] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0081.535] lstrlenW (lpString=".zip") returned 4
	[0081.535] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.535] lstrlenW (lpString=".rar") returned 4
	[0081.535] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.535] lstrlenW (lpString=".bz2") returned 4
	[0081.535] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.535] lstrlenW (lpString=".7z") returned 3
	[0081.535] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0081.535] lstrlenW (lpString=".dbf") returned 4
	[0081.535] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0081.535] lstrlenW (lpString=".1cd") returned 4
	[0081.535] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0081.535] lstrlenW (lpString=".jpg") returned 4
	[0081.535] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0081.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0081.535] lstrlenW (lpString=".doc") returned 4
	[0081.535] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.535] lstrlenW (lpString=".docx") returned 5
	[0081.535] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0081.535] lstrlenW (lpString=".pdf") returned 4
	[0081.535] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.535] lstrlenW (lpString=".xls") returned 4
	[0081.535] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.535] lstrlenW (lpString=".xlsx") returned 5
	[0081.536] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0081.536] lstrlenW (lpString=".ppt") returned 4
	[0081.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0081.536] lstrlenW (lpString=".zip") returned 4
	[0081.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.536] lstrlenW (lpString=".rar") returned 4
	[0081.536] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.536] lstrlenW (lpString=".bz2") returned 4
	[0081.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.536] lstrlenW (lpString=".7z") returned 3
	[0081.536] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0081.536] lstrlenW (lpString=".dbf") returned 4
	[0081.536] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0081.536] lstrlenW (lpString=".1cd") returned 4
	[0081.536] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0081.536] lstrlenW (lpString=".jpg") returned 4
	[0081.536] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.536] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0081.536] lstrlenW (lpString="branding.xml") returned 12
	[0081.536] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.537] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=596341) returned 1
	[0081.537] CloseHandle (hObject=0x184) returned 1
	[0081.537] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020
	[0081.537] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.537] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.537] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.537] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.537] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0081.538] GetLastError () returned 0x0
	[0081.538] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x91975, lpOverlapped=0x0) returned 1
	[0081.554] WriteFile (in: hFile=0x19c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x91980, lpOverlapped=0x0) returned 1
	[0081.571] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.571] WriteFile (in: hFile=0x19c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0081.571] SetEndOfFile (hFile=0x19c) returned 1
	[0081.571] CloseHandle (hObject=0x19c) returned 1
	[0081.571] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.571] SetEndOfFile (hFile=0x184) returned 1
	[0081.579] CloseHandle (hObject=0x184) returned 1
	[0081.579] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.580] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1
	[0081.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0081.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0081.580] lstrlenW (lpString=".doc") returned 4
	[0081.580] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.580] lstrlenW (lpString=".docx") returned 5
	[0081.580] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0081.580] lstrlenW (lpString=".pdf") returned 4
	[0081.580] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.580] lstrlenW (lpString=".xls") returned 4
	[0081.580] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.580] lstrlenW (lpString=".xlsx") returned 5
	[0081.580] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0081.580] lstrlenW (lpString=".ppt") returned 4
	[0081.581] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0081.581] lstrlenW (lpString=".zip") returned 4
	[0081.581] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.581] lstrlenW (lpString=".rar") returned 4
	[0081.581] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.581] lstrlenW (lpString=".bz2") returned 4
	[0081.581] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.581] lstrlenW (lpString=".7z") returned 3
	[0081.581] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0081.581] lstrlenW (lpString=".dbf") returned 4
	[0081.581] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0081.581] lstrlenW (lpString=".1cd") returned 4
	[0081.581] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0081.581] lstrlenW (lpString=".jpg") returned 4
	[0081.581] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0081.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0081.581] lstrlenW (lpString=".doc") returned 4
	[0081.581] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.581] lstrlenW (lpString=".docx") returned 5
	[0081.581] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0081.581] lstrlenW (lpString=".pdf") returned 4
	[0081.582] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.582] lstrlenW (lpString=".xls") returned 4
	[0081.582] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.582] lstrlenW (lpString=".xlsx") returned 5
	[0081.582] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0081.582] lstrlenW (lpString=".ppt") returned 4
	[0081.582] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0081.582] lstrlenW (lpString=".zip") returned 4
	[0081.582] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.582] lstrlenW (lpString=".rar") returned 4
	[0081.582] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.582] lstrlenW (lpString=".bz2") returned 4
	[0081.582] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.582] lstrlenW (lpString=".7z") returned 3
	[0081.582] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0081.582] lstrlenW (lpString=".dbf") returned 4
	[0081.582] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0081.582] lstrlenW (lpString=".1cd") returned 4
	[0081.582] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0081.582] lstrlenW (lpString=".jpg") returned 4
	[0081.582] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.583] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0081.583] lstrlenW (lpString="AccessMUISet.xml") returned 16
	[0081.583] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.583] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=819) returned 1
	[0081.583] CloseHandle (hObject=0x184) returned 1
	[0081.583] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020
	[0081.583] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.584] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.584] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.584] GetLastError () returned 0x0
	[0081.584] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x333, lpOverlapped=0x0) returned 1
	[0081.589] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x340, lpOverlapped=0x0) returned 1
	[0081.590] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.590] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0081.590] SetEndOfFile (hFile=0x198) returned 1
	[0081.590] CloseHandle (hObject=0x198) returned 1
	[0081.591] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.591] SetEndOfFile (hFile=0x184) returned 1
	[0081.595] CloseHandle (hObject=0x184) returned 1
	[0081.595] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.596] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1
	[0081.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0081.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0081.596] lstrlenW (lpString=".doc") returned 4
	[0081.596] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.596] lstrlenW (lpString=".docx") returned 5
	[0081.596] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0081.596] lstrlenW (lpString=".pdf") returned 4
	[0081.596] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.596] lstrlenW (lpString=".xls") returned 4
	[0081.596] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.596] lstrlenW (lpString=".xlsx") returned 5
	[0081.596] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0081.597] lstrlenW (lpString=".ppt") returned 4
	[0081.597] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0081.597] lstrlenW (lpString=".zip") returned 4
	[0081.597] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.597] lstrlenW (lpString=".rar") returned 4
	[0081.597] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.597] lstrlenW (lpString=".bz2") returned 4
	[0081.597] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.597] lstrlenW (lpString=".7z") returned 3
	[0081.597] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0081.597] lstrlenW (lpString=".dbf") returned 4
	[0081.597] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0081.597] lstrlenW (lpString=".1cd") returned 4
	[0081.597] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0081.597] lstrlenW (lpString=".jpg") returned 4
	[0081.597] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0081.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0081.597] lstrlenW (lpString=".doc") returned 4
	[0081.598] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.598] lstrlenW (lpString=".docx") returned 5
	[0081.598] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0081.598] lstrlenW (lpString=".pdf") returned 4
	[0081.598] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.598] lstrlenW (lpString=".xls") returned 4
	[0081.598] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.598] lstrlenW (lpString=".xlsx") returned 5
	[0081.598] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0081.598] lstrlenW (lpString=".ppt") returned 4
	[0081.598] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0081.598] lstrlenW (lpString=".zip") returned 4
	[0081.598] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.598] lstrlenW (lpString=".rar") returned 4
	[0081.598] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.598] lstrlenW (lpString=".bz2") returned 4
	[0081.598] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.598] lstrlenW (lpString=".7z") returned 3
	[0081.598] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0081.598] lstrlenW (lpString=".dbf") returned 4
	[0081.598] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0081.598] lstrlenW (lpString=".1cd") returned 4
	[0081.599] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0081.599] lstrlenW (lpString=".jpg") returned 4
	[0081.599] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.599] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0081.599] lstrlenW (lpString="Setup.xml") returned 9
	[0081.599] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.599] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2624) returned 1
	[0081.600] CloseHandle (hObject=0x184) returned 1
	[0081.600] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0081.600] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.600] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.600] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.600] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.600] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.600] GetLastError () returned 0x0
	[0081.600] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xa40, lpOverlapped=0x0) returned 1
	[0081.603] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xa50, lpOverlapped=0x0) returned 1
	[0081.604] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.604] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0081.604] SetEndOfFile (hFile=0x198) returned 1
	[0081.604] CloseHandle (hObject=0x198) returned 1
	[0081.605] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.605] SetEndOfFile (hFile=0x184) returned 1
	[0081.606] CloseHandle (hObject=0x184) returned 1
	[0081.606] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.606] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0081.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.606] lstrlenW (lpString=".doc") returned 4
	[0081.606] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.606] lstrlenW (lpString=".docx") returned 5
	[0081.606] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0081.607] lstrlenW (lpString=".pdf") returned 4
	[0081.607] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.607] lstrlenW (lpString=".xls") returned 4
	[0081.607] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.607] lstrlenW (lpString=".xlsx") returned 5
	[0081.607] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0081.607] lstrlenW (lpString=".ppt") returned 4
	[0081.607] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.607] lstrlenW (lpString=".zip") returned 4
	[0081.607] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.607] lstrlenW (lpString=".rar") returned 4
	[0081.607] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.607] lstrlenW (lpString=".bz2") returned 4
	[0081.607] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.607] lstrlenW (lpString=".7z") returned 3
	[0081.607] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.607] lstrlenW (lpString=".dbf") returned 4
	[0081.607] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.607] lstrlenW (lpString=".1cd") returned 4
	[0081.607] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.607] lstrlenW (lpString=".jpg") returned 4
	[0081.607] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.608] lstrlenW (lpString=".doc") returned 4
	[0081.608] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.608] lstrlenW (lpString=".docx") returned 5
	[0081.608] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0081.608] lstrlenW (lpString=".pdf") returned 4
	[0081.608] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.608] lstrlenW (lpString=".xls") returned 4
	[0081.608] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.608] lstrlenW (lpString=".xlsx") returned 5
	[0081.608] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0081.608] lstrlenW (lpString=".ppt") returned 4
	[0081.608] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.608] lstrlenW (lpString=".zip") returned 4
	[0081.608] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.608] lstrlenW (lpString=".rar") returned 4
	[0081.608] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.608] lstrlenW (lpString=".bz2") returned 4
	[0081.608] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.608] lstrlenW (lpString=".7z") returned 3
	[0081.608] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.608] lstrlenW (lpString=".dbf") returned 4
	[0081.608] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.609] lstrlenW (lpString=".1cd") returned 4
	[0081.609] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.609] lstrlenW (lpString=".jpg") returned 4
	[0081.609] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.609] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0081.609] lstrlenW (lpString="Office32WW.xml") returned 14
	[0081.609] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.611] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4274) returned 1
	[0081.611] CloseHandle (hObject=0x184) returned 1
	[0081.612] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020
	[0081.614] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.615] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.616] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.616] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.616] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.616] GetLastError () returned 0x0
	[0081.616] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0081.622] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0081.623] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.623] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0081.623] SetEndOfFile (hFile=0x198) returned 1
	[0081.623] CloseHandle (hObject=0x198) returned 1
	[0081.624] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.624] SetEndOfFile (hFile=0x184) returned 1
	[0081.625] CloseHandle (hObject=0x184) returned 1
	[0081.625] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.625] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1
	[0081.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.626] lstrlenW (lpString=".doc") returned 4
	[0081.626] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.626] lstrlenW (lpString=".docx") returned 5
	[0081.626] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0081.626] lstrlenW (lpString=".pdf") returned 4
	[0081.626] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.626] lstrlenW (lpString=".xls") returned 4
	[0081.626] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.626] lstrlenW (lpString=".xlsx") returned 5
	[0081.627] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0081.627] lstrlenW (lpString=".ppt") returned 4
	[0081.627] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.627] lstrlenW (lpString=".zip") returned 4
	[0081.627] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.627] lstrlenW (lpString=".rar") returned 4
	[0081.627] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.627] lstrlenW (lpString=".bz2") returned 4
	[0081.627] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.627] lstrlenW (lpString=".7z") returned 3
	[0081.627] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.627] lstrlenW (lpString=".dbf") returned 4
	[0081.627] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.627] lstrlenW (lpString=".1cd") returned 4
	[0081.627] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.627] lstrlenW (lpString=".jpg") returned 4
	[0081.627] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.627] lstrlenW (lpString=".doc") returned 4
	[0081.627] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.627] lstrlenW (lpString=".docx") returned 5
	[0081.628] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0081.628] lstrlenW (lpString=".pdf") returned 4
	[0081.628] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.628] lstrlenW (lpString=".xls") returned 4
	[0081.628] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.628] lstrlenW (lpString=".xlsx") returned 5
	[0081.628] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0081.628] lstrlenW (lpString=".ppt") returned 4
	[0081.628] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.628] lstrlenW (lpString=".zip") returned 4
	[0081.628] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.628] lstrlenW (lpString=".rar") returned 4
	[0081.628] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.628] lstrlenW (lpString=".bz2") returned 4
	[0081.628] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.628] lstrlenW (lpString=".7z") returned 3
	[0081.628] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.628] lstrlenW (lpString=".dbf") returned 4
	[0081.628] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.628] lstrlenW (lpString=".1cd") returned 4
	[0081.628] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.628] lstrlenW (lpString=".jpg") returned 4
	[0081.628] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.629] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0081.629] lstrlenW (lpString="Setup.xml") returned 9
	[0081.629] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.634] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=31094) returned 1
	[0081.634] CloseHandle (hObject=0x198) returned 1
	[0081.634] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0081.677] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.681] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0081.738] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.738] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.739] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0081.739] GetLastError () returned 0x0
	[0081.739] ReadFile (in: hFile=0x1b8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x7976, lpOverlapped=0x0) returned 1
	[0081.808] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x7980, lpOverlapped=0x0) returned 1
	[0081.810] ReadFile (in: hFile=0x1b8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.810] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0081.811] SetEndOfFile (hFile=0x1bc) returned 1
	[0081.811] CloseHandle (hObject=0x1bc) returned 1
	[0081.811] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.811] SetEndOfFile (hFile=0x1b8) returned 1
	[0081.812] CloseHandle (hObject=0x1b8) returned 1
	[0081.813] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.813] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0081.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.813] lstrlenW (lpString=".doc") returned 4
	[0081.813] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.813] lstrlenW (lpString=".docx") returned 5
	[0081.813] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0081.813] lstrlenW (lpString=".pdf") returned 4
	[0081.813] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.813] lstrlenW (lpString=".xls") returned 4
	[0081.814] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.814] lstrlenW (lpString=".xlsx") returned 5
	[0081.814] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0081.814] lstrlenW (lpString=".ppt") returned 4
	[0081.814] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.814] lstrlenW (lpString=".zip") returned 4
	[0081.814] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.814] lstrlenW (lpString=".rar") returned 4
	[0081.814] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.814] lstrlenW (lpString=".bz2") returned 4
	[0081.814] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.814] lstrlenW (lpString=".7z") returned 3
	[0081.814] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.814] lstrlenW (lpString=".dbf") returned 4
	[0081.814] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.814] lstrlenW (lpString=".1cd") returned 4
	[0081.814] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.814] lstrlenW (lpString=".jpg") returned 4
	[0081.814] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.815] lstrlenW (lpString=".doc") returned 4
	[0081.815] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.815] lstrlenW (lpString=".docx") returned 5
	[0081.815] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0081.815] lstrlenW (lpString=".pdf") returned 4
	[0081.815] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.815] lstrlenW (lpString=".xls") returned 4
	[0081.815] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.815] lstrlenW (lpString=".xlsx") returned 5
	[0081.815] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0081.815] lstrlenW (lpString=".ppt") returned 4
	[0081.815] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.815] lstrlenW (lpString=".zip") returned 4
	[0081.815] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.815] lstrlenW (lpString=".rar") returned 4
	[0081.815] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.815] lstrlenW (lpString=".bz2") returned 4
	[0081.815] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.815] lstrlenW (lpString=".7z") returned 3
	[0081.815] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.816] lstrlenW (lpString=".dbf") returned 4
	[0081.816] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.816] lstrlenW (lpString=".1cd") returned 4
	[0081.816] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.816] lstrlenW (lpString=".jpg") returned 4
	[0081.816] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.816] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0081.816] lstrlenW (lpString="PrjProrWW.xml") returned 13
	[0081.816] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0081.848] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6421) returned 1
	[0081.848] CloseHandle (hObject=0x194) returned 1
	[0081.849] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020
	[0081.879] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.879] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.891] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.891] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.891] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0081.916] GetLastError () returned 0x0
	[0081.916] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1915, lpOverlapped=0x0) returned 1
	[0081.930] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1920, lpOverlapped=0x0) returned 1
	[0081.931] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.931] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0081.932] SetEndOfFile (hFile=0x194) returned 1
	[0081.932] CloseHandle (hObject=0x194) returned 1
	[0081.932] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.932] SetEndOfFile (hFile=0x184) returned 1
	[0081.933] CloseHandle (hObject=0x184) returned 1
	[0081.933] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.933] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1
	[0081.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0081.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0081.934] lstrlenW (lpString=".doc") returned 4
	[0081.934] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.934] lstrlenW (lpString=".docx") returned 5
	[0081.934] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0081.934] lstrlenW (lpString=".pdf") returned 4
	[0081.934] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.934] lstrlenW (lpString=".xls") returned 4
	[0081.934] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.934] lstrlenW (lpString=".xlsx") returned 5
	[0081.934] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0081.934] lstrlenW (lpString=".ppt") returned 4
	[0081.934] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0081.934] lstrlenW (lpString=".zip") returned 4
	[0081.934] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.934] lstrlenW (lpString=".rar") returned 4
	[0081.934] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.935] lstrlenW (lpString=".bz2") returned 4
	[0081.935] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.935] lstrlenW (lpString=".7z") returned 3
	[0081.935] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0081.935] lstrlenW (lpString=".dbf") returned 4
	[0081.935] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0081.935] lstrlenW (lpString=".1cd") returned 4
	[0081.935] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0081.935] lstrlenW (lpString=".jpg") returned 4
	[0081.935] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0081.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0081.935] lstrlenW (lpString=".doc") returned 4
	[0081.935] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.935] lstrlenW (lpString=".docx") returned 5
	[0081.935] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0081.935] lstrlenW (lpString=".pdf") returned 4
	[0081.935] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.935] lstrlenW (lpString=".xls") returned 4
	[0081.935] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.935] lstrlenW (lpString=".xlsx") returned 5
	[0081.935] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0081.936] lstrlenW (lpString=".ppt") returned 4
	[0081.936] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0081.936] lstrlenW (lpString=".zip") returned 4
	[0081.936] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.936] lstrlenW (lpString=".rar") returned 4
	[0081.936] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.936] lstrlenW (lpString=".bz2") returned 4
	[0081.936] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.936] lstrlenW (lpString=".7z") returned 3
	[0081.936] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0081.936] lstrlenW (lpString=".dbf") returned 4
	[0081.936] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0081.936] lstrlenW (lpString=".1cd") returned 4
	[0081.936] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0081.936] lstrlenW (lpString=".jpg") returned 4
	[0081.936] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.936] lstrcmpiW (lpString1=".EPS", lpString2=".adobe") returned 1
	[0081.937] lstrlenW (lpString="MS.EPS") returned 6
	[0081.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.968] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=15067) returned 1
	[0081.968] CloseHandle (hObject=0x184) returned 1
	[0081.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20
	[0081.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0081.985] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.985] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0082.100] GetLastError () returned 0x0
	[0082.100] ReadFile (in: hFile=0x1a4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x3adb, lpOverlapped=0x0) returned 1
	[0082.102] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3ae0, lpOverlapped=0x0) returned 1
	[0082.103] ReadFile (in: hFile=0x1a4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0082.103] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0082.104] SetEndOfFile (hFile=0x1b0) returned 1
	[0082.116] CloseHandle (hObject=0x1b0) returned 1
	[0082.184] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.184] SetEndOfFile (hFile=0x1a4) returned 1
	[0082.191] CloseHandle (hObject=0x1a4) returned 1
	[0082.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0082.287] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1
	[0082.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0082.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0082.304] lstrlenW (lpString=".doc") returned 4
	[0082.304] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1
	[0082.304] lstrlenW (lpString=".docx") returned 5
	[0082.304] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1
	[0082.304] lstrlenW (lpString=".pdf") returned 4
	[0082.304] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1
	[0082.304] lstrlenW (lpString=".xls") returned 4
	[0082.305] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1
	[0082.305] lstrlenW (lpString=".xlsx") returned 5
	[0082.305] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1
	[0082.305] lstrlenW (lpString=".ppt") returned 4
	[0082.305] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1
	[0082.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0082.305] lstrlenW (lpString=".zip") returned 4
	[0082.305] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1
	[0082.305] lstrlenW (lpString=".rar") returned 4
	[0082.305] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1
	[0082.305] lstrlenW (lpString=".bz2") returned 4
	[0082.305] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1
	[0082.305] lstrlenW (lpString=".7z") returned 3
	[0082.305] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1
	[0082.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0082.305] lstrlenW (lpString=".dbf") returned 4
	[0082.305] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1
	[0082.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0082.305] lstrlenW (lpString=".1cd") returned 4
	[0082.305] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1
	[0082.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0082.305] lstrlenW (lpString=".jpg") returned 4
	[0082.305] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1
	[0082.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0082.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0082.305] lstrlenW (lpString=".doc") returned 4
	[0082.305] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1
	[0082.305] lstrlenW (lpString=".docx") returned 5
	[0082.305] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1
	[0082.305] lstrlenW (lpString=".pdf") returned 4
	[0082.305] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1
	[0082.305] lstrlenW (lpString=".xls") returned 4
	[0082.305] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1
	[0082.306] lstrlenW (lpString=".xlsx") returned 5
	[0082.306] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1
	[0082.306] lstrlenW (lpString=".ppt") returned 4
	[0082.306] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1
	[0082.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0082.306] lstrlenW (lpString=".zip") returned 4
	[0082.306] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1
	[0082.306] lstrlenW (lpString=".rar") returned 4
	[0082.306] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1
	[0082.306] lstrlenW (lpString=".bz2") returned 4
	[0082.306] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1
	[0082.306] lstrlenW (lpString=".7z") returned 3
	[0082.306] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1
	[0082.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0082.306] lstrlenW (lpString=".dbf") returned 4
	[0082.306] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1
	[0082.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0082.306] lstrlenW (lpString=".1cd") returned 4
	[0082.306] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1
	[0082.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0082.306] lstrlenW (lpString=".jpg") returned 4
	[0082.306] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1
	[0082.306] lstrcmpiW (lpString1=".avi", lpString2=".adobe") returned 1
	[0082.306] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0082.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0082.656] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=31744) returned 1
	[0082.656] CloseHandle (hObject=0x19c) returned 1
	[0082.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20
	[0082.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0082.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0082.661] lstrlenW (lpString=".doc") returned 4
	[0082.661] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0082.661] lstrlenW (lpString=".docx") returned 5
	[0082.661] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0082.661] lstrlenW (lpString=".pdf") returned 4
	[0082.661] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0082.662] lstrlenW (lpString=".xls") returned 4
	[0082.662] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0082.662] lstrlenW (lpString=".xlsx") returned 5
	[0082.662] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0082.662] lstrlenW (lpString=".ppt") returned 4
	[0082.662] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0082.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0082.662] lstrlenW (lpString=".zip") returned 4
	[0082.662] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0082.662] lstrlenW (lpString=".rar") returned 4
	[0082.662] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0082.662] lstrlenW (lpString=".bz2") returned 4
	[0082.662] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0082.662] lstrlenW (lpString=".7z") returned 3
	[0082.662] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0082.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0082.662] lstrlenW (lpString=".dbf") returned 4
	[0082.662] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0082.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0082.662] lstrlenW (lpString=".1cd") returned 4
	[0082.662] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0082.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0082.662] lstrlenW (lpString=".jpg") returned 4
	[0082.662] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0082.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0082.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0082.663] lstrlenW (lpString=".doc") returned 4
	[0082.663] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0082.663] lstrlenW (lpString=".docx") returned 5
	[0082.663] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0082.663] lstrlenW (lpString=".pdf") returned 4
	[0082.663] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0082.663] lstrlenW (lpString=".xls") returned 4
	[0082.663] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0082.663] lstrlenW (lpString=".xlsx") returned 5
	[0082.663] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0082.663] lstrlenW (lpString=".ppt") returned 4
	[0082.663] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0082.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0082.663] lstrlenW (lpString=".zip") returned 4
	[0082.663] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0082.663] lstrlenW (lpString=".rar") returned 4
	[0082.663] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0082.663] lstrlenW (lpString=".bz2") returned 4
	[0082.663] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0082.663] lstrlenW (lpString=".7z") returned 3
	[0082.663] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0082.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0082.663] lstrlenW (lpString=".dbf") returned 4
	[0082.663] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0082.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0082.664] lstrlenW (lpString=".1cd") returned 4
	[0082.664] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0082.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0082.664] lstrlenW (lpString=".jpg") returned 4
	[0082.664] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0082.664] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0082.664] lstrlenW (lpString="auxbase.xml") returned 11
	[0082.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0082.723] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1434) returned 1
	[0082.723] CloseHandle (hObject=0x174) returned 1
	[0082.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20
	[0082.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0082.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0082.782] lstrlenW (lpString=".doc") returned 4
	[0082.782] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.782] lstrlenW (lpString=".docx") returned 5
	[0082.782] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0082.782] lstrlenW (lpString=".pdf") returned 4
	[0082.782] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.782] lstrlenW (lpString=".xls") returned 4
	[0082.782] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.782] lstrlenW (lpString=".xlsx") returned 5
	[0082.782] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0082.782] lstrlenW (lpString=".ppt") returned 4
	[0082.782] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0082.782] lstrlenW (lpString=".zip") returned 4
	[0082.782] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.782] lstrlenW (lpString=".rar") returned 4
	[0082.782] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.782] lstrlenW (lpString=".bz2") returned 4
	[0082.782] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.782] lstrlenW (lpString=".7z") returned 3
	[0082.782] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0082.782] lstrlenW (lpString=".dbf") returned 4
	[0082.782] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0082.782] lstrlenW (lpString=".1cd") returned 4
	[0082.782] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0082.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0082.783] lstrlenW (lpString=".jpg") returned 4
	[0082.783] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0082.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0082.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0082.783] lstrlenW (lpString=".doc") returned 4
	[0082.783] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.783] lstrlenW (lpString=".docx") returned 5
	[0082.783] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0082.783] lstrlenW (lpString=".pdf") returned 4
	[0082.783] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.783] lstrlenW (lpString=".xls") returned 4
	[0082.783] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.783] lstrlenW (lpString=".xlsx") returned 5
	[0082.783] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0082.783] lstrlenW (lpString=".ppt") returned 4
	[0082.783] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0082.783] lstrlenW (lpString=".zip") returned 4
	[0082.783] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.783] lstrlenW (lpString=".rar") returned 4
	[0082.783] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.783] lstrlenW (lpString=".bz2") returned 4
	[0082.783] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.783] lstrlenW (lpString=".7z") returned 3
	[0082.784] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0082.784] lstrlenW (lpString=".dbf") returned 4
	[0082.784] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0082.784] lstrlenW (lpString=".1cd") returned 4
	[0082.784] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0082.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0082.784] lstrlenW (lpString=".jpg") returned 4
	[0082.784] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0082.784] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0082.784] lstrlenW (lpString="auxpad.xml") returned 10
	[0082.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0082.786] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=212) returned 1
	[0082.786] CloseHandle (hObject=0x19c) returned 1
	[0082.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20
	[0082.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0082.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0082.787] lstrlenW (lpString=".doc") returned 4
	[0082.787] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.787] lstrlenW (lpString=".docx") returned 5
	[0082.787] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0082.787] lstrlenW (lpString=".pdf") returned 4
	[0082.787] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.787] lstrlenW (lpString=".xls") returned 4
	[0082.787] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.787] lstrlenW (lpString=".xlsx") returned 5
	[0082.787] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0082.787] lstrlenW (lpString=".ppt") returned 4
	[0082.787] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0082.788] lstrlenW (lpString=".zip") returned 4
	[0082.788] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.788] lstrlenW (lpString=".rar") returned 4
	[0082.788] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.788] lstrlenW (lpString=".bz2") returned 4
	[0082.788] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.788] lstrlenW (lpString=".7z") returned 3
	[0082.788] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0082.788] lstrlenW (lpString=".dbf") returned 4
	[0082.788] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0082.788] lstrlenW (lpString=".1cd") returned 4
	[0082.788] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0082.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0082.788] lstrlenW (lpString=".jpg") returned 4
	[0082.788] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0082.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0082.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0082.788] lstrlenW (lpString=".doc") returned 4
	[0082.788] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.788] lstrlenW (lpString=".docx") returned 5
	[0082.788] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0082.788] lstrlenW (lpString=".pdf") returned 4
	[0082.789] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.789] lstrlenW (lpString=".xls") returned 4
	[0082.789] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.789] lstrlenW (lpString=".xlsx") returned 5
	[0082.789] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0082.789] lstrlenW (lpString=".ppt") returned 4
	[0082.789] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0082.789] lstrlenW (lpString=".zip") returned 4
	[0082.789] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.789] lstrlenW (lpString=".rar") returned 4
	[0082.789] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.789] lstrlenW (lpString=".bz2") returned 4
	[0082.789] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.789] lstrlenW (lpString=".7z") returned 3
	[0082.789] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0082.789] lstrlenW (lpString=".dbf") returned 4
	[0082.789] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0082.789] lstrlenW (lpString=".1cd") returned 4
	[0082.789] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0082.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0082.789] lstrlenW (lpString=".jpg") returned 4
	[0082.789] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0082.790] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0082.790] lstrlenW (lpString="ea.xml") returned 6
	[0082.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0082.809] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=384) returned 1
	[0082.809] CloseHandle (hObject=0x1b0) returned 1
	[0082.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20
	[0082.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0082.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0082.825] lstrlenW (lpString=".doc") returned 4
	[0082.826] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.826] lstrlenW (lpString=".docx") returned 5
	[0082.826] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0082.826] lstrlenW (lpString=".pdf") returned 4
	[0082.826] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.826] lstrlenW (lpString=".xls") returned 4
	[0082.826] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.826] lstrlenW (lpString=".xlsx") returned 5
	[0082.826] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0082.826] lstrlenW (lpString=".ppt") returned 4
	[0082.826] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0082.826] lstrlenW (lpString=".zip") returned 4
	[0082.826] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.826] lstrlenW (lpString=".rar") returned 4
	[0082.826] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.826] lstrlenW (lpString=".bz2") returned 4
	[0082.826] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.826] lstrlenW (lpString=".7z") returned 3
	[0082.826] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0082.826] lstrlenW (lpString=".dbf") returned 4
	[0082.826] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0082.826] lstrlenW (lpString=".1cd") returned 4
	[0082.826] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0082.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0082.826] lstrlenW (lpString=".jpg") returned 4
	[0082.827] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0082.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0082.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0082.827] lstrlenW (lpString=".doc") returned 4
	[0082.827] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.827] lstrlenW (lpString=".docx") returned 5
	[0082.827] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0082.827] lstrlenW (lpString=".pdf") returned 4
	[0082.827] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.827] lstrlenW (lpString=".xls") returned 4
	[0082.827] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.827] lstrlenW (lpString=".xlsx") returned 5
	[0082.827] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0082.827] lstrlenW (lpString=".ppt") returned 4
	[0082.827] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0082.827] lstrlenW (lpString=".zip") returned 4
	[0082.827] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.827] lstrlenW (lpString=".rar") returned 4
	[0082.827] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.827] lstrlenW (lpString=".bz2") returned 4
	[0082.827] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.827] lstrlenW (lpString=".7z") returned 3
	[0082.827] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0082.828] lstrlenW (lpString=".dbf") returned 4
	[0082.828] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0082.828] lstrlenW (lpString=".1cd") returned 4
	[0082.828] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0082.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0082.828] lstrlenW (lpString=".jpg") returned 4
	[0082.828] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0082.828] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0082.828] lstrlenW (lpString="base.xml") returned 8
	[0082.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0082.831] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3150) returned 1
	[0082.831] CloseHandle (hObject=0x19c) returned 1
	[0082.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20
	[0082.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0082.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0082.835] lstrlenW (lpString=".doc") returned 4
	[0082.835] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.835] lstrlenW (lpString=".docx") returned 5
	[0082.836] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0082.836] lstrlenW (lpString=".pdf") returned 4
	[0082.836] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.836] lstrlenW (lpString=".xls") returned 4
	[0082.836] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.836] lstrlenW (lpString=".xlsx") returned 5
	[0082.836] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0082.836] lstrlenW (lpString=".ppt") returned 4
	[0082.836] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0082.836] lstrlenW (lpString=".zip") returned 4
	[0082.836] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.836] lstrlenW (lpString=".rar") returned 4
	[0082.836] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.836] lstrlenW (lpString=".bz2") returned 4
	[0082.836] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.836] lstrlenW (lpString=".7z") returned 3
	[0082.836] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0082.836] lstrlenW (lpString=".dbf") returned 4
	[0082.836] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0082.836] lstrlenW (lpString=".1cd") returned 4
	[0082.836] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0082.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0082.836] lstrlenW (lpString=".jpg") returned 4
	[0082.836] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0082.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0082.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0082.837] lstrlenW (lpString=".doc") returned 4
	[0082.837] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.837] lstrlenW (lpString=".docx") returned 5
	[0082.837] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0082.837] lstrlenW (lpString=".pdf") returned 4
	[0082.837] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.837] lstrlenW (lpString=".xls") returned 4
	[0082.837] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.837] lstrlenW (lpString=".xlsx") returned 5
	[0082.837] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0082.837] lstrlenW (lpString=".ppt") returned 4
	[0082.837] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0082.837] lstrlenW (lpString=".zip") returned 4
	[0082.837] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.837] lstrlenW (lpString=".rar") returned 4
	[0082.837] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.837] lstrlenW (lpString=".bz2") returned 4
	[0082.837] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.837] lstrlenW (lpString=".7z") returned 3
	[0082.837] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0082.837] lstrlenW (lpString=".dbf") returned 4
	[0082.837] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0082.838] lstrlenW (lpString=".1cd") returned 4
	[0082.838] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0082.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0082.838] lstrlenW (lpString=".jpg") returned 4
	[0082.838] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0082.838] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0082.838] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17
	[0082.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0082.839] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=247) returned 1
	[0082.839] CloseHandle (hObject=0x19c) returned 1
	[0082.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20
	[0082.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0082.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0082.844] lstrlenW (lpString=".doc") returned 4
	[0082.844] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.844] lstrlenW (lpString=".docx") returned 5
	[0082.844] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1
	[0082.844] lstrlenW (lpString=".pdf") returned 4
	[0082.845] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.845] lstrlenW (lpString=".xls") returned 4
	[0082.845] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.845] lstrlenW (lpString=".xlsx") returned 5
	[0082.845] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1
	[0082.845] lstrlenW (lpString=".ppt") returned 4
	[0082.845] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0082.845] lstrlenW (lpString=".zip") returned 4
	[0082.845] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.845] lstrlenW (lpString=".rar") returned 4
	[0082.845] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.845] lstrlenW (lpString=".bz2") returned 4
	[0082.845] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.845] lstrlenW (lpString=".7z") returned 3
	[0082.845] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0082.845] lstrlenW (lpString=".dbf") returned 4
	[0082.845] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0084.967] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.967] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0084.968] GetLastError () returned 0x0
	[0084.968] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x333, lpOverlapped=0x0) returned 1
	[0084.969] WriteFile (in: hFile=0x1a4, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x340, lpOverlapped=0x0) returned 1
	[0084.971] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.972] WriteFile (in: hFile=0x1a4, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0084.972] SetEndOfFile (hFile=0x1a4) returned 1
	[0084.972] CloseHandle (hObject=0x1a4) returned 1
	[0084.972] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.972] SetEndOfFile (hFile=0x1ac) returned 1
	[0084.973] CloseHandle (hObject=0x1ac) returned 1
	[0084.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0084.974] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1
	[0084.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0084.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0084.975] lstrlenW (lpString=".doc") returned 4
	[0084.975] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.975] lstrlenW (lpString=".docx") returned 5
	[0084.975] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0084.975] lstrlenW (lpString=".pdf") returned 4
	[0084.975] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.975] lstrlenW (lpString=".xls") returned 4
	[0084.975] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.975] lstrlenW (lpString=".xlsx") returned 5
	[0084.975] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0084.975] lstrlenW (lpString=".ppt") returned 4
	[0084.975] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0084.975] lstrlenW (lpString=".zip") returned 4
	[0084.975] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.976] lstrlenW (lpString=".rar") returned 4
	[0084.976] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.976] lstrlenW (lpString=".bz2") returned 4
	[0084.976] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.976] lstrlenW (lpString=".7z") returned 3
	[0084.976] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0084.976] lstrlenW (lpString=".dbf") returned 4
	[0084.976] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0084.976] lstrlenW (lpString=".1cd") returned 4
	[0084.976] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0084.976] lstrlenW (lpString=".jpg") returned 4
	[0084.976] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0084.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0084.977] lstrlenW (lpString=".doc") returned 4
	[0084.977] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.977] lstrlenW (lpString=".docx") returned 5
	[0084.977] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0084.977] lstrlenW (lpString=".pdf") returned 4
	[0084.977] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.977] lstrlenW (lpString=".xls") returned 4
	[0084.977] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.977] lstrlenW (lpString=".xlsx") returned 5
	[0084.977] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0084.977] lstrlenW (lpString=".ppt") returned 4
	[0084.977] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0084.977] lstrlenW (lpString=".zip") returned 4
	[0084.977] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.978] lstrlenW (lpString=".rar") returned 4
	[0084.978] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.978] lstrlenW (lpString=".bz2") returned 4
	[0084.978] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.978] lstrlenW (lpString=".7z") returned 3
	[0084.978] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0084.978] lstrlenW (lpString=".dbf") returned 4
	[0084.978] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0084.978] lstrlenW (lpString=".1cd") returned 4
	[0084.978] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0084.978] lstrlenW (lpString=".jpg") returned 4
	[0084.978] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.979] lstrcmpiW (lpString1=".CHM", lpString2=".adobe") returned 1
	[0084.979] lstrlenW (lpString="PSCONFIG.CHM") returned 12
	[0084.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.980] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=37689) returned 1
	[0084.980] CloseHandle (hObject=0x1ac) returned 1
	[0084.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20
	[0084.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.981] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.981] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0084.982] GetLastError () returned 0x0
	[0084.982] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x9339, lpOverlapped=0x0) returned 1
	[0085.009] WriteFile (in: hFile=0x1a4, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x9340, lpOverlapped=0x0) returned 1
	[0085.011] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.011] WriteFile (in: hFile=0x1a4, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0085.012] SetEndOfFile (hFile=0x1a4) returned 1
	[0085.012] CloseHandle (hObject=0x1a4) returned 1
	[0085.012] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.012] SetEndOfFile (hFile=0x1ac) returned 1
	[0085.014] CloseHandle (hObject=0x1ac) returned 1
	[0085.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.014] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1
	[0085.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0085.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0085.023] lstrlenW (lpString=".doc") returned 4
	[0085.023] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0085.023] lstrlenW (lpString=".docx") returned 5
	[0085.023] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1
	[0085.023] lstrlenW (lpString=".pdf") returned 4
	[0085.023] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0085.023] lstrlenW (lpString=".xls") returned 4
	[0085.023] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0085.023] lstrlenW (lpString=".xlsx") returned 5
	[0085.023] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1
	[0085.023] lstrlenW (lpString=".ppt") returned 4
	[0085.023] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0085.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0085.023] lstrlenW (lpString=".zip") returned 4
	[0085.023] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0085.023] lstrlenW (lpString=".rar") returned 4
	[0085.023] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0085.023] lstrlenW (lpString=".bz2") returned 4
	[0085.023] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0085.023] lstrlenW (lpString=".7z") returned 3
	[0085.023] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0085.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0085.023] lstrlenW (lpString=".dbf") returned 4
	[0085.023] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0085.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0085.023] lstrlenW (lpString=".1cd") returned 4
	[0085.023] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0085.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0085.023] lstrlenW (lpString=".jpg") returned 4
	[0085.023] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0085.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0085.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0085.024] lstrlenW (lpString=".doc") returned 4
	[0085.024] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0085.024] lstrlenW (lpString=".docx") returned 5
	[0085.024] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1
	[0085.024] lstrlenW (lpString=".pdf") returned 4
	[0085.024] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0085.024] lstrlenW (lpString=".xls") returned 4
	[0085.024] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0085.024] lstrlenW (lpString=".xlsx") returned 5
	[0085.024] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1
	[0085.024] lstrlenW (lpString=".ppt") returned 4
	[0085.024] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0085.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0085.024] lstrlenW (lpString=".zip") returned 4
	[0085.024] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0085.024] lstrlenW (lpString=".rar") returned 4
	[0085.024] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0085.024] lstrlenW (lpString=".bz2") returned 4
	[0085.024] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0085.024] lstrlenW (lpString=".7z") returned 3
	[0085.024] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0085.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0085.024] lstrlenW (lpString=".dbf") returned 4
	[0085.024] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0085.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0085.024] lstrlenW (lpString=".1cd") returned 4
	[0085.024] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0085.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0085.024] lstrlenW (lpString=".jpg") returned 4
	[0085.025] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0085.025] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.025] lstrlenW (lpString="SETUP.XML") returned 9
	[0085.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0085.091] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=9352) returned 1
	[0085.091] CloseHandle (hObject=0x194) returned 1
	[0085.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20
	[0085.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.302] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.302] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.303] GetLastError () returned 0x0
	[0085.303] ReadFile (in: hFile=0x1a4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x2488, lpOverlapped=0x0) returned 1
	[0085.310] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2490, lpOverlapped=0x0) returned 1
	[0085.312] ReadFile (in: hFile=0x1a4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.312] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0085.312] SetEndOfFile (hFile=0x198) returned 1
	[0085.312] CloseHandle (hObject=0x198) returned 1
	[0085.312] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.312] SetEndOfFile (hFile=0x1a4) returned 1
	[0085.314] CloseHandle (hObject=0x1a4) returned 1
	[0085.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.314] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1
	[0085.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0085.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0085.315] lstrlenW (lpString=".doc") returned 4
	[0085.315] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.315] lstrlenW (lpString=".docx") returned 5
	[0085.315] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.315] lstrlenW (lpString=".pdf") returned 4
	[0085.315] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.315] lstrlenW (lpString=".xls") returned 4
	[0085.315] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.315] lstrlenW (lpString=".xlsx") returned 5
	[0085.315] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.315] lstrlenW (lpString=".ppt") returned 4
	[0085.315] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0085.315] lstrlenW (lpString=".zip") returned 4
	[0085.315] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.315] lstrlenW (lpString=".rar") returned 4
	[0085.315] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.315] lstrlenW (lpString=".bz2") returned 4
	[0085.315] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.315] lstrlenW (lpString=".7z") returned 3
	[0085.315] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0085.315] lstrlenW (lpString=".dbf") returned 4
	[0085.315] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0085.316] lstrlenW (lpString=".1cd") returned 4
	[0085.316] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0085.316] lstrlenW (lpString=".jpg") returned 4
	[0085.316] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0085.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0085.316] lstrlenW (lpString=".doc") returned 4
	[0085.316] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.316] lstrlenW (lpString=".docx") returned 5
	[0085.316] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.316] lstrlenW (lpString=".pdf") returned 4
	[0085.316] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.316] lstrlenW (lpString=".xls") returned 4
	[0085.316] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.316] lstrlenW (lpString=".xlsx") returned 5
	[0085.316] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.316] lstrlenW (lpString=".ppt") returned 4
	[0085.316] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0085.316] lstrlenW (lpString=".zip") returned 4
	[0085.316] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.316] lstrlenW (lpString=".rar") returned 4
	[0085.317] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.317] lstrlenW (lpString=".bz2") returned 4
	[0085.317] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.317] lstrlenW (lpString=".7z") returned 3
	[0085.317] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0085.317] lstrlenW (lpString=".dbf") returned 4
	[0085.317] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0085.317] lstrlenW (lpString=".1cd") returned 4
	[0085.317] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0085.317] lstrlenW (lpString=".jpg") returned 4
	[0085.317] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.317] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.317] lstrlenW (lpString="PowerPointMUI.XML") returned 17
	[0085.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.318] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1450) returned 1
	[0085.318] CloseHandle (hObject=0x1a4) returned 1
	[0085.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20
	[0085.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.319] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.319] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.322] GetLastError () returned 0x0
	[0085.322] ReadFile (in: hFile=0x1a4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x5aa, lpOverlapped=0x0) returned 1
	[0085.324] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0085.325] ReadFile (in: hFile=0x1a4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.325] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0085.326] SetEndOfFile (hFile=0x198) returned 1
	[0085.326] CloseHandle (hObject=0x198) returned 1
	[0085.326] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.326] SetEndOfFile (hFile=0x1a4) returned 1
	[0085.327] CloseHandle (hObject=0x1a4) returned 1
	[0085.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.327] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1
	[0085.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0085.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0085.328] lstrlenW (lpString=".doc") returned 4
	[0085.328] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.328] lstrlenW (lpString=".docx") returned 5
	[0085.328] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0085.328] lstrlenW (lpString=".pdf") returned 4
	[0085.328] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.328] lstrlenW (lpString=".xls") returned 4
	[0085.328] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.328] lstrlenW (lpString=".xlsx") returned 5
	[0085.328] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0085.328] lstrlenW (lpString=".ppt") returned 4
	[0085.328] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0085.328] lstrlenW (lpString=".zip") returned 4
	[0085.328] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.328] lstrlenW (lpString=".rar") returned 4
	[0085.328] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.328] lstrlenW (lpString=".bz2") returned 4
	[0085.329] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.329] lstrlenW (lpString=".7z") returned 3
	[0085.329] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0085.329] lstrlenW (lpString=".dbf") returned 4
	[0085.329] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0085.329] lstrlenW (lpString=".1cd") returned 4
	[0085.329] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0085.329] lstrlenW (lpString=".jpg") returned 4
	[0085.329] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0085.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0085.329] lstrlenW (lpString=".doc") returned 4
	[0085.329] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.329] lstrlenW (lpString=".docx") returned 5
	[0085.329] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0085.329] lstrlenW (lpString=".pdf") returned 4
	[0085.329] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.329] lstrlenW (lpString=".xls") returned 4
	[0085.329] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.329] lstrlenW (lpString=".xlsx") returned 5
	[0085.329] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0085.329] lstrlenW (lpString=".ppt") returned 4
	[0085.330] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0085.330] lstrlenW (lpString=".zip") returned 4
	[0085.330] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.330] lstrlenW (lpString=".rar") returned 4
	[0085.330] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.330] lstrlenW (lpString=".bz2") returned 4
	[0085.330] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.330] lstrlenW (lpString=".7z") returned 3
	[0085.330] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0085.330] lstrlenW (lpString=".dbf") returned 4
	[0085.330] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0085.330] lstrlenW (lpString=".1cd") returned 4
	[0085.330] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0085.330] lstrlenW (lpString=".jpg") returned 4
	[0085.330] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.330] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.330] lstrlenW (lpString="SETUP.XML") returned 9
	[0085.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.332] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1886) returned 1
	[0085.332] CloseHandle (hObject=0x1a4) returned 1
	[0085.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20
	[0085.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.333] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.333] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.333] GetLastError () returned 0x0
	[0085.333] ReadFile (in: hFile=0x1a4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x75e, lpOverlapped=0x0) returned 1
	[0085.337] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x760, lpOverlapped=0x0) returned 1
	[0085.338] ReadFile (in: hFile=0x1a4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.338] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0085.339] SetEndOfFile (hFile=0x198) returned 1
	[0085.339] CloseHandle (hObject=0x198) returned 1
	[0085.339] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.339] SetEndOfFile (hFile=0x1a4) returned 1
	[0085.340] CloseHandle (hObject=0x1a4) returned 1
	[0085.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.341] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1
	[0085.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0085.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0085.341] lstrlenW (lpString=".doc") returned 4
	[0085.341] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.341] lstrlenW (lpString=".docx") returned 5
	[0085.341] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.341] lstrlenW (lpString=".pdf") returned 4
	[0085.341] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.341] lstrlenW (lpString=".xls") returned 4
	[0085.341] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.341] lstrlenW (lpString=".xlsx") returned 5
	[0085.341] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.341] lstrlenW (lpString=".ppt") returned 4
	[0085.341] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0085.341] lstrlenW (lpString=".zip") returned 4
	[0085.342] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.342] lstrlenW (lpString=".rar") returned 4
	[0085.342] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.342] lstrlenW (lpString=".bz2") returned 4
	[0085.342] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.342] lstrlenW (lpString=".7z") returned 3
	[0085.342] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0085.342] lstrlenW (lpString=".dbf") returned 4
	[0085.342] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0085.342] lstrlenW (lpString=".1cd") returned 4
	[0085.342] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0085.342] lstrlenW (lpString=".jpg") returned 4
	[0085.342] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0085.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0085.342] lstrlenW (lpString=".doc") returned 4
	[0085.342] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.342] lstrlenW (lpString=".docx") returned 5
	[0085.342] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.342] lstrlenW (lpString=".pdf") returned 4
	[0085.342] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.342] lstrlenW (lpString=".xls") returned 4
	[0085.343] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.343] lstrlenW (lpString=".xlsx") returned 5
	[0085.343] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.343] lstrlenW (lpString=".ppt") returned 4
	[0085.343] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0085.343] lstrlenW (lpString=".zip") returned 4
	[0085.343] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.343] lstrlenW (lpString=".rar") returned 4
	[0085.343] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.343] lstrlenW (lpString=".bz2") returned 4
	[0085.343] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.343] lstrlenW (lpString=".7z") returned 3
	[0085.343] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0085.343] lstrlenW (lpString=".dbf") returned 4
	[0085.343] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0085.343] lstrlenW (lpString=".1cd") returned 4
	[0085.343] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0085.343] lstrlenW (lpString=".jpg") returned 4
	[0085.343] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.344] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.344] lstrlenW (lpString="PrjProrWW.XML") returned 13
	[0085.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0085.486] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6421) returned 1
	[0085.487] CloseHandle (hObject=0x194) returned 1
	[0085.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20
	[0085.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0085.600] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.601] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0085.743] GetLastError () returned 0x0
	[0085.743] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1915, lpOverlapped=0x0) returned 1
	[0085.764] WriteFile (in: hFile=0x160, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1920, lpOverlapped=0x0) returned 1
	[0085.765] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.765] WriteFile (in: hFile=0x160, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0085.765] SetEndOfFile (hFile=0x160) returned 1
	[0085.837] CloseHandle (hObject=0x160) returned 1
	[0085.883] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.883] SetEndOfFile (hFile=0x1ac) returned 1
	[0085.895] CloseHandle (hObject=0x1ac) returned 1
	[0085.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.896] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1
	[0085.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0085.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0085.896] lstrlenW (lpString=".doc") returned 4
	[0085.896] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.896] lstrlenW (lpString=".docx") returned 5
	[0085.896] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0085.896] lstrlenW (lpString=".pdf") returned 4
	[0085.896] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.896] lstrlenW (lpString=".xls") returned 4
	[0085.896] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.896] lstrlenW (lpString=".xlsx") returned 5
	[0085.896] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0085.896] lstrlenW (lpString=".ppt") returned 4
	[0085.896] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0085.896] lstrlenW (lpString=".zip") returned 4
	[0085.896] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.896] lstrlenW (lpString=".rar") returned 4
	[0085.896] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.896] lstrlenW (lpString=".bz2") returned 4
	[0085.896] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.896] lstrlenW (lpString=".7z") returned 3
	[0085.897] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0085.897] lstrlenW (lpString=".dbf") returned 4
	[0085.897] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0085.897] lstrlenW (lpString=".1cd") returned 4
	[0085.897] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0085.897] lstrlenW (lpString=".jpg") returned 4
	[0085.897] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0085.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0085.897] lstrlenW (lpString=".doc") returned 4
	[0085.897] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.897] lstrlenW (lpString=".docx") returned 5
	[0085.897] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0085.897] lstrlenW (lpString=".pdf") returned 4
	[0085.897] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.897] lstrlenW (lpString=".xls") returned 4
	[0085.897] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.897] lstrlenW (lpString=".xlsx") returned 5
	[0085.897] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0085.897] lstrlenW (lpString=".ppt") returned 4
	[0085.897] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0085.897] lstrlenW (lpString=".zip") returned 4
	[0085.897] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.897] lstrlenW (lpString=".rar") returned 4
	[0085.897] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.897] lstrlenW (lpString=".bz2") returned 4
	[0085.897] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.897] lstrlenW (lpString=".7z") returned 3
	[0085.897] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0085.898] lstrlenW (lpString=".dbf") returned 4
	[0085.898] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0085.898] lstrlenW (lpString=".1cd") returned 4
	[0085.898] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0085.898] lstrlenW (lpString=".jpg") returned 4
	[0085.898] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.898] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.898] lstrlenW (lpString="PublisherMUI.XML") returned 16
	[0085.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0085.898] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1450) returned 1
	[0085.898] CloseHandle (hObject=0x1ac) returned 1
	[0085.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20
	[0085.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0085.899] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.899] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.978] GetLastError () returned 0x0
	[0085.978] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x5aa, lpOverlapped=0x0) returned 1
	[0085.986] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0085.989] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.989] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0085.989] SetEndOfFile (hFile=0x198) returned 1
	[0085.989] CloseHandle (hObject=0x198) returned 1
	[0085.989] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.990] SetEndOfFile (hFile=0x1ac) returned 1
	[0085.990] CloseHandle (hObject=0x1ac) returned 1
	[0085.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.991] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1
	[0085.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0085.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0085.991] lstrlenW (lpString=".doc") returned 4
	[0085.991] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.991] lstrlenW (lpString=".docx") returned 5
	[0085.991] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0085.991] lstrlenW (lpString=".pdf") returned 4
	[0085.991] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.991] lstrlenW (lpString=".xls") returned 4
	[0085.991] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.991] lstrlenW (lpString=".xlsx") returned 5
	[0085.991] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0085.991] lstrlenW (lpString=".ppt") returned 4
	[0085.991] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0085.991] lstrlenW (lpString=".zip") returned 4
	[0085.991] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.991] lstrlenW (lpString=".rar") returned 4
	[0085.991] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.992] lstrlenW (lpString=".bz2") returned 4
	[0085.992] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.992] lstrlenW (lpString=".7z") returned 3
	[0085.992] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0085.992] lstrlenW (lpString=".dbf") returned 4
	[0085.992] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0085.992] lstrlenW (lpString=".1cd") returned 4
	[0085.992] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0085.992] lstrlenW (lpString=".jpg") returned 4
	[0085.992] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0085.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0085.992] lstrlenW (lpString=".doc") returned 4
	[0085.992] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.992] lstrlenW (lpString=".docx") returned 5
	[0085.992] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0085.992] lstrlenW (lpString=".pdf") returned 4
	[0085.992] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.992] lstrlenW (lpString=".xls") returned 4
	[0085.992] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.992] lstrlenW (lpString=".xlsx") returned 5
	[0085.992] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0085.992] lstrlenW (lpString=".ppt") returned 4
	[0085.992] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0085.992] lstrlenW (lpString=".zip") returned 4
	[0085.993] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.993] lstrlenW (lpString=".rar") returned 4
	[0085.993] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.993] lstrlenW (lpString=".bz2") returned 4
	[0085.993] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.993] lstrlenW (lpString=".7z") returned 3
	[0085.993] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0085.993] lstrlenW (lpString=".dbf") returned 4
	[0085.993] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0085.993] lstrlenW (lpString=".1cd") returned 4
	[0085.993] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0085.993] lstrlenW (lpString=".jpg") returned 4
	[0085.993] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.993] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.993] lstrlenW (lpString="SETUP.XML") returned 9
	[0085.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.020] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6241) returned 1
	[0086.020] CloseHandle (hObject=0x19c) returned 1
	[0086.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20
	[0086.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0086.047] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.047] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.048] GetLastError () returned 0x0
	[0086.048] ReadFile (in: hFile=0x1a4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1861, lpOverlapped=0x0) returned 1
	[0086.049] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1870, lpOverlapped=0x0) returned 1
	[0086.050] ReadFile (in: hFile=0x1a4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.050] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0086.051] SetEndOfFile (hFile=0x194) returned 1
	[0086.051] CloseHandle (hObject=0x194) returned 1
	[0086.051] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.051] SetEndOfFile (hFile=0x1a4) returned 1
	[0086.052] CloseHandle (hObject=0x1a4) returned 1
	[0086.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.052] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1
	[0086.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0086.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0086.052] lstrlenW (lpString=".doc") returned 4
	[0086.052] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.052] lstrlenW (lpString=".docx") returned 5
	[0086.052] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0086.052] lstrlenW (lpString=".pdf") returned 4
	[0086.053] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.053] lstrlenW (lpString=".xls") returned 4
	[0086.053] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.053] lstrlenW (lpString=".xlsx") returned 5
	[0086.053] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0086.053] lstrlenW (lpString=".ppt") returned 4
	[0086.053] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0086.053] lstrlenW (lpString=".zip") returned 4
	[0086.053] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.053] lstrlenW (lpString=".rar") returned 4
	[0086.053] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.053] lstrlenW (lpString=".bz2") returned 4
	[0086.053] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.053] lstrlenW (lpString=".7z") returned 3
	[0086.053] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0086.053] lstrlenW (lpString=".dbf") returned 4
	[0086.053] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0086.053] lstrlenW (lpString=".1cd") returned 4
	[0086.053] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0086.053] lstrlenW (lpString=".jpg") returned 4
	[0086.053] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0086.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0086.053] lstrlenW (lpString=".doc") returned 4
	[0086.053] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.053] lstrlenW (lpString=".docx") returned 5
	[0086.053] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0086.053] lstrlenW (lpString=".pdf") returned 4
	[0086.053] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.054] lstrlenW (lpString=".xls") returned 4
	[0086.054] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.054] lstrlenW (lpString=".xlsx") returned 5
	[0086.054] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0086.054] lstrlenW (lpString=".ppt") returned 4
	[0086.054] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0086.054] lstrlenW (lpString=".zip") returned 4
	[0086.054] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.054] lstrlenW (lpString=".rar") returned 4
	[0086.054] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.054] lstrlenW (lpString=".bz2") returned 4
	[0086.054] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.054] lstrlenW (lpString=".7z") returned 3
	[0086.054] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0086.054] lstrlenW (lpString=".dbf") returned 4
	[0086.054] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0086.054] lstrlenW (lpString=".1cd") returned 4
	[0086.054] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0086.054] lstrlenW (lpString=".jpg") returned 4
	[0086.054] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.054] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0086.054] lstrlenW (lpString="SETUP.XML") returned 9
	[0086.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0086.078] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2424) returned 1
	[0086.078] CloseHandle (hObject=0x1a4) returned 1
	[0086.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20
	[0086.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.252] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.252] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.253] GetLastError () returned 0x0
	[0086.253] ReadFile (in: hFile=0x194, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x978, lpOverlapped=0x0) returned 1
	[0086.257] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x980, lpOverlapped=0x0) returned 1
	[0086.259] ReadFile (in: hFile=0x194, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.259] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0086.259] SetEndOfFile (hFile=0x174) returned 1
	[0086.259] CloseHandle (hObject=0x174) returned 1
	[0086.260] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.260] SetEndOfFile (hFile=0x194) returned 1
	[0086.261] CloseHandle (hObject=0x194) returned 1
	[0086.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.261] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1
	[0086.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0086.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0086.262] lstrlenW (lpString=".doc") returned 4
	[0086.262] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.262] lstrlenW (lpString=".docx") returned 5
	[0086.262] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0086.262] lstrlenW (lpString=".pdf") returned 4
	[0086.262] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.262] lstrlenW (lpString=".xls") returned 4
	[0086.262] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.262] lstrlenW (lpString=".xlsx") returned 5
	[0086.262] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0086.262] lstrlenW (lpString=".ppt") returned 4
	[0086.262] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0086.262] lstrlenW (lpString=".zip") returned 4
	[0086.262] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.262] lstrlenW (lpString=".rar") returned 4
	[0086.262] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.262] lstrlenW (lpString=".bz2") returned 4
	[0086.262] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.262] lstrlenW (lpString=".7z") returned 3
	[0086.262] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0086.263] lstrlenW (lpString=".dbf") returned 4
	[0086.263] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0086.263] lstrlenW (lpString=".1cd") returned 4
	[0086.263] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0086.263] lstrlenW (lpString=".jpg") returned 4
	[0086.263] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0086.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0086.263] lstrlenW (lpString=".doc") returned 4
	[0086.263] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.263] lstrlenW (lpString=".docx") returned 5
	[0086.263] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0086.263] lstrlenW (lpString=".pdf") returned 4
	[0086.263] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.263] lstrlenW (lpString=".xls") returned 4
	[0086.263] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.263] lstrlenW (lpString=".xlsx") returned 5
	[0086.263] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0086.263] lstrlenW (lpString=".ppt") returned 4
	[0086.263] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0086.263] lstrlenW (lpString=".zip") returned 4
	[0086.264] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.264] lstrlenW (lpString=".rar") returned 4
	[0086.264] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.264] lstrlenW (lpString=".bz2") returned 4
	[0086.264] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.264] lstrlenW (lpString=".7z") returned 3
	[0086.264] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0086.264] lstrlenW (lpString=".dbf") returned 4
	[0086.264] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0086.264] lstrlenW (lpString=".1cd") returned 4
	[0086.264] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0086.264] lstrlenW (lpString=".jpg") returned 4
	[0086.264] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.264] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0086.264] lstrlenW (lpString="PHONE.XML") returned 9
	[0086.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0086.289] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1844) returned 1
	[0086.289] CloseHandle (hObject=0x1a4) returned 1
	[0086.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20
	[0086.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.646] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.646] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0086.763] GetLastError () returned 0x0
	[0086.763] ReadFile (in: hFile=0x19c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x734, lpOverlapped=0x0) returned 1
	[0086.765] WriteFile (in: hFile=0x188, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x740, lpOverlapped=0x0) returned 1
	[0086.767] ReadFile (in: hFile=0x19c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.767] WriteFile (in: hFile=0x188, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0086.767] SetEndOfFile (hFile=0x188) returned 1
	[0086.769] CloseHandle (hObject=0x188) returned 1
	[0086.770] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.770] SetEndOfFile (hFile=0x19c) returned 1
	[0086.774] CloseHandle (hObject=0x19c) returned 1
	[0086.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.785] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1
	[0086.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0086.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0086.791] lstrlenW (lpString=".doc") returned 4
	[0086.791] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.791] lstrlenW (lpString=".docx") returned 5
	[0086.791] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1
	[0086.791] lstrlenW (lpString=".pdf") returned 4
	[0086.791] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.791] lstrlenW (lpString=".xls") returned 4
	[0086.791] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.791] lstrlenW (lpString=".xlsx") returned 5
	[0086.791] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1
	[0086.791] lstrlenW (lpString=".ppt") returned 4
	[0086.791] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0086.791] lstrlenW (lpString=".zip") returned 4
	[0086.791] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.791] lstrlenW (lpString=".rar") returned 4
	[0086.791] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.791] lstrlenW (lpString=".bz2") returned 4
	[0086.791] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.791] lstrlenW (lpString=".7z") returned 3
	[0086.791] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0086.791] lstrlenW (lpString=".dbf") returned 4
	[0086.792] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0086.792] lstrlenW (lpString=".1cd") returned 4
	[0086.792] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0086.792] lstrlenW (lpString=".jpg") returned 4
	[0086.792] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0086.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0086.792] lstrlenW (lpString=".doc") returned 4
	[0086.792] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.792] lstrlenW (lpString=".docx") returned 5
	[0086.792] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1
	[0086.792] lstrlenW (lpString=".pdf") returned 4
	[0086.792] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.792] lstrlenW (lpString=".xls") returned 4
	[0086.792] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.792] lstrlenW (lpString=".xlsx") returned 5
	[0086.792] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1
	[0086.792] lstrlenW (lpString=".ppt") returned 4
	[0086.792] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0086.792] lstrlenW (lpString=".zip") returned 4
	[0086.792] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.793] lstrlenW (lpString=".rar") returned 4
	[0086.793] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.793] lstrlenW (lpString=".bz2") returned 4
	[0086.793] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.793] lstrlenW (lpString=".7z") returned 3
	[0086.793] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0086.793] lstrlenW (lpString=".dbf") returned 4
	[0086.793] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0086.793] lstrlenW (lpString=".1cd") returned 4
	[0086.793] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0086.793] lstrlenW (lpString=".jpg") returned 4
	[0086.793] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.793] lstrcmpiW (lpString1=".XSL", lpString2=".adobe") returned 1
	[0086.793] lstrlenW (lpString="BASMLA.XSL") returned 10
	[0086.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.795] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=227311) returned 1
	[0086.795] CloseHandle (hObject=0x174) returned 1
	[0086.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20
	[0086.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.795] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.796] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0086.796] GetLastError () returned 0x0
	[0086.796] ReadFile (in: hFile=0x174, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x377ef, lpOverlapped=0x0) returned 1
	[0086.805] WriteFile (in: hFile=0x178, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x377f0, lpOverlapped=0x0) returned 1
	[0086.810] ReadFile (in: hFile=0x174, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.810] WriteFile (in: hFile=0x178, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0086.810] SetEndOfFile (hFile=0x178) returned 1
	[0086.810] CloseHandle (hObject=0x178) returned 1
	[0086.810] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.810] SetEndOfFile (hFile=0x174) returned 1
	[0086.813] CloseHandle (hObject=0x174) returned 1
	[0086.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.814] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1
	[0086.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0086.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0086.814] lstrlenW (lpString=".doc") returned 4
	[0086.814] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1
	[0086.814] lstrlenW (lpString=".docx") returned 5
	[0086.814] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1
	[0086.814] lstrlenW (lpString=".pdf") returned 4
	[0086.814] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1
	[0086.814] lstrlenW (lpString=".xls") returned 4
	[0086.814] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1
	[0086.814] lstrlenW (lpString=".xlsx") returned 5
	[0086.814] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1
	[0086.814] lstrlenW (lpString=".ppt") returned 4
	[0086.814] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1
	[0086.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0086.814] lstrlenW (lpString=".zip") returned 4
	[0086.814] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1
	[0086.815] lstrlenW (lpString=".rar") returned 4
	[0086.815] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1
	[0086.815] lstrlenW (lpString=".bz2") returned 4
	[0086.815] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1
	[0086.815] lstrlenW (lpString=".7z") returned 3
	[0086.815] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1
	[0086.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0086.815] lstrlenW (lpString=".dbf") returned 4
	[0086.815] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1
	[0086.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0086.815] lstrlenW (lpString=".1cd") returned 4
	[0086.815] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1
	[0086.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0086.815] lstrlenW (lpString=".jpg") returned 4
	[0086.815] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1
	[0086.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0086.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0086.815] lstrlenW (lpString=".doc") returned 4
	[0086.815] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1
	[0086.815] lstrlenW (lpString=".docx") returned 5
	[0086.815] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1
	[0086.815] lstrlenW (lpString=".pdf") returned 4
	[0086.815] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1
	[0086.815] lstrlenW (lpString=".xls") returned 4
	[0086.815] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1
	[0086.815] lstrlenW (lpString=".xlsx") returned 5
	[0086.816] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1
	[0086.816] lstrlenW (lpString=".ppt") returned 4
	[0086.816] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1
	[0086.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0086.816] lstrlenW (lpString=".zip") returned 4
	[0086.816] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1
	[0086.816] lstrlenW (lpString=".rar") returned 4
	[0086.816] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1
	[0086.816] lstrlenW (lpString=".bz2") returned 4
	[0086.816] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1
	[0086.816] lstrlenW (lpString=".7z") returned 3
	[0086.816] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1
	[0086.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0086.816] lstrlenW (lpString=".dbf") returned 4
	[0086.816] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1
	[0086.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0086.816] lstrlenW (lpString=".1cd") returned 4
	[0086.816] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1
	[0086.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0086.816] lstrlenW (lpString=".jpg") returned 4
	[0086.816] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1
	[0086.816] lstrcmpiW (lpString1=".TXT", lpString2=".adobe") returned 1
	[0086.817] lstrlenW (lpString="METCONV.TXT") returned 11
	[0086.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0086.835] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1183416) returned 1
	[0086.835] CloseHandle (hObject=0x1a4) returned 1
	[0086.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20
	[0086.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0086.836] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.836] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.836] GetLastError () returned 0x0
	[0086.836] ReadFile (in: hFile=0x1a4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0086.867] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0086.896] ReadFile (in: hFile=0x1a4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x20ec8, lpOverlapped=0x0) returned 1
	[0086.913] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x20ed0, lpOverlapped=0x0) returned 1
	[0086.921] ReadFile (in: hFile=0x1a4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.922] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0086.922] SetEndOfFile (hFile=0x174) returned 1
	[0086.922] CloseHandle (hObject=0x174) returned 1
	[0086.922] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.922] SetEndOfFile (hFile=0x1a4) returned 1
	[0086.924] CloseHandle (hObject=0x1a4) returned 1
	[0086.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.925] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1
	[0086.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0086.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0086.925] lstrlenW (lpString=".doc") returned 4
	[0086.925] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1
	[0086.925] lstrlenW (lpString=".docx") returned 5
	[0086.925] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1
	[0086.925] lstrlenW (lpString=".pdf") returned 4
	[0086.925] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1
	[0086.925] lstrlenW (lpString=".xls") returned 4
	[0086.925] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1
	[0086.925] lstrlenW (lpString=".xlsx") returned 5
	[0086.926] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1
	[0086.926] lstrlenW (lpString=".ppt") returned 4
	[0086.926] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1
	[0086.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0086.926] lstrlenW (lpString=".zip") returned 4
	[0086.926] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1
	[0086.926] lstrlenW (lpString=".rar") returned 4
	[0086.926] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1
	[0086.926] lstrlenW (lpString=".bz2") returned 4
	[0086.926] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1
	[0086.926] lstrlenW (lpString=".7z") returned 3
	[0086.926] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1
	[0086.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0086.926] lstrlenW (lpString=".dbf") returned 4
	[0086.926] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1
	[0086.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0086.926] lstrlenW (lpString=".1cd") returned 4
	[0086.926] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1
	[0086.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0086.926] lstrlenW (lpString=".jpg") returned 4
	[0086.926] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1
	[0086.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0086.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0086.926] lstrlenW (lpString=".doc") returned 4
	[0086.926] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1
	[0086.927] lstrlenW (lpString=".docx") returned 5
	[0086.927] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1
	[0086.927] lstrlenW (lpString=".pdf") returned 4
	[0086.927] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1
	[0086.927] lstrlenW (lpString=".xls") returned 4
	[0086.927] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1
	[0086.927] lstrlenW (lpString=".xlsx") returned 5
	[0086.927] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1
	[0086.927] lstrlenW (lpString=".ppt") returned 4
	[0086.927] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1
	[0086.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0086.927] lstrlenW (lpString=".zip") returned 4
	[0086.927] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1
	[0086.927] lstrlenW (lpString=".rar") returned 4
	[0086.927] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1
	[0086.927] lstrlenW (lpString=".bz2") returned 4
	[0086.927] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1
	[0086.927] lstrlenW (lpString=".7z") returned 3
	[0086.927] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1
	[0086.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0086.927] lstrlenW (lpString=".dbf") returned 4
	[0086.927] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1
	[0086.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0086.927] lstrlenW (lpString=".1cd") returned 4
	[0086.927] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1
	[0086.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0086.927] lstrlenW (lpString=".jpg") returned 4
	[0086.928] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1
	[0086.928] lstrcmpiW (lpString1=".htm", lpString2=".adobe") returned 1
	[0086.928] lstrlenW (lpString="Bears.htm") returned 9
	[0086.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.932] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=255) returned 1
	[0086.932] CloseHandle (hObject=0x174) returned 1
	[0086.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20
	[0086.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0086.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0086.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0086.937] lstrlenW (lpString=".doc") returned 4
	[0086.937] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0086.937] lstrlenW (lpString=".docx") returned 5
	[0086.937] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0086.937] lstrlenW (lpString=".pdf") returned 4
	[0086.937] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0086.937] lstrlenW (lpString=".xls") returned 4
	[0086.938] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0086.938] lstrlenW (lpString=".xlsx") returned 5
	[0086.938] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0086.938] lstrlenW (lpString=".ppt") returned 4
	[0086.938] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0086.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0086.938] lstrlenW (lpString=".zip") returned 4
	[0086.938] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0086.938] lstrlenW (lpString=".rar") returned 4
	[0086.938] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0086.938] lstrlenW (lpString=".bz2") returned 4
	[0086.938] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0086.938] lstrlenW (lpString=".7z") returned 3
	[0086.938] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0086.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0086.938] lstrlenW (lpString=".dbf") returned 4
	[0086.938] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0086.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0086.938] lstrlenW (lpString=".1cd") returned 4
	[0086.938] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0086.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0086.938] lstrlenW (lpString=".jpg") returned 4
	[0086.938] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0086.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0086.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0086.939] lstrlenW (lpString=".doc") returned 4
	[0086.939] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0086.939] lstrlenW (lpString=".docx") returned 5
	[0086.939] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0086.939] lstrlenW (lpString=".pdf") returned 4
	[0086.939] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0086.939] lstrlenW (lpString=".xls") returned 4
	[0086.939] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0086.939] lstrlenW (lpString=".xlsx") returned 5
	[0086.939] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0086.939] lstrlenW (lpString=".ppt") returned 4
	[0086.939] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0086.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0086.939] lstrlenW (lpString=".zip") returned 4
	[0086.939] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0086.939] lstrlenW (lpString=".rar") returned 4
	[0086.939] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0086.939] lstrlenW (lpString=".bz2") returned 4
	[0086.939] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0086.939] lstrlenW (lpString=".7z") returned 3
	[0086.939] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0086.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0086.939] lstrlenW (lpString=".dbf") returned 4
	[0086.939] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0086.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0086.939] lstrlenW (lpString=".1cd") returned 4
	[0086.939] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0086.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0086.940] lstrlenW (lpString=".jpg") returned 4
	[0086.940] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0086.940] lstrcmpiW (lpString1=".jpg", lpString2=".adobe") returned 1
	[0086.940] lstrlenW (lpString="Bears.jpg") returned 9
	[0086.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.941] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1074) returned 1
	[0086.941] CloseHandle (hObject=0x174) returned 1
	[0086.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20
	[0086.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0086.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0086.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0086.946] lstrlenW (lpString=".doc") returned 4
	[0086.946] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0086.946] lstrlenW (lpString=".docx") returned 5
	[0086.946] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0086.946] lstrlenW (lpString=".pdf") returned 4
	[0086.946] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0086.946] lstrlenW (lpString=".xls") returned 4
	[0086.946] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0086.946] lstrlenW (lpString=".xlsx") returned 5
	[0086.946] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0086.946] lstrlenW (lpString=".ppt") returned 4
	[0086.946] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0086.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0086.946] lstrlenW (lpString=".zip") returned 4
	[0086.946] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0086.947] lstrlenW (lpString=".rar") returned 4
	[0086.947] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0086.947] lstrlenW (lpString=".bz2") returned 4
	[0086.947] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0086.947] lstrlenW (lpString=".7z") returned 3
	[0086.947] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0086.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0086.947] lstrlenW (lpString=".dbf") returned 4
	[0086.947] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0086.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0086.947] lstrlenW (lpString=".1cd") returned 4
	[0086.947] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0086.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0086.947] lstrlenW (lpString=".jpg") returned 4
	[0086.947] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0086.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0086.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0086.947] lstrlenW (lpString=".doc") returned 4
	[0086.947] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0086.947] lstrlenW (lpString=".docx") returned 5
	[0086.947] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0086.947] lstrlenW (lpString=".pdf") returned 4
	[0086.947] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0086.947] lstrlenW (lpString=".xls") returned 4
	[0086.947] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0086.948] lstrlenW (lpString=".xlsx") returned 5
	[0086.948] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0086.948] lstrlenW (lpString=".ppt") returned 4
	[0086.948] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0086.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0086.948] lstrlenW (lpString=".zip") returned 4
	[0086.948] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0086.948] lstrlenW (lpString=".rar") returned 4
	[0086.948] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0086.948] lstrlenW (lpString=".bz2") returned 4
	[0086.948] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0086.948] lstrlenW (lpString=".7z") returned 3
	[0086.948] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0086.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0086.948] lstrlenW (lpString=".dbf") returned 4
	[0086.948] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0086.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0086.948] lstrlenW (lpString=".1cd") returned 4
	[0086.948] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0086.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0086.948] lstrlenW (lpString=".jpg") returned 4
	[0086.948] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0086.948] lstrcmpiW (lpString1=".jpg", lpString2=".adobe") returned 1
	[0086.949] lstrlenW (lpString="Blue_Gradient.jpg") returned 17
	[0086.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.952] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2575) returned 1
	[0086.952] CloseHandle (hObject=0x174) returned 1
	[0086.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20
	[0086.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0086.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0086.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0086.957] lstrlenW (lpString=".doc") returned 4
	[0086.957] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0086.957] lstrlenW (lpString=".docx") returned 5
	[0086.957] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1
	[0086.957] lstrlenW (lpString=".pdf") returned 4
	[0086.957] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0086.957] lstrlenW (lpString=".xls") returned 4
	[0086.957] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0086.957] lstrlenW (lpString=".xlsx") returned 5
	[0086.957] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1
	[0086.957] lstrlenW (lpString=".ppt") returned 4
	[0086.957] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0086.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0086.957] lstrlenW (lpString=".zip") returned 4
	[0086.957] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0086.957] lstrlenW (lpString=".rar") returned 4
	[0086.957] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0086.957] lstrlenW (lpString=".bz2") returned 4
	[0086.957] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0086.958] lstrlenW (lpString=".7z") returned 3
	[0086.958] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0086.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0086.958] lstrlenW (lpString=".dbf") returned 4
	[0086.958] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0086.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0086.958] lstrlenW (lpString=".1cd") returned 4
	[0086.958] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0086.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0086.958] lstrlenW (lpString=".jpg") returned 4
	[0086.958] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0086.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0086.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0086.958] lstrlenW (lpString=".doc") returned 4
	[0086.958] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0086.958] lstrlenW (lpString=".docx") returned 5
	[0086.958] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1
	[0086.958] lstrlenW (lpString=".pdf") returned 4
	[0086.958] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0086.958] lstrlenW (lpString=".xls") returned 4
	[0086.958] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0086.958] lstrlenW (lpString=".xlsx") returned 5
	[0086.958] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1
	[0086.958] lstrlenW (lpString=".ppt") returned 4
	[0086.958] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0086.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0086.959] lstrlenW (lpString=".zip") returned 4
	[0086.959] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0086.959] lstrlenW (lpString=".rar") returned 4
	[0086.959] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0086.959] lstrlenW (lpString=".bz2") returned 4
	[0086.959] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0086.959] lstrlenW (lpString=".7z") returned 3
	[0086.959] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0086.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0086.959] lstrlenW (lpString=".dbf") returned 4
	[0086.959] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0086.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0086.959] lstrlenW (lpString=".1cd") returned 4
	[0086.959] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0086.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0086.959] lstrlenW (lpString=".jpg") returned 4
	[0086.959] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0086.959] lstrcmpiW (lpString1=".gif", lpString2=".adobe") returned 1
	[0086.960] lstrlenW (lpString="Cave_Drawings.gif") returned 17
	[0086.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.961] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4587) returned 1
	[0086.961] CloseHandle (hObject=0x174) returned 1
	[0086.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20
	[0086.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0086.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0086.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0086.965] lstrlenW (lpString=".doc") returned 4
	[0086.966] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0086.966] lstrlenW (lpString=".docx") returned 5
	[0086.966] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1
	[0086.966] lstrlenW (lpString=".pdf") returned 4
	[0086.966] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0086.966] lstrlenW (lpString=".xls") returned 4
	[0086.966] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0086.966] lstrlenW (lpString=".xlsx") returned 5
	[0086.966] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1
	[0086.966] lstrlenW (lpString=".ppt") returned 4
	[0086.966] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0086.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0086.966] lstrlenW (lpString=".zip") returned 4
	[0086.966] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0086.966] lstrlenW (lpString=".rar") returned 4
	[0086.966] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0086.966] lstrlenW (lpString=".bz2") returned 4
	[0086.966] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0086.966] lstrlenW (lpString=".7z") returned 3
	[0086.966] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0086.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0086.966] lstrlenW (lpString=".dbf") returned 4
	[0086.966] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0086.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0086.966] lstrlenW (lpString=".1cd") returned 4
	[0086.966] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0086.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0086.967] lstrlenW (lpString=".jpg") returned 4
	[0086.967] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0086.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0086.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0086.967] lstrlenW (lpString=".doc") returned 4
	[0086.967] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0086.967] lstrlenW (lpString=".docx") returned 5
	[0086.967] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1
	[0086.967] lstrlenW (lpString=".pdf") returned 4
	[0086.967] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0086.967] lstrlenW (lpString=".xls") returned 4
	[0086.967] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0086.967] lstrlenW (lpString=".xlsx") returned 5
	[0086.967] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1
	[0086.967] lstrlenW (lpString=".ppt") returned 4
	[0086.967] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0086.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0086.967] lstrlenW (lpString=".zip") returned 4
	[0086.967] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0086.967] lstrlenW (lpString=".rar") returned 4
	[0086.967] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0086.967] lstrlenW (lpString=".bz2") returned 4
	[0086.967] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0086.967] lstrlenW (lpString=".7z") returned 3
	[0086.967] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0086.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0086.968] lstrlenW (lpString=".dbf") returned 4
	[0086.968] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0086.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0086.968] lstrlenW (lpString=".1cd") returned 4
	[0086.968] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0086.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0086.968] lstrlenW (lpString=".jpg") returned 4
	[0086.968] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0086.968] lstrcmpiW (lpString1=".gif", lpString2=".adobe") returned 1
	[0086.968] lstrlenW (lpString="Connectivity.gif") returned 16
	[0086.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.969] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2319) returned 1
	[0086.969] CloseHandle (hObject=0x174) returned 1
	[0086.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20
	[0086.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0086.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0086.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0086.974] lstrlenW (lpString=".doc") returned 4
	[0086.974] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0086.974] lstrlenW (lpString=".docx") returned 5
	[0086.974] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1
	[0086.974] lstrlenW (lpString=".pdf") returned 4
	[0086.974] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0086.974] lstrlenW (lpString=".xls") returned 4
	[0086.974] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0086.974] lstrlenW (lpString=".xlsx") returned 5
	[0086.974] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1
	[0086.974] lstrlenW (lpString=".ppt") returned 4
	[0086.974] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0086.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0086.974] lstrlenW (lpString=".zip") returned 4
	[0086.974] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0086.975] lstrlenW (lpString=".rar") returned 4
	[0086.975] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0086.975] lstrlenW (lpString=".bz2") returned 4
	[0086.975] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0086.975] lstrlenW (lpString=".7z") returned 3
	[0086.975] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0086.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0086.975] lstrlenW (lpString=".dbf") returned 4
	[0086.975] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0086.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0086.975] lstrlenW (lpString=".1cd") returned 4
	[0086.975] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0086.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0086.975] lstrlenW (lpString=".jpg") returned 4
	[0086.975] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0086.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0086.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0086.975] lstrlenW (lpString=".doc") returned 4
	[0086.975] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0086.975] lstrlenW (lpString=".docx") returned 5
	[0086.975] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1
	[0086.975] lstrlenW (lpString=".pdf") returned 4
	[0086.975] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0086.975] lstrlenW (lpString=".xls") returned 4
	[0086.975] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0086.976] lstrlenW (lpString=".xlsx") returned 5
	[0086.976] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1
	[0086.976] lstrlenW (lpString=".ppt") returned 4
	[0086.976] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0086.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0086.976] lstrlenW (lpString=".zip") returned 4
	[0086.976] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0086.976] lstrlenW (lpString=".rar") returned 4
	[0086.976] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0086.976] lstrlenW (lpString=".bz2") returned 4
	[0086.976] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0086.976] lstrlenW (lpString=".7z") returned 3
	[0086.976] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0086.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0086.976] lstrlenW (lpString=".dbf") returned 4
	[0086.976] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0086.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0086.976] lstrlenW (lpString=".1cd") returned 4
	[0086.976] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0086.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0086.976] lstrlenW (lpString=".jpg") returned 4
	[0086.976] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0086.977] lstrcmpiW (lpString1=".ini", lpString2=".adobe") returned 1
	[0086.977] lstrlenW (lpString="Desktop.ini") returned 11
	[0086.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.978] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=645) returned 1
	[0086.978] CloseHandle (hObject=0x174) returned 1
	[0086.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26
	[0086.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.982] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.982] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.983] GetLastError () returned 0x0
	[0086.983] ReadFile (in: hFile=0x174, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x285, lpOverlapped=0x0) returned 1
	[0086.984] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x290, lpOverlapped=0x0) returned 1
	[0086.989] ReadFile (in: hFile=0x174, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.989] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0086.989] SetEndOfFile (hFile=0x194) returned 1
	[0086.989] CloseHandle (hObject=0x194) returned 1
	[0086.989] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.989] SetEndOfFile (hFile=0x174) returned 1
	[0086.990] CloseHandle (hObject=0x174) returned 1
	[0086.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x26) returned 1
	[0086.994] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1
	[0086.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0086.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0086.995] lstrlenW (lpString=".doc") returned 4
	[0086.995] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0086.995] lstrlenW (lpString=".docx") returned 5
	[0086.995] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0086.995] lstrlenW (lpString=".pdf") returned 4
	[0086.995] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0086.995] lstrlenW (lpString=".xls") returned 4
	[0086.995] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0086.995] lstrlenW (lpString=".xlsx") returned 5
	[0086.995] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0086.995] lstrlenW (lpString=".ppt") returned 4
	[0086.995] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0086.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0086.995] lstrlenW (lpString=".zip") returned 4
	[0086.995] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0086.995] lstrlenW (lpString=".rar") returned 4
	[0086.995] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0086.995] lstrlenW (lpString=".bz2") returned 4
	[0086.995] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0086.995] lstrlenW (lpString=".7z") returned 3
	[0086.995] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0086.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0086.996] lstrlenW (lpString=".dbf") returned 4
	[0086.996] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0086.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0086.996] lstrlenW (lpString=".1cd") returned 4
	[0086.996] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0086.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0086.996] lstrlenW (lpString=".jpg") returned 4
	[0086.996] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0086.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0086.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0086.996] lstrlenW (lpString=".doc") returned 4
	[0086.996] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0086.996] lstrlenW (lpString=".docx") returned 5
	[0086.996] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0086.996] lstrlenW (lpString=".pdf") returned 4
	[0086.996] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0086.996] lstrlenW (lpString=".xls") returned 4
	[0086.996] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0086.996] lstrlenW (lpString=".xlsx") returned 5
	[0086.996] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0086.996] lstrlenW (lpString=".ppt") returned 4
	[0086.996] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0086.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0086.997] lstrlenW (lpString=".zip") returned 4
	[0086.997] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0086.997] lstrlenW (lpString=".rar") returned 4
	[0086.997] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0086.997] lstrlenW (lpString=".bz2") returned 4
	[0086.997] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0086.997] lstrlenW (lpString=".7z") returned 3
	[0086.997] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0086.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0086.997] lstrlenW (lpString=".dbf") returned 4
	[0086.997] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0086.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0086.997] lstrlenW (lpString=".1cd") returned 4
	[0086.997] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0086.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0086.997] lstrlenW (lpString=".jpg") returned 4
	[0086.997] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0086.997] lstrcmpiW (lpString1=".emf", lpString2=".adobe") returned 1
	[0086.997] lstrlenW (lpString="Dotted_Lines.emf") returned 16
	[0086.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.998] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3792) returned 1
	[0086.998] CloseHandle (hObject=0x174) returned 1
	[0086.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20
	[0086.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0086.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0086.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0086.999] lstrlenW (lpString=".doc") returned 4
	[0086.999] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0086.999] lstrlenW (lpString=".docx") returned 5
	[0086.999] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1
	[0086.999] lstrlenW (lpString=".pdf") returned 4
	[0086.999] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0086.999] lstrlenW (lpString=".xls") returned 4
	[0086.999] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0086.999] lstrlenW (lpString=".xlsx") returned 5
	[0086.999] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1
	[0086.999] lstrlenW (lpString=".ppt") returned 4
	[0086.999] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0086.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0086.999] lstrlenW (lpString=".zip") returned 4
	[0086.999] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0086.999] lstrlenW (lpString=".rar") returned 4
	[0086.999] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0086.999] lstrlenW (lpString=".bz2") returned 4
	[0086.999] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0086.999] lstrlenW (lpString=".7z") returned 3
	[0086.999] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0086.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0086.999] lstrlenW (lpString=".dbf") returned 4
	[0086.999] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0086.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0087.000] lstrlenW (lpString=".1cd") returned 4
	[0087.000] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0087.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0087.000] lstrlenW (lpString=".jpg") returned 4
	[0087.000] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0087.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0087.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0087.000] lstrlenW (lpString=".doc") returned 4
	[0087.000] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0087.000] lstrlenW (lpString=".docx") returned 5
	[0087.000] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1
	[0087.000] lstrlenW (lpString=".pdf") returned 4
	[0087.000] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0087.000] lstrlenW (lpString=".xls") returned 4
	[0087.000] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0087.000] lstrlenW (lpString=".xlsx") returned 5
	[0087.000] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1
	[0087.000] lstrlenW (lpString=".ppt") returned 4
	[0087.000] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0087.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0087.000] lstrlenW (lpString=".zip") returned 4
	[0087.000] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0087.000] lstrlenW (lpString=".rar") returned 4
	[0087.000] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0087.001] lstrlenW (lpString=".bz2") returned 4
	[0087.001] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0087.001] lstrlenW (lpString=".7z") returned 3
	[0087.001] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0087.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0087.001] lstrlenW (lpString=".dbf") returned 4
	[0087.001] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0087.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0087.001] lstrlenW (lpString=".1cd") returned 4
	[0087.001] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0087.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0087.001] lstrlenW (lpString=".jpg") returned 4
	[0087.001] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0087.001] lstrcmpiW (lpString1=".htm", lpString2=".adobe") returned 1
	[0087.001] lstrlenW (lpString="Garden.htm") returned 10
	[0087.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.002] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=231) returned 1
	[0087.002] CloseHandle (hObject=0x174) returned 1
	[0087.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20
	[0087.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0087.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0087.002] lstrlenW (lpString=".doc") returned 4
	[0087.002] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0087.002] lstrlenW (lpString=".docx") returned 5
	[0087.002] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1
	[0087.002] lstrlenW (lpString=".pdf") returned 4
	[0087.003] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0087.003] lstrlenW (lpString=".xls") returned 4
	[0087.003] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0087.003] lstrlenW (lpString=".xlsx") returned 5
	[0087.003] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1
	[0087.003] lstrlenW (lpString=".ppt") returned 4
	[0087.003] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0087.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0087.003] lstrlenW (lpString=".zip") returned 4
	[0087.003] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0087.003] lstrlenW (lpString=".rar") returned 4
	[0087.003] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0087.003] lstrlenW (lpString=".bz2") returned 4
	[0087.003] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0087.003] lstrlenW (lpString=".7z") returned 3
	[0087.003] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0087.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0087.003] lstrlenW (lpString=".dbf") returned 4
	[0087.003] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0087.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0087.003] lstrlenW (lpString=".1cd") returned 4
	[0087.003] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0087.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0087.003] lstrlenW (lpString=".jpg") returned 4
	[0087.003] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0087.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0087.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0087.004] lstrlenW (lpString=".doc") returned 4
	[0087.004] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0087.004] lstrlenW (lpString=".docx") returned 5
	[0087.004] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1
	[0087.004] lstrlenW (lpString=".pdf") returned 4
	[0087.004] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0087.004] lstrlenW (lpString=".xls") returned 4
	[0087.004] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0087.004] lstrlenW (lpString=".xlsx") returned 5
	[0087.004] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1
	[0087.004] lstrlenW (lpString=".ppt") returned 4
	[0087.004] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0087.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0087.004] lstrlenW (lpString=".zip") returned 4
	[0087.004] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0087.004] lstrlenW (lpString=".rar") returned 4
	[0087.004] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0087.004] lstrlenW (lpString=".bz2") returned 4
	[0087.004] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0087.004] lstrlenW (lpString=".7z") returned 3
	[0087.004] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0087.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0087.004] lstrlenW (lpString=".dbf") returned 4
	[0087.004] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0087.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0087.005] lstrlenW (lpString=".1cd") returned 4
	[0087.005] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0087.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0087.005] lstrlenW (lpString=".jpg") returned 4
	[0087.005] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0087.005] lstrcmpiW (lpString1=".jpg", lpString2=".adobe") returned 1
	[0087.005] lstrlenW (lpString="Garden.jpg") returned 10
	[0087.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.005] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=23871) returned 1
	[0087.005] CloseHandle (hObject=0x174) returned 1
	[0087.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20
	[0087.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0087.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0087.006] lstrlenW (lpString=".doc") returned 4
	[0087.006] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0087.006] lstrlenW (lpString=".docx") returned 5
	[0087.006] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1
	[0087.006] lstrlenW (lpString=".pdf") returned 4
	[0087.006] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0087.006] lstrlenW (lpString=".xls") returned 4
	[0087.006] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0087.006] lstrlenW (lpString=".xlsx") returned 5
	[0087.006] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1
	[0087.006] lstrlenW (lpString=".ppt") returned 4
	[0087.006] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0087.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0087.007] lstrlenW (lpString=".zip") returned 4
	[0087.007] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0087.007] lstrlenW (lpString=".rar") returned 4
	[0087.007] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0087.007] lstrlenW (lpString=".bz2") returned 4
	[0087.007] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0087.007] lstrlenW (lpString=".7z") returned 3
	[0087.007] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0087.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0087.007] lstrlenW (lpString=".dbf") returned 4
	[0087.007] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0087.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0087.007] lstrlenW (lpString=".1cd") returned 4
	[0087.007] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0087.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0087.007] lstrlenW (lpString=".jpg") returned 4
	[0087.007] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0087.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0087.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0087.007] lstrlenW (lpString=".doc") returned 4
	[0087.007] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0087.007] lstrlenW (lpString=".docx") returned 5
	[0087.007] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1
	[0087.007] lstrlenW (lpString=".pdf") returned 4
	[0087.007] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0087.008] lstrlenW (lpString=".xls") returned 4
	[0087.008] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0087.008] lstrlenW (lpString=".xlsx") returned 5
	[0087.008] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1
	[0087.008] lstrlenW (lpString=".ppt") returned 4
	[0087.008] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0087.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0087.008] lstrlenW (lpString=".zip") returned 4
	[0087.008] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0087.008] lstrlenW (lpString=".rar") returned 4
	[0087.008] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0087.008] lstrlenW (lpString=".bz2") returned 4
	[0087.008] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0087.008] lstrlenW (lpString=".7z") returned 3
	[0087.008] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0087.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0087.008] lstrlenW (lpString=".dbf") returned 4
	[0087.008] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0087.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0087.008] lstrlenW (lpString=".1cd") returned 4
	[0087.008] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0087.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0087.008] lstrlenW (lpString=".jpg") returned 4
	[0087.008] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0087.009] lstrcmpiW (lpString1=".emf", lpString2=".adobe") returned 1
	[0087.009] lstrlenW (lpString="Genko_1.emf") returned 11
	[0087.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0087.025] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5524) returned 1
	[0087.025] CloseHandle (hObject=0x19c) returned 1
	[0087.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20
	[0087.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0087.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0087.054] lstrlenW (lpString=".doc") returned 4
	[0087.054] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0087.054] lstrlenW (lpString=".docx") returned 5
	[0087.054] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1
	[0087.054] lstrlenW (lpString=".pdf") returned 4
	[0087.054] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0087.054] lstrlenW (lpString=".xls") returned 4
	[0087.054] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0087.054] lstrlenW (lpString=".xlsx") returned 5
	[0087.054] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1
	[0087.054] lstrlenW (lpString=".ppt") returned 4
	[0087.054] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0087.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0087.054] lstrlenW (lpString=".zip") returned 4
	[0087.054] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0087.054] lstrlenW (lpString=".rar") returned 4
	[0087.054] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0087.054] lstrlenW (lpString=".bz2") returned 4
	[0087.054] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0087.054] lstrlenW (lpString=".7z") returned 3
	[0087.054] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0087.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0087.054] lstrlenW (lpString=".dbf") returned 4
	[0087.054] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0087.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0087.055] lstrlenW (lpString=".1cd") returned 4
	[0087.055] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0087.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0087.055] lstrlenW (lpString=".jpg") returned 4
	[0087.055] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0087.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0087.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0087.055] lstrlenW (lpString=".doc") returned 4
	[0087.055] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0087.055] lstrlenW (lpString=".docx") returned 5
	[0087.055] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1
	[0087.055] lstrlenW (lpString=".pdf") returned 4
	[0087.055] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0087.055] lstrlenW (lpString=".xls") returned 4
	[0087.055] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0087.055] lstrlenW (lpString=".xlsx") returned 5
	[0087.055] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1
	[0087.055] lstrlenW (lpString=".ppt") returned 4
	[0087.055] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0087.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0087.055] lstrlenW (lpString=".zip") returned 4
	[0087.055] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0087.055] lstrlenW (lpString=".rar") returned 4
	[0087.055] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0087.055] lstrlenW (lpString=".bz2") returned 4
	[0087.056] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0087.056] lstrlenW (lpString=".7z") returned 3
	[0087.056] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0087.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0087.056] lstrlenW (lpString=".dbf") returned 4
	[0087.056] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0087.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0087.056] lstrlenW (lpString=".1cd") returned 4
	[0087.056] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0087.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0087.056] lstrlenW (lpString=".jpg") returned 4
	[0087.056] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0087.056] lstrcmpiW (lpString1=".htm", lpString2=".adobe") returned 1
	[0087.056] lstrlenW (lpString="Green Bubbles.htm") returned 17
	[0087.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0087.122] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=237) returned 1
	[0087.122] CloseHandle (hObject=0x194) returned 1
	[0087.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20
	[0087.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0087.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0087.187] lstrlenW (lpString=".doc") returned 4
	[0087.188] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0087.188] lstrlenW (lpString=".docx") returned 5
	[0087.188] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0087.188] lstrlenW (lpString=".pdf") returned 4
	[0087.188] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0087.188] lstrlenW (lpString=".xls") returned 4
	[0087.188] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0087.188] lstrlenW (lpString=".xlsx") returned 5
	[0087.188] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0087.188] lstrlenW (lpString=".ppt") returned 4
	[0087.188] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0087.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0087.188] lstrlenW (lpString=".zip") returned 4
	[0087.188] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0087.188] lstrlenW (lpString=".rar") returned 4
	[0087.188] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0087.188] lstrlenW (lpString=".bz2") returned 4
	[0087.188] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0087.188] lstrlenW (lpString=".7z") returned 3
	[0087.188] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0087.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0087.188] lstrlenW (lpString=".dbf") returned 4
	[0087.188] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0087.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0087.188] lstrlenW (lpString=".1cd") returned 4
	[0087.188] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0087.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0087.188] lstrlenW (lpString=".jpg") returned 4
	[0087.189] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0087.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0087.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0087.189] lstrlenW (lpString=".doc") returned 4
	[0087.189] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0087.189] lstrlenW (lpString=".docx") returned 5
	[0087.189] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0087.189] lstrlenW (lpString=".pdf") returned 4
	[0087.189] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0087.189] lstrlenW (lpString=".xls") returned 4
	[0087.189] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0087.189] lstrlenW (lpString=".xlsx") returned 5
	[0087.189] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0087.189] lstrlenW (lpString=".ppt") returned 4
	[0087.189] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0087.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0087.189] lstrlenW (lpString=".zip") returned 4
	[0087.189] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0087.189] lstrlenW (lpString=".rar") returned 4
	[0087.189] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0087.189] lstrlenW (lpString=".bz2") returned 4
	[0087.189] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0087.189] lstrlenW (lpString=".7z") returned 3
	[0087.189] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0087.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0087.189] lstrlenW (lpString=".dbf") returned 4
	[0087.190] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0087.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0087.190] lstrlenW (lpString=".1cd") returned 4
	[0087.190] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0087.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0087.190] lstrlenW (lpString=".jpg") returned 4
	[0087.190] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0087.190] lstrcmpiW (lpString1=".wmf", lpString2=".adobe") returned 1
	[0087.190] lstrlenW (lpString="grid_(inch).wmf") returned 15
	[0087.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.236] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7498) returned 1
	[0087.236] CloseHandle (hObject=0x1ac) returned 1
	[0087.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20
	[0087.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0087.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0087.275] lstrlenW (lpString=".doc") returned 4
	[0087.275] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1
	[0087.275] lstrlenW (lpString=".docx") returned 5
	[0087.275] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1
	[0087.275] lstrlenW (lpString=".pdf") returned 4
	[0087.275] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1
	[0087.275] lstrlenW (lpString=".xls") returned 4
	[0087.276] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1
	[0087.276] lstrlenW (lpString=".xlsx") returned 5
	[0087.276] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1
	[0087.276] lstrlenW (lpString=".ppt") returned 4
	[0087.276] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1
	[0087.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0087.276] lstrlenW (lpString=".zip") returned 4
	[0087.276] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1
	[0087.276] lstrlenW (lpString=".rar") returned 4
	[0087.276] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1
	[0087.276] lstrlenW (lpString=".bz2") returned 4
	[0087.276] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1
	[0087.276] lstrlenW (lpString=".7z") returned 3
	[0087.276] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1
	[0087.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0087.276] lstrlenW (lpString=".dbf") returned 4
	[0087.276] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1
	[0088.558] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.558] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.573] GetLastError () returned 0x0
	[0088.573] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x618, lpOverlapped=0x0) returned 1
	[0088.581] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x620, lpOverlapped=0x0) returned 1
	[0088.583] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.583] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.583] SetEndOfFile (hFile=0x174) returned 1
	[0088.583] CloseHandle (hObject=0x174) returned 1
	[0088.583] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.584] SetEndOfFile (hFile=0x1ac) returned 1
	[0088.584] CloseHandle (hObject=0x1ac) returned 1
	[0088.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.585] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1
	[0088.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0088.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0088.586] lstrlenW (lpString=".doc") returned 4
	[0088.586] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.586] lstrlenW (lpString=".docx") returned 5
	[0088.586] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.586] lstrlenW (lpString=".pdf") returned 4
	[0088.586] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.586] lstrlenW (lpString=".xls") returned 4
	[0088.586] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.586] lstrlenW (lpString=".xlsx") returned 5
	[0088.586] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.586] lstrlenW (lpString=".ppt") returned 4
	[0088.586] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0088.586] lstrlenW (lpString=".zip") returned 4
	[0088.586] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.586] lstrlenW (lpString=".rar") returned 4
	[0088.586] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.586] lstrlenW (lpString=".bz2") returned 4
	[0088.586] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.586] lstrlenW (lpString=".7z") returned 3
	[0088.586] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0088.587] lstrlenW (lpString=".dbf") returned 4
	[0088.587] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0088.587] lstrlenW (lpString=".1cd") returned 4
	[0088.587] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0088.587] lstrlenW (lpString=".jpg") returned 4
	[0088.587] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0088.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0088.587] lstrlenW (lpString=".doc") returned 4
	[0088.587] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.587] lstrlenW (lpString=".docx") returned 5
	[0088.587] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.587] lstrlenW (lpString=".pdf") returned 4
	[0088.587] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.587] lstrlenW (lpString=".xls") returned 4
	[0088.587] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.587] lstrlenW (lpString=".xlsx") returned 5
	[0088.587] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.588] lstrlenW (lpString=".ppt") returned 4
	[0088.588] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0088.588] lstrlenW (lpString=".zip") returned 4
	[0088.588] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.588] lstrlenW (lpString=".rar") returned 4
	[0088.588] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.588] lstrlenW (lpString=".bz2") returned 4
	[0088.588] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.588] lstrlenW (lpString=".7z") returned 3
	[0088.588] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0088.588] lstrlenW (lpString=".dbf") returned 4
	[0088.588] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0088.588] lstrlenW (lpString=".1cd") returned 4
	[0088.588] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0088.588] lstrlenW (lpString=".jpg") returned 4
	[0088.588] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.588] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.588] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0088.589] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1925) returned 1
	[0088.589] CloseHandle (hObject=0x1ac) returned 1
	[0088.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20
	[0088.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0088.590] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.590] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.611] GetLastError () returned 0x0
	[0088.611] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x785, lpOverlapped=0x0) returned 1
	[0088.616] WriteFile (in: hFile=0x188, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x790, lpOverlapped=0x0) returned 1
	[0088.617] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.617] WriteFile (in: hFile=0x188, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.618] SetEndOfFile (hFile=0x188) returned 1
	[0088.618] CloseHandle (hObject=0x188) returned 1
	[0088.618] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.618] SetEndOfFile (hFile=0x1ac) returned 1
	[0088.619] CloseHandle (hObject=0x1ac) returned 1
	[0088.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.619] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1
	[0088.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0088.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0088.620] lstrlenW (lpString=".doc") returned 4
	[0088.620] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.620] lstrlenW (lpString=".docx") returned 5
	[0088.620] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.620] lstrlenW (lpString=".pdf") returned 4
	[0088.620] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.620] lstrlenW (lpString=".xls") returned 4
	[0088.620] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.620] lstrlenW (lpString=".xlsx") returned 5
	[0088.620] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.620] lstrlenW (lpString=".ppt") returned 4
	[0088.620] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0088.620] lstrlenW (lpString=".zip") returned 4
	[0088.620] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.620] lstrlenW (lpString=".rar") returned 4
	[0088.620] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.620] lstrlenW (lpString=".bz2") returned 4
	[0088.620] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.620] lstrlenW (lpString=".7z") returned 3
	[0088.621] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0088.621] lstrlenW (lpString=".dbf") returned 4
	[0088.621] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0088.621] lstrlenW (lpString=".1cd") returned 4
	[0088.621] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0088.621] lstrlenW (lpString=".jpg") returned 4
	[0088.621] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0088.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0088.621] lstrlenW (lpString=".doc") returned 4
	[0088.621] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.621] lstrlenW (lpString=".docx") returned 5
	[0088.621] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.621] lstrlenW (lpString=".pdf") returned 4
	[0088.621] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.621] lstrlenW (lpString=".xls") returned 4
	[0088.621] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.621] lstrlenW (lpString=".xlsx") returned 5
	[0088.621] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.621] lstrlenW (lpString=".ppt") returned 4
	[0088.621] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0088.622] lstrlenW (lpString=".zip") returned 4
	[0088.622] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.622] lstrlenW (lpString=".rar") returned 4
	[0088.622] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.622] lstrlenW (lpString=".bz2") returned 4
	[0088.622] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.622] lstrlenW (lpString=".7z") returned 3
	[0088.622] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0088.622] lstrlenW (lpString=".dbf") returned 4
	[0088.622] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0088.622] lstrlenW (lpString=".1cd") returned 4
	[0088.622] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0088.622] lstrlenW (lpString=".jpg") returned 4
	[0088.622] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.622] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.622] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0088.623] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3479) returned 1
	[0088.623] CloseHandle (hObject=0x1ac) returned 1
	[0088.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20
	[0088.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0088.624] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.624] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.655] GetLastError () returned 0x0
	[0088.656] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xd97, lpOverlapped=0x0) returned 1
	[0088.661] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xda0, lpOverlapped=0x0) returned 1
	[0088.663] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.663] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.663] SetEndOfFile (hFile=0x174) returned 1
	[0088.663] CloseHandle (hObject=0x174) returned 1
	[0088.663] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.663] SetEndOfFile (hFile=0x1ac) returned 1
	[0088.664] CloseHandle (hObject=0x1ac) returned 1
	[0088.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.665] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1
	[0088.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0088.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0088.665] lstrlenW (lpString=".doc") returned 4
	[0088.665] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.665] lstrlenW (lpString=".docx") returned 5
	[0088.665] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.665] lstrlenW (lpString=".pdf") returned 4
	[0088.665] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.665] lstrlenW (lpString=".xls") returned 4
	[0088.665] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.665] lstrlenW (lpString=".xlsx") returned 5
	[0088.665] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.665] lstrlenW (lpString=".ppt") returned 4
	[0088.665] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0088.666] lstrlenW (lpString=".zip") returned 4
	[0088.666] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.666] lstrlenW (lpString=".rar") returned 4
	[0088.666] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.666] lstrlenW (lpString=".bz2") returned 4
	[0088.666] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.666] lstrlenW (lpString=".7z") returned 3
	[0088.666] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0088.666] lstrlenW (lpString=".dbf") returned 4
	[0088.666] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0088.666] lstrlenW (lpString=".1cd") returned 4
	[0088.666] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0088.666] lstrlenW (lpString=".jpg") returned 4
	[0088.666] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0088.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0088.666] lstrlenW (lpString=".doc") returned 4
	[0088.666] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.666] lstrlenW (lpString=".docx") returned 5
	[0088.666] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.666] lstrlenW (lpString=".pdf") returned 4
	[0088.666] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.667] lstrlenW (lpString=".xls") returned 4
	[0088.667] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.667] lstrlenW (lpString=".xlsx") returned 5
	[0088.667] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.667] lstrlenW (lpString=".ppt") returned 4
	[0088.667] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0088.667] lstrlenW (lpString=".zip") returned 4
	[0088.667] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.667] lstrlenW (lpString=".rar") returned 4
	[0088.667] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.667] lstrlenW (lpString=".bz2") returned 4
	[0088.667] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.667] lstrlenW (lpString=".7z") returned 3
	[0088.667] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0088.667] lstrlenW (lpString=".dbf") returned 4
	[0088.667] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0088.667] lstrlenW (lpString=".1cd") returned 4
	[0088.667] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0088.667] lstrlenW (lpString=".jpg") returned 4
	[0088.667] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.668] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.669] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0088.669] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2722) returned 1
	[0088.669] CloseHandle (hObject=0x1ac) returned 1
	[0088.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20
	[0088.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0088.670] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.670] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.711] GetLastError () returned 0x0
	[0088.711] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xaa2, lpOverlapped=0x0) returned 1
	[0088.720] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xab0, lpOverlapped=0x0) returned 1
	[0088.722] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.722] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.722] SetEndOfFile (hFile=0x174) returned 1
	[0088.722] CloseHandle (hObject=0x174) returned 1
	[0088.723] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.723] SetEndOfFile (hFile=0x1ac) returned 1
	[0088.724] CloseHandle (hObject=0x1ac) returned 1
	[0088.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.724] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1
	[0088.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0088.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0088.724] lstrlenW (lpString=".doc") returned 4
	[0088.724] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.724] lstrlenW (lpString=".docx") returned 5
	[0088.724] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.724] lstrlenW (lpString=".pdf") returned 4
	[0088.725] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.725] lstrlenW (lpString=".xls") returned 4
	[0088.725] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.725] lstrlenW (lpString=".xlsx") returned 5
	[0088.725] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.725] lstrlenW (lpString=".ppt") returned 4
	[0088.725] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0088.725] lstrlenW (lpString=".zip") returned 4
	[0088.725] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.725] lstrlenW (lpString=".rar") returned 4
	[0088.725] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.725] lstrlenW (lpString=".bz2") returned 4
	[0088.725] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.725] lstrlenW (lpString=".7z") returned 3
	[0088.725] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0088.725] lstrlenW (lpString=".dbf") returned 4
	[0088.725] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0088.725] lstrlenW (lpString=".1cd") returned 4
	[0088.725] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0088.725] lstrlenW (lpString=".jpg") returned 4
	[0088.725] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0088.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0088.726] lstrlenW (lpString=".doc") returned 4
	[0088.726] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.726] lstrlenW (lpString=".docx") returned 5
	[0088.726] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.726] lstrlenW (lpString=".pdf") returned 4
	[0088.726] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.726] lstrlenW (lpString=".xls") returned 4
	[0088.726] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.726] lstrlenW (lpString=".xlsx") returned 5
	[0088.726] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.726] lstrlenW (lpString=".ppt") returned 4
	[0088.726] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0088.726] lstrlenW (lpString=".zip") returned 4
	[0088.726] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.726] lstrlenW (lpString=".rar") returned 4
	[0088.726] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.726] lstrlenW (lpString=".bz2") returned 4
	[0088.726] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.726] lstrlenW (lpString=".7z") returned 3
	[0088.726] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0088.726] lstrlenW (lpString=".dbf") returned 4
	[0088.726] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0088.727] lstrlenW (lpString=".1cd") returned 4
	[0088.727] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0088.727] lstrlenW (lpString=".jpg") returned 4
	[0088.727] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.727] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.727] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0088.771] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2044) returned 1
	[0088.771] CloseHandle (hObject=0x1b0) returned 1
	[0088.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20
	[0088.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.822] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.822] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.867] GetLastError () returned 0x0
	[0088.867] ReadFile (in: hFile=0x174, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x7fc, lpOverlapped=0x0) returned 1
	[0088.871] WriteFile (in: hFile=0x188, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x800, lpOverlapped=0x0) returned 1
	[0088.872] ReadFile (in: hFile=0x174, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.872] WriteFile (in: hFile=0x188, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.872] SetEndOfFile (hFile=0x188) returned 1
	[0088.873] CloseHandle (hObject=0x188) returned 1
	[0088.873] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.873] SetEndOfFile (hFile=0x174) returned 1
	[0088.874] CloseHandle (hObject=0x174) returned 1
	[0088.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.874] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1
	[0088.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0088.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0088.874] lstrlenW (lpString=".doc") returned 4
	[0088.874] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.874] lstrlenW (lpString=".docx") returned 5
	[0088.874] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.875] lstrlenW (lpString=".pdf") returned 4
	[0088.875] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.875] lstrlenW (lpString=".xls") returned 4
	[0088.875] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.875] lstrlenW (lpString=".xlsx") returned 5
	[0088.875] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.875] lstrlenW (lpString=".ppt") returned 4
	[0088.875] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0088.875] lstrlenW (lpString=".zip") returned 4
	[0088.875] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.875] lstrlenW (lpString=".rar") returned 4
	[0088.875] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.875] lstrlenW (lpString=".bz2") returned 4
	[0088.875] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.875] lstrlenW (lpString=".7z") returned 3
	[0088.875] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0088.875] lstrlenW (lpString=".dbf") returned 4
	[0088.875] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0088.875] lstrlenW (lpString=".1cd") returned 4
	[0088.875] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0088.875] lstrlenW (lpString=".jpg") returned 4
	[0088.875] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0088.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0088.875] lstrlenW (lpString=".doc") returned 4
	[0088.875] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.875] lstrlenW (lpString=".docx") returned 5
	[0088.875] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.876] lstrlenW (lpString=".pdf") returned 4
	[0088.876] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.876] lstrlenW (lpString=".xls") returned 4
	[0088.876] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.876] lstrlenW (lpString=".xlsx") returned 5
	[0088.876] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.876] lstrlenW (lpString=".ppt") returned 4
	[0088.876] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0088.876] lstrlenW (lpString=".zip") returned 4
	[0088.876] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.876] lstrlenW (lpString=".rar") returned 4
	[0088.876] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.876] lstrlenW (lpString=".bz2") returned 4
	[0088.876] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.876] lstrlenW (lpString=".7z") returned 3
	[0088.876] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0088.876] lstrlenW (lpString=".dbf") returned 4
	[0088.876] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0088.876] lstrlenW (lpString=".1cd") returned 4
	[0088.876] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0088.876] lstrlenW (lpString=".jpg") returned 4
	[0088.876] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.876] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.877] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.877] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1453) returned 1
	[0088.877] CloseHandle (hObject=0x174) returned 1
	[0088.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20
	[0088.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.878] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.878] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0088.908] GetLastError () returned 0x0
	[0088.908] ReadFile (in: hFile=0x174, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x5ad, lpOverlapped=0x0) returned 1
	[0088.912] WriteFile (in: hFile=0x1a8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0088.913] ReadFile (in: hFile=0x174, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.913] WriteFile (in: hFile=0x1a8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.913] SetEndOfFile (hFile=0x1a8) returned 1
	[0088.916] CloseHandle (hObject=0x1a8) returned 1
	[0088.918] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.919] SetEndOfFile (hFile=0x174) returned 1
	[0088.922] CloseHandle (hObject=0x174) returned 1
	[0088.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.926] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1
	[0088.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0088.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0088.928] lstrlenW (lpString=".doc") returned 4
	[0088.928] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.928] lstrlenW (lpString=".docx") returned 5
	[0088.928] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.928] lstrlenW (lpString=".pdf") returned 4
	[0088.928] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.928] lstrlenW (lpString=".xls") returned 4
	[0088.928] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.928] lstrlenW (lpString=".xlsx") returned 5
	[0088.928] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.928] lstrlenW (lpString=".ppt") returned 4
	[0088.928] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0088.929] lstrlenW (lpString=".zip") returned 4
	[0088.929] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.929] lstrlenW (lpString=".rar") returned 4
	[0088.929] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.929] lstrlenW (lpString=".bz2") returned 4
	[0088.929] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.929] lstrlenW (lpString=".7z") returned 3
	[0088.929] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0088.929] lstrlenW (lpString=".dbf") returned 4
	[0088.929] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0088.929] lstrlenW (lpString=".1cd") returned 4
	[0088.929] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0088.929] lstrlenW (lpString=".jpg") returned 4
	[0088.929] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0088.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0088.929] lstrlenW (lpString=".doc") returned 4
	[0088.929] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.929] lstrlenW (lpString=".docx") returned 5
	[0088.929] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.930] lstrlenW (lpString=".pdf") returned 4
	[0088.930] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.930] lstrlenW (lpString=".xls") returned 4
	[0088.930] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.930] lstrlenW (lpString=".xlsx") returned 5
	[0088.930] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.930] lstrlenW (lpString=".ppt") returned 4
	[0088.930] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0088.930] lstrlenW (lpString=".zip") returned 4
	[0088.930] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.930] lstrlenW (lpString=".rar") returned 4
	[0088.930] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.930] lstrlenW (lpString=".bz2") returned 4
	[0088.930] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.930] lstrlenW (lpString=".7z") returned 3
	[0088.930] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0088.930] lstrlenW (lpString=".dbf") returned 4
	[0088.930] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0088.930] lstrlenW (lpString=".1cd") returned 4
	[0088.930] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0088.931] lstrlenW (lpString=".jpg") returned 4
	[0088.931] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.931] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.931] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0088.931] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1347) returned 1
	[0088.932] CloseHandle (hObject=0x1a8) returned 1
	[0088.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20
	[0088.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0088.932] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.932] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.938] GetLastError () returned 0x0
	[0088.938] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x543, lpOverlapped=0x0) returned 1
	[0088.953] WriteFile (in: hFile=0x160, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0088.954] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.955] WriteFile (in: hFile=0x160, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.955] SetEndOfFile (hFile=0x160) returned 1
	[0088.955] CloseHandle (hObject=0x160) returned 1
	[0088.955] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.955] SetEndOfFile (hFile=0x1a8) returned 1
	[0088.956] CloseHandle (hObject=0x1a8) returned 1
	[0088.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.957] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1
	[0088.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0088.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0088.957] lstrlenW (lpString=".doc") returned 4
	[0088.957] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.957] lstrlenW (lpString=".docx") returned 5
	[0088.957] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.957] lstrlenW (lpString=".pdf") returned 4
	[0088.957] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.957] lstrlenW (lpString=".xls") returned 4
	[0088.957] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.957] lstrlenW (lpString=".xlsx") returned 5
	[0088.957] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.958] lstrlenW (lpString=".ppt") returned 4
	[0088.958] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0088.958] lstrlenW (lpString=".zip") returned 4
	[0088.958] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.958] lstrlenW (lpString=".rar") returned 4
	[0088.958] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.958] lstrlenW (lpString=".bz2") returned 4
	[0088.958] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.958] lstrlenW (lpString=".7z") returned 3
	[0088.958] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0088.958] lstrlenW (lpString=".dbf") returned 4
	[0088.958] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0088.958] lstrlenW (lpString=".1cd") returned 4
	[0088.958] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0088.958] lstrlenW (lpString=".jpg") returned 4
	[0088.958] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0088.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0088.958] lstrlenW (lpString=".doc") returned 4
	[0088.958] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.959] lstrlenW (lpString=".docx") returned 5
	[0088.959] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.959] lstrlenW (lpString=".pdf") returned 4
	[0088.959] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.959] lstrlenW (lpString=".xls") returned 4
	[0088.959] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.959] lstrlenW (lpString=".xlsx") returned 5
	[0088.959] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.959] lstrlenW (lpString=".ppt") returned 4
	[0088.959] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0088.959] lstrlenW (lpString=".zip") returned 4
	[0088.959] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.959] lstrlenW (lpString=".rar") returned 4
	[0088.959] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.959] lstrlenW (lpString=".bz2") returned 4
	[0088.959] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.959] lstrlenW (lpString=".7z") returned 3
	[0088.959] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0088.959] lstrlenW (lpString=".dbf") returned 4
	[0088.959] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0088.959] lstrlenW (lpString=".1cd") returned 4
	[0088.959] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0088.960] lstrlenW (lpString=".jpg") returned 4
	[0088.960] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.960] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.960] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0088.961] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1354) returned 1
	[0088.961] CloseHandle (hObject=0x1a8) returned 1
	[0088.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20
	[0088.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0088.961] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.961] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.984] GetLastError () returned 0x0
	[0088.984] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x54a, lpOverlapped=0x0) returned 1
	[0089.022] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0089.023] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.023] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.023] SetEndOfFile (hFile=0x174) returned 1
	[0089.024] CloseHandle (hObject=0x174) returned 1
	[0089.024] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.024] SetEndOfFile (hFile=0x1a8) returned 1
	[0089.025] CloseHandle (hObject=0x1a8) returned 1
	[0089.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.025] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1
	[0089.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0089.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0089.025] lstrlenW (lpString=".doc") returned 4
	[0089.025] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.025] lstrlenW (lpString=".docx") returned 5
	[0089.025] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.025] lstrlenW (lpString=".pdf") returned 4
	[0089.025] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.025] lstrlenW (lpString=".xls") returned 4
	[0089.025] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.025] lstrlenW (lpString=".xlsx") returned 5
	[0089.025] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.025] lstrlenW (lpString=".ppt") returned 4
	[0089.025] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0089.026] lstrlenW (lpString=".zip") returned 4
	[0089.026] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.026] lstrlenW (lpString=".rar") returned 4
	[0089.026] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.026] lstrlenW (lpString=".bz2") returned 4
	[0089.026] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.026] lstrlenW (lpString=".7z") returned 3
	[0089.026] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0089.026] lstrlenW (lpString=".dbf") returned 4
	[0089.026] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0089.026] lstrlenW (lpString=".1cd") returned 4
	[0089.026] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0089.026] lstrlenW (lpString=".jpg") returned 4
	[0089.026] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0089.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0089.026] lstrlenW (lpString=".doc") returned 4
	[0089.026] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.026] lstrlenW (lpString=".docx") returned 5
	[0089.026] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.026] lstrlenW (lpString=".pdf") returned 4
	[0089.026] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.026] lstrlenW (lpString=".xls") returned 4
	[0089.026] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.026] lstrlenW (lpString=".xlsx") returned 5
	[0089.026] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.026] lstrlenW (lpString=".ppt") returned 4
	[0089.026] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0089.027] lstrlenW (lpString=".zip") returned 4
	[0089.027] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.027] lstrlenW (lpString=".rar") returned 4
	[0089.027] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.027] lstrlenW (lpString=".bz2") returned 4
	[0089.027] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.027] lstrlenW (lpString=".7z") returned 3
	[0089.027] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0089.027] lstrlenW (lpString=".dbf") returned 4
	[0089.027] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0089.027] lstrlenW (lpString=".1cd") returned 4
	[0089.027] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0089.027] lstrlenW (lpString=".jpg") returned 4
	[0089.027] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.027] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0089.027] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0089.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.028] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5120) returned 1
	[0089.028] CloseHandle (hObject=0x1a8) returned 1
	[0089.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20
	[0089.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.028] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.028] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0089.177] GetLastError () returned 0x0
	[0089.177] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1400, lpOverlapped=0x0) returned 1
	[0089.200] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1410, lpOverlapped=0x0) returned 1
	[0089.202] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.202] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.202] SetEndOfFile (hFile=0x174) returned 1
	[0089.202] CloseHandle (hObject=0x174) returned 1
	[0089.202] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.202] SetEndOfFile (hFile=0x1a8) returned 1
	[0089.203] CloseHandle (hObject=0x1a8) returned 1
	[0089.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.203] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1
	[0089.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0089.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0089.204] lstrlenW (lpString=".doc") returned 4
	[0089.204] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.204] lstrlenW (lpString=".docx") returned 5
	[0089.204] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.204] lstrlenW (lpString=".pdf") returned 4
	[0089.204] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.204] lstrlenW (lpString=".xls") returned 4
	[0089.204] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.204] lstrlenW (lpString=".xlsx") returned 5
	[0089.204] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.204] lstrlenW (lpString=".ppt") returned 4
	[0089.204] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0089.204] lstrlenW (lpString=".zip") returned 4
	[0089.204] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.204] lstrlenW (lpString=".rar") returned 4
	[0089.204] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.204] lstrlenW (lpString=".bz2") returned 4
	[0089.204] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.204] lstrlenW (lpString=".7z") returned 3
	[0089.204] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0089.204] lstrlenW (lpString=".dbf") returned 4
	[0089.204] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0089.204] lstrlenW (lpString=".1cd") returned 4
	[0089.204] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0089.204] lstrlenW (lpString=".jpg") returned 4
	[0089.204] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0089.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0089.205] lstrlenW (lpString=".doc") returned 4
	[0089.205] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.205] lstrlenW (lpString=".docx") returned 5
	[0089.205] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.205] lstrlenW (lpString=".pdf") returned 4
	[0089.205] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.205] lstrlenW (lpString=".xls") returned 4
	[0089.205] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.205] lstrlenW (lpString=".xlsx") returned 5
	[0089.205] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.205] lstrlenW (lpString=".ppt") returned 4
	[0089.205] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0089.205] lstrlenW (lpString=".zip") returned 4
	[0089.205] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.205] lstrlenW (lpString=".rar") returned 4
	[0089.205] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.205] lstrlenW (lpString=".bz2") returned 4
	[0089.205] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.205] lstrlenW (lpString=".7z") returned 3
	[0089.205] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0089.205] lstrlenW (lpString=".dbf") returned 4
	[0089.205] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0089.205] lstrlenW (lpString=".1cd") returned 4
	[0089.205] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0089.205] lstrlenW (lpString=".jpg") returned 4
	[0089.205] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.206] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0089.206] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0089.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.206] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5179) returned 1
	[0089.206] CloseHandle (hObject=0x1a8) returned 1
	[0089.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20
	[0089.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.207] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.207] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0089.381] GetLastError () returned 0x0
	[0089.381] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x143b, lpOverlapped=0x0) returned 1
	[0089.415] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1440, lpOverlapped=0x0) returned 1
	[0089.416] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.416] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.416] SetEndOfFile (hFile=0x174) returned 1
	[0089.416] CloseHandle (hObject=0x174) returned 1
	[0089.416] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.416] SetEndOfFile (hFile=0x1a8) returned 1
	[0089.417] CloseHandle (hObject=0x1a8) returned 1
	[0089.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.417] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1
	[0089.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0089.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0089.418] lstrlenW (lpString=".doc") returned 4
	[0089.418] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.418] lstrlenW (lpString=".docx") returned 5
	[0089.418] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.418] lstrlenW (lpString=".pdf") returned 4
	[0089.418] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.418] lstrlenW (lpString=".xls") returned 4
	[0089.418] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.418] lstrlenW (lpString=".xlsx") returned 5
	[0089.418] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.418] lstrlenW (lpString=".ppt") returned 4
	[0089.418] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0089.418] lstrlenW (lpString=".zip") returned 4
	[0089.418] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.418] lstrlenW (lpString=".rar") returned 4
	[0089.418] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.418] lstrlenW (lpString=".bz2") returned 4
	[0089.418] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.418] lstrlenW (lpString=".7z") returned 3
	[0089.418] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0089.418] lstrlenW (lpString=".dbf") returned 4
	[0089.418] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0089.418] lstrlenW (lpString=".1cd") returned 4
	[0089.418] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0089.418] lstrlenW (lpString=".jpg") returned 4
	[0089.418] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0089.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0089.419] lstrlenW (lpString=".doc") returned 4
	[0089.419] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.419] lstrlenW (lpString=".docx") returned 5
	[0089.419] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.419] lstrlenW (lpString=".pdf") returned 4
	[0089.419] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.419] lstrlenW (lpString=".xls") returned 4
	[0089.419] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.419] lstrlenW (lpString=".xlsx") returned 5
	[0089.419] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.419] lstrlenW (lpString=".ppt") returned 4
	[0089.419] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0089.419] lstrlenW (lpString=".zip") returned 4
	[0089.419] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.419] lstrlenW (lpString=".rar") returned 4
	[0089.419] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.419] lstrlenW (lpString=".bz2") returned 4
	[0089.419] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.419] lstrlenW (lpString=".7z") returned 3
	[0089.419] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0089.419] lstrlenW (lpString=".dbf") returned 4
	[0089.419] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0089.419] lstrlenW (lpString=".1cd") returned 4
	[0089.419] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0089.419] lstrlenW (lpString=".jpg") returned 4
	[0089.419] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.420] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0089.420] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0089.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.421] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1232) returned 1
	[0089.421] CloseHandle (hObject=0x1a8) returned 1
	[0089.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20
	[0089.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.421] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.422] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.471] GetLastError () returned 0x0
	[0089.471] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x4d0, lpOverlapped=0x0) returned 1
	[0089.521] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4e0, lpOverlapped=0x0) returned 1
	[0089.522] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.522] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.522] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.522] CloseHandle (hObject=0x1b0) returned 1
	[0089.523] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.523] SetEndOfFile (hFile=0x1a8) returned 1
	[0089.523] CloseHandle (hObject=0x1a8) returned 1
	[0089.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.524] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1
	[0089.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0089.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0089.524] lstrlenW (lpString=".doc") returned 4
	[0089.524] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.524] lstrlenW (lpString=".docx") returned 5
	[0089.524] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.524] lstrlenW (lpString=".pdf") returned 4
	[0089.524] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.524] lstrlenW (lpString=".xls") returned 4
	[0089.524] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.524] lstrlenW (lpString=".xlsx") returned 5
	[0089.524] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.524] lstrlenW (lpString=".ppt") returned 4
	[0089.524] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0089.524] lstrlenW (lpString=".zip") returned 4
	[0089.524] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.524] lstrlenW (lpString=".rar") returned 4
	[0089.524] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.524] lstrlenW (lpString=".bz2") returned 4
	[0089.524] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.524] lstrlenW (lpString=".7z") returned 3
	[0089.524] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0089.525] lstrlenW (lpString=".dbf") returned 4
	[0089.525] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0089.525] lstrlenW (lpString=".1cd") returned 4
	[0089.525] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0089.525] lstrlenW (lpString=".jpg") returned 4
	[0089.525] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0089.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0089.525] lstrlenW (lpString=".doc") returned 4
	[0089.525] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.525] lstrlenW (lpString=".docx") returned 5
	[0089.525] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.525] lstrlenW (lpString=".pdf") returned 4
	[0089.525] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.525] lstrlenW (lpString=".xls") returned 4
	[0089.525] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.525] lstrlenW (lpString=".xlsx") returned 5
	[0089.525] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.525] lstrlenW (lpString=".ppt") returned 4
	[0089.525] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0089.525] lstrlenW (lpString=".zip") returned 4
	[0089.525] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.525] lstrlenW (lpString=".rar") returned 4
	[0089.525] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.525] lstrlenW (lpString=".bz2") returned 4
	[0089.525] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.525] lstrlenW (lpString=".7z") returned 3
	[0089.525] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0089.526] lstrlenW (lpString=".dbf") returned 4
	[0089.526] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0089.526] lstrlenW (lpString=".1cd") returned 4
	[0089.526] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0089.526] lstrlenW (lpString=".jpg") returned 4
	[0089.526] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.526] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0089.526] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0089.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.526] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1379) returned 1
	[0089.526] CloseHandle (hObject=0x1a8) returned 1
	[0089.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20
	[0089.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.527] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.527] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.621] GetLastError () returned 0x0
	[0089.621] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x563, lpOverlapped=0x0) returned 1
	[0089.674] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x570, lpOverlapped=0x0) returned 1
	[0089.675] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.675] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.675] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.675] CloseHandle (hObject=0x1b0) returned 1
	[0089.675] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.675] SetEndOfFile (hFile=0x1a8) returned 1
	[0089.676] CloseHandle (hObject=0x1a8) returned 1
	[0089.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.676] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1
	[0089.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0089.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0089.677] lstrlenW (lpString=".doc") returned 4
	[0089.677] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.677] lstrlenW (lpString=".docx") returned 5
	[0089.677] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.677] lstrlenW (lpString=".pdf") returned 4
	[0089.677] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.677] lstrlenW (lpString=".xls") returned 4
	[0089.677] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.677] lstrlenW (lpString=".xlsx") returned 5
	[0089.677] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.677] lstrlenW (lpString=".ppt") returned 4
	[0089.677] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0089.677] lstrlenW (lpString=".zip") returned 4
	[0089.677] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.677] lstrlenW (lpString=".rar") returned 4
	[0089.677] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.677] lstrlenW (lpString=".bz2") returned 4
	[0089.677] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.677] lstrlenW (lpString=".7z") returned 3
	[0089.677] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0089.677] lstrlenW (lpString=".dbf") returned 4
	[0089.677] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0089.677] lstrlenW (lpString=".1cd") returned 4
	[0089.677] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0089.678] lstrlenW (lpString=".jpg") returned 4
	[0089.678] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0089.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0089.678] lstrlenW (lpString=".doc") returned 4
	[0089.678] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.678] lstrlenW (lpString=".docx") returned 5
	[0089.678] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.678] lstrlenW (lpString=".pdf") returned 4
	[0089.678] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.678] lstrlenW (lpString=".xls") returned 4
	[0089.678] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.678] lstrlenW (lpString=".xlsx") returned 5
	[0089.678] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.678] lstrlenW (lpString=".ppt") returned 4
	[0089.678] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0089.678] lstrlenW (lpString=".zip") returned 4
	[0089.678] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.678] lstrlenW (lpString=".rar") returned 4
	[0089.678] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.678] lstrlenW (lpString=".bz2") returned 4
	[0089.678] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.678] lstrlenW (lpString=".7z") returned 3
	[0089.678] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0089.678] lstrlenW (lpString=".dbf") returned 4
	[0089.678] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0089.678] lstrlenW (lpString=".1cd") returned 4
	[0089.679] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0089.679] lstrlenW (lpString=".jpg") returned 4
	[0089.679] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.679] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0089.679] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0089.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.679] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2574) returned 1
	[0089.679] CloseHandle (hObject=0x1a8) returned 1
	[0089.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20
	[0089.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.680] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.680] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.922] GetLastError () returned 0x0
	[0089.922] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xa0e, lpOverlapped=0x0) returned 1
	[0089.944] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xa10, lpOverlapped=0x0) returned 1
	[0089.945] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.945] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.945] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.945] CloseHandle (hObject=0x1b0) returned 1
	[0089.945] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.945] SetEndOfFile (hFile=0x1a8) returned 1
	[0089.946] CloseHandle (hObject=0x1a8) returned 1
	[0089.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.947] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1
	[0089.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0089.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0089.947] lstrlenW (lpString=".doc") returned 4
	[0089.947] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.947] lstrlenW (lpString=".docx") returned 5
	[0089.947] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.947] lstrlenW (lpString=".pdf") returned 4
	[0089.947] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.947] lstrlenW (lpString=".xls") returned 4
	[0089.947] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.947] lstrlenW (lpString=".xlsx") returned 5
	[0089.947] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.947] lstrlenW (lpString=".ppt") returned 4
	[0089.947] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0089.947] lstrlenW (lpString=".zip") returned 4
	[0089.947] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.947] lstrlenW (lpString=".rar") returned 4
	[0089.947] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.947] lstrlenW (lpString=".bz2") returned 4
	[0089.947] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.947] lstrlenW (lpString=".7z") returned 3
	[0089.947] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0089.948] lstrlenW (lpString=".dbf") returned 4
	[0089.948] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0089.948] lstrlenW (lpString=".1cd") returned 4
	[0089.948] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0089.948] lstrlenW (lpString=".jpg") returned 4
	[0089.948] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0089.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0089.948] lstrlenW (lpString=".doc") returned 4
	[0089.948] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.948] lstrlenW (lpString=".docx") returned 5
	[0089.948] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.948] lstrlenW (lpString=".pdf") returned 4
	[0089.948] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.948] lstrlenW (lpString=".xls") returned 4
	[0089.948] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.948] lstrlenW (lpString=".xlsx") returned 5
	[0089.948] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.948] lstrlenW (lpString=".ppt") returned 4
	[0089.948] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0089.948] lstrlenW (lpString=".zip") returned 4
	[0089.948] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.948] lstrlenW (lpString=".rar") returned 4
	[0089.948] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.949] lstrlenW (lpString=".bz2") returned 4
	[0089.949] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.949] lstrlenW (lpString=".7z") returned 3
	[0089.949] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0089.949] lstrlenW (lpString=".dbf") returned 4
	[0089.949] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0089.949] lstrlenW (lpString=".1cd") returned 4
	[0089.949] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0089.949] lstrlenW (lpString=".jpg") returned 4
	[0089.949] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.949] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0089.949] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0089.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.950] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1339) returned 1
	[0089.950] CloseHandle (hObject=0x1a8) returned 1
	[0089.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20
	[0089.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.951] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.951] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0089.995] GetLastError () returned 0x0
	[0089.995] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x53b, lpOverlapped=0x0) returned 1
	[0090.012] WriteFile (in: hFile=0x184, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x540, lpOverlapped=0x0) returned 1
	[0090.013] ReadFile (in: hFile=0x1a8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.013] WriteFile (in: hFile=0x184, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.014] SetEndOfFile (hFile=0x184) returned 1
	[0090.014] CloseHandle (hObject=0x184) returned 1
	[0090.014] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.014] SetEndOfFile (hFile=0x1a8) returned 1
	[0090.015] CloseHandle (hObject=0x1a8) returned 1
	[0090.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.015] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1
	[0090.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0090.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0090.016] lstrlenW (lpString=".doc") returned 4
	[0090.016] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.016] lstrlenW (lpString=".docx") returned 5
	[0090.016] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.016] lstrlenW (lpString=".pdf") returned 4
	[0090.016] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.016] lstrlenW (lpString=".xls") returned 4
	[0090.016] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.016] lstrlenW (lpString=".xlsx") returned 5
	[0090.016] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.016] lstrlenW (lpString=".ppt") returned 4
	[0090.016] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0090.016] lstrlenW (lpString=".zip") returned 4
	[0090.016] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.016] lstrlenW (lpString=".rar") returned 4
	[0090.017] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.017] lstrlenW (lpString=".bz2") returned 4
	[0090.017] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.017] lstrlenW (lpString=".7z") returned 3
	[0090.017] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0090.017] lstrlenW (lpString=".dbf") returned 4
	[0090.017] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0090.017] lstrlenW (lpString=".1cd") returned 4
	[0090.017] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0090.017] lstrlenW (lpString=".jpg") returned 4
	[0090.017] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0090.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0090.017] lstrlenW (lpString=".doc") returned 4
	[0090.017] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.017] lstrlenW (lpString=".docx") returned 5
	[0090.017] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.017] lstrlenW (lpString=".pdf") returned 4
	[0090.017] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.017] lstrlenW (lpString=".xls") returned 4
	[0090.017] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.017] lstrlenW (lpString=".xlsx") returned 5
	[0090.017] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.018] lstrlenW (lpString=".ppt") returned 4
	[0090.018] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0090.018] lstrlenW (lpString=".zip") returned 4
	[0090.018] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.018] lstrlenW (lpString=".rar") returned 4
	[0090.018] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.018] lstrlenW (lpString=".bz2") returned 4
	[0090.018] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.018] lstrlenW (lpString=".7z") returned 3
	[0090.018] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0090.018] lstrlenW (lpString=".dbf") returned 4
	[0090.018] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0090.018] lstrlenW (lpString=".1cd") returned 4
	[0090.018] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0090.018] lstrlenW (lpString=".jpg") returned 4
	[0090.018] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.018] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0090.019] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0090.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.068] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1666) returned 1
	[0090.068] CloseHandle (hObject=0x160) returned 1
	[0090.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20
	[0090.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.123] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.124] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0090.173] GetLastError () returned 0x0
	[0090.174] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x682, lpOverlapped=0x0) returned 1
	[0090.198] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x690, lpOverlapped=0x0) returned 1
	[0090.199] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.199] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.199] SetEndOfFile (hFile=0x1b0) returned 1
	[0090.199] CloseHandle (hObject=0x1b0) returned 1
	[0090.200] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.200] SetEndOfFile (hFile=0x1ac) returned 1
	[0090.201] CloseHandle (hObject=0x1ac) returned 1
	[0090.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.201] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1
	[0090.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0090.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0090.201] lstrlenW (lpString=".doc") returned 4
	[0090.201] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.201] lstrlenW (lpString=".docx") returned 5
	[0090.201] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.201] lstrlenW (lpString=".pdf") returned 4
	[0090.201] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.202] lstrlenW (lpString=".xls") returned 4
	[0090.202] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.202] lstrlenW (lpString=".xlsx") returned 5
	[0090.202] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.202] lstrlenW (lpString=".ppt") returned 4
	[0090.202] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0090.202] lstrlenW (lpString=".zip") returned 4
	[0090.202] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.202] lstrlenW (lpString=".rar") returned 4
	[0090.202] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.202] lstrlenW (lpString=".bz2") returned 4
	[0090.202] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.202] lstrlenW (lpString=".7z") returned 3
	[0090.202] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0090.202] lstrlenW (lpString=".dbf") returned 4
	[0090.202] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0090.202] lstrlenW (lpString=".1cd") returned 4
	[0090.202] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0090.202] lstrlenW (lpString=".jpg") returned 4
	[0090.202] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0090.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0090.202] lstrlenW (lpString=".doc") returned 4
	[0090.202] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.202] lstrlenW (lpString=".docx") returned 5
	[0090.202] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.202] lstrlenW (lpString=".pdf") returned 4
	[0090.202] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.203] lstrlenW (lpString=".xls") returned 4
	[0090.203] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.203] lstrlenW (lpString=".xlsx") returned 5
	[0090.203] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.203] lstrlenW (lpString=".ppt") returned 4
	[0090.203] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0090.203] lstrlenW (lpString=".zip") returned 4
	[0090.203] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.203] lstrlenW (lpString=".rar") returned 4
	[0090.203] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.203] lstrlenW (lpString=".bz2") returned 4
	[0090.203] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.203] lstrlenW (lpString=".7z") returned 3
	[0090.203] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0090.203] lstrlenW (lpString=".dbf") returned 4
	[0090.203] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0090.203] lstrlenW (lpString=".1cd") returned 4
	[0090.203] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0090.203] lstrlenW (lpString=".jpg") returned 4
	[0090.203] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.203] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0090.203] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0090.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.204] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3611) returned 1
	[0090.204] CloseHandle (hObject=0x1ac) returned 1
	[0090.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20
	[0090.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.205] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.205] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0090.207] GetLastError () returned 0x0
	[0090.207] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xe1b, lpOverlapped=0x0) returned 1
	[0090.218] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe20, lpOverlapped=0x0) returned 1
	[0090.219] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.219] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.219] SetEndOfFile (hFile=0x1b0) returned 1
	[0090.219] CloseHandle (hObject=0x1b0) returned 1
	[0090.220] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.220] SetEndOfFile (hFile=0x1ac) returned 1
	[0090.221] CloseHandle (hObject=0x1ac) returned 1
	[0090.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.221] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1
	[0090.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0090.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0090.221] lstrlenW (lpString=".doc") returned 4
	[0090.221] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.221] lstrlenW (lpString=".docx") returned 5
	[0090.221] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.221] lstrlenW (lpString=".pdf") returned 4
	[0090.221] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.221] lstrlenW (lpString=".xls") returned 4
	[0090.221] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.221] lstrlenW (lpString=".xlsx") returned 5
	[0090.221] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.221] lstrlenW (lpString=".ppt") returned 4
	[0090.221] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0090.222] lstrlenW (lpString=".zip") returned 4
	[0090.222] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.222] lstrlenW (lpString=".rar") returned 4
	[0090.222] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.222] lstrlenW (lpString=".bz2") returned 4
	[0090.222] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.222] lstrlenW (lpString=".7z") returned 3
	[0090.222] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0090.222] lstrlenW (lpString=".dbf") returned 4
	[0090.222] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0090.222] lstrlenW (lpString=".1cd") returned 4
	[0090.222] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0090.222] lstrlenW (lpString=".jpg") returned 4
	[0090.222] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0090.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0090.222] lstrlenW (lpString=".doc") returned 4
	[0090.222] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.222] lstrlenW (lpString=".docx") returned 5
	[0090.222] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.222] lstrlenW (lpString=".pdf") returned 4
	[0090.222] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.222] lstrlenW (lpString=".xls") returned 4
	[0090.222] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.222] lstrlenW (lpString=".xlsx") returned 5
	[0090.222] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.222] lstrlenW (lpString=".ppt") returned 4
	[0090.222] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0090.223] lstrlenW (lpString=".zip") returned 4
	[0090.223] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.223] lstrlenW (lpString=".rar") returned 4
	[0090.223] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.223] lstrlenW (lpString=".bz2") returned 4
	[0090.223] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.223] lstrlenW (lpString=".7z") returned 3
	[0090.223] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0090.223] lstrlenW (lpString=".dbf") returned 4
	[0090.223] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0090.223] lstrlenW (lpString=".1cd") returned 4
	[0090.223] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0090.223] lstrlenW (lpString=".jpg") returned 4
	[0090.223] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.223] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0090.223] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0090.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.224] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=937) returned 1
	[0090.224] CloseHandle (hObject=0x1ac) returned 1
	[0090.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20
	[0090.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.225] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.225] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.258] GetLastError () returned 0x0
	[0090.258] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x3a9, lpOverlapped=0x0) returned 1
	[0090.263] WriteFile (in: hFile=0x184, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3b0, lpOverlapped=0x0) returned 1
	[0090.264] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.264] WriteFile (in: hFile=0x184, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.264] SetEndOfFile (hFile=0x184) returned 1
	[0090.265] CloseHandle (hObject=0x184) returned 1
	[0090.265] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.265] SetEndOfFile (hFile=0x1ac) returned 1
	[0090.266] CloseHandle (hObject=0x1ac) returned 1
	[0090.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.266] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1
	[0090.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0090.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0090.266] lstrlenW (lpString=".doc") returned 4
	[0090.266] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.266] lstrlenW (lpString=".docx") returned 5
	[0090.266] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.266] lstrlenW (lpString=".pdf") returned 4
	[0090.266] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.266] lstrlenW (lpString=".xls") returned 4
	[0090.266] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.266] lstrlenW (lpString=".xlsx") returned 5
	[0090.266] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.267] lstrlenW (lpString=".ppt") returned 4
	[0090.267] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0090.267] lstrlenW (lpString=".zip") returned 4
	[0090.267] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.267] lstrlenW (lpString=".rar") returned 4
	[0090.267] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.267] lstrlenW (lpString=".bz2") returned 4
	[0090.267] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.267] lstrlenW (lpString=".7z") returned 3
	[0090.267] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0090.267] lstrlenW (lpString=".dbf") returned 4
	[0090.267] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0090.267] lstrlenW (lpString=".1cd") returned 4
	[0090.267] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0090.267] lstrlenW (lpString=".jpg") returned 4
	[0090.267] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0090.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0090.267] lstrlenW (lpString=".doc") returned 4
	[0090.267] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.267] lstrlenW (lpString=".docx") returned 5
	[0090.267] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.267] lstrlenW (lpString=".pdf") returned 4
	[0090.267] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.267] lstrlenW (lpString=".xls") returned 4
	[0090.267] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.268] lstrlenW (lpString=".xlsx") returned 5
	[0090.268] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.269] lstrlenW (lpString=".ppt") returned 4
	[0090.269] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0090.269] lstrlenW (lpString=".zip") returned 4
	[0090.269] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.269] lstrlenW (lpString=".rar") returned 4
	[0090.269] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.269] lstrlenW (lpString=".bz2") returned 4
	[0090.270] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.270] lstrlenW (lpString=".7z") returned 3
	[0090.270] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0090.270] lstrlenW (lpString=".dbf") returned 4
	[0090.270] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0090.270] lstrlenW (lpString=".1cd") returned 4
	[0090.270] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0090.270] lstrlenW (lpString=".jpg") returned 4
	[0090.270] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.270] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0090.270] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0090.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.271] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2209) returned 1
	[0090.271] CloseHandle (hObject=0x1ac) returned 1
	[0090.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20
	[0090.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.271] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.271] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0090.298] GetLastError () returned 0x0
	[0090.298] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x8a1, lpOverlapped=0x0) returned 1
	[0090.304] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x8b0, lpOverlapped=0x0) returned 1
	[0090.305] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.305] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.305] SetEndOfFile (hFile=0x194) returned 1
	[0090.305] CloseHandle (hObject=0x194) returned 1
	[0090.306] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.306] SetEndOfFile (hFile=0x1ac) returned 1
	[0090.306] CloseHandle (hObject=0x1ac) returned 1
	[0090.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.307] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1
	[0090.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0090.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0090.307] lstrlenW (lpString=".doc") returned 4
	[0090.307] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.307] lstrlenW (lpString=".docx") returned 5
	[0090.307] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.307] lstrlenW (lpString=".pdf") returned 4
	[0090.307] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.307] lstrlenW (lpString=".xls") returned 4
	[0090.307] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.307] lstrlenW (lpString=".xlsx") returned 5
	[0090.307] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.307] lstrlenW (lpString=".ppt") returned 4
	[0090.307] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0090.307] lstrlenW (lpString=".zip") returned 4
	[0090.307] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.308] lstrlenW (lpString=".rar") returned 4
	[0090.308] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.308] lstrlenW (lpString=".bz2") returned 4
	[0090.308] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.308] lstrlenW (lpString=".7z") returned 3
	[0090.308] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0090.308] lstrlenW (lpString=".dbf") returned 4
	[0090.308] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0090.308] lstrlenW (lpString=".1cd") returned 4
	[0090.308] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0090.308] lstrlenW (lpString=".jpg") returned 4
	[0090.308] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0090.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0090.308] lstrlenW (lpString=".doc") returned 4
	[0090.308] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.308] lstrlenW (lpString=".docx") returned 5
	[0090.308] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.308] lstrlenW (lpString=".pdf") returned 4
	[0090.308] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.308] lstrlenW (lpString=".xls") returned 4
	[0090.308] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.308] lstrlenW (lpString=".xlsx") returned 5
	[0090.308] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.308] lstrlenW (lpString=".ppt") returned 4
	[0090.308] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0090.308] lstrlenW (lpString=".zip") returned 4
	[0090.309] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.309] lstrlenW (lpString=".rar") returned 4
	[0090.309] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.309] lstrlenW (lpString=".bz2") returned 4
	[0090.309] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.309] lstrlenW (lpString=".7z") returned 3
	[0090.309] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0090.309] lstrlenW (lpString=".dbf") returned 4
	[0090.309] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0090.309] lstrlenW (lpString=".1cd") returned 4
	[0090.309] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0090.309] lstrlenW (lpString=".jpg") returned 4
	[0090.309] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.309] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0090.309] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0090.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.310] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2527) returned 1
	[0090.310] CloseHandle (hObject=0x1ac) returned 1
	[0090.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20
	[0090.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.311] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.311] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0090.352] GetLastError () returned 0x0
	[0090.352] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x9df, lpOverlapped=0x0) returned 1
	[0090.361] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x9e0, lpOverlapped=0x0) returned 1
	[0090.363] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.363] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.363] SetEndOfFile (hFile=0x194) returned 1
	[0090.363] CloseHandle (hObject=0x194) returned 1
	[0090.364] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.364] SetEndOfFile (hFile=0x1ac) returned 1
	[0090.365] CloseHandle (hObject=0x1ac) returned 1
	[0090.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.365] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1
	[0090.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0090.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0090.365] lstrlenW (lpString=".doc") returned 4
	[0090.365] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.366] lstrlenW (lpString=".docx") returned 5
	[0090.366] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.366] lstrlenW (lpString=".pdf") returned 4
	[0090.366] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.366] lstrlenW (lpString=".xls") returned 4
	[0090.366] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.366] lstrlenW (lpString=".xlsx") returned 5
	[0090.366] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.366] lstrlenW (lpString=".ppt") returned 4
	[0090.366] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0090.366] lstrlenW (lpString=".zip") returned 4
	[0090.366] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.366] lstrlenW (lpString=".rar") returned 4
	[0090.366] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.366] lstrlenW (lpString=".bz2") returned 4
	[0090.366] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.366] lstrlenW (lpString=".7z") returned 3
	[0090.366] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0090.366] lstrlenW (lpString=".dbf") returned 4
	[0090.366] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0090.366] lstrlenW (lpString=".1cd") returned 4
	[0090.366] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0090.366] lstrlenW (lpString=".jpg") returned 4
	[0090.366] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0090.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0090.367] lstrlenW (lpString=".doc") returned 4
	[0090.367] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.367] lstrlenW (lpString=".docx") returned 5
	[0090.367] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.367] lstrlenW (lpString=".pdf") returned 4
	[0090.367] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.367] lstrlenW (lpString=".xls") returned 4
	[0090.367] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.367] lstrlenW (lpString=".xlsx") returned 5
	[0090.367] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.367] lstrlenW (lpString=".ppt") returned 4
	[0090.367] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0090.367] lstrlenW (lpString=".zip") returned 4
	[0090.367] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.367] lstrlenW (lpString=".rar") returned 4
	[0090.367] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.367] lstrlenW (lpString=".bz2") returned 4
	[0090.367] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.367] lstrlenW (lpString=".7z") returned 3
	[0090.367] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0090.367] lstrlenW (lpString=".dbf") returned 4
	[0090.367] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0090.367] lstrlenW (lpString=".1cd") returned 4
	[0090.368] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0090.368] lstrlenW (lpString=".jpg") returned 4
	[0090.368] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.368] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0090.368] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0090.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.369] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1737) returned 1
	[0090.369] CloseHandle (hObject=0x1ac) returned 1
	[0090.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20
	[0090.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.369] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.369] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0090.425] GetLastError () returned 0x0
	[0090.425] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x6c9, lpOverlapped=0x0) returned 1
	[0090.438] WriteFile (in: hFile=0x1a8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x6d0, lpOverlapped=0x0) returned 1
	[0090.440] ReadFile (in: hFile=0x1ac, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.440] WriteFile (in: hFile=0x1a8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.440] SetEndOfFile (hFile=0x1a8) returned 1
	[0090.440] CloseHandle (hObject=0x1a8) returned 1
	[0090.440] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.440] SetEndOfFile (hFile=0x1ac) returned 1
	[0090.441] CloseHandle (hObject=0x1ac) returned 1
	[0090.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.442] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1
	[0090.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0090.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0090.442] lstrlenW (lpString=".doc") returned 4
	[0090.442] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.442] lstrlenW (lpString=".docx") returned 5
	[0090.442] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.442] lstrlenW (lpString=".pdf") returned 4
	[0090.442] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.442] lstrlenW (lpString=".xls") returned 4
	[0090.442] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.442] lstrlenW (lpString=".xlsx") returned 5
	[0090.442] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.442] lstrlenW (lpString=".ppt") returned 4
	[0090.442] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0090.443] lstrlenW (lpString=".zip") returned 4
	[0090.443] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.443] lstrlenW (lpString=".rar") returned 4
	[0090.443] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.443] lstrlenW (lpString=".bz2") returned 4
	[0090.443] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.443] lstrlenW (lpString=".7z") returned 3
	[0090.443] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0090.443] lstrlenW (lpString=".dbf") returned 4
	[0090.443] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0090.443] lstrlenW (lpString=".1cd") returned 4
	[0090.443] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0090.443] lstrlenW (lpString=".jpg") returned 4
	[0090.443] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0090.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0090.444] lstrlenW (lpString=".doc") returned 4
	[0090.444] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.444] lstrlenW (lpString=".docx") returned 5
	[0090.444] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.444] lstrlenW (lpString=".pdf") returned 4
	[0090.444] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.444] lstrlenW (lpString=".xls") returned 4
	[0090.444] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.444] lstrlenW (lpString=".xlsx") returned 5
	[0090.444] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.444] lstrlenW (lpString=".ppt") returned 4
	[0090.444] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0090.444] lstrlenW (lpString=".zip") returned 4
	[0090.444] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.444] lstrlenW (lpString=".rar") returned 4
	[0090.444] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.444] lstrlenW (lpString=".bz2") returned 4
	[0090.444] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.444] lstrlenW (lpString=".7z") returned 3
	[0090.444] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0090.444] lstrlenW (lpString=".dbf") returned 4
	[0090.444] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0090.445] lstrlenW (lpString=".1cd") returned 4
	[0090.445] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0090.445] lstrlenW (lpString=".jpg") returned 4
	[0090.445] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.445] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0090.445] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0090.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.446] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1675) returned 1
	[0090.446] CloseHandle (hObject=0x1ac) returned 1
	[0090.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20
	[0090.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.447] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.447] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 57
	os_tid = 0xb94

	[0073.175] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x6c0c48
	[0073.175] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x3750048
	[0073.176] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630980
	[0073.176] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x6c0660
	[0073.176] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630998
	[0073.176] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3850020
	[0073.176] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6309b0
	[0073.176] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6309b0, Size=0x20) returned 0x6162b0
	[0073.176] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6309b0
	[0073.176] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6309b0, Size=0x20) returned 0x6162d8
	[0073.176] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0073.177] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0073.177] Wow64DisableWow64FsRedirection (in: OldValue=0x2ddff58 | out: OldValue=0x2ddff58*=0x0) returned 1
	[0073.177] lstrlenW (lpString="kernel32.dll") returned 12
	[0073.177] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162b0 | out: hHeap=0x5e0000) returned 1
	[0073.177] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0073.177] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162d8 | out: hHeap=0x5e0000) returned 1
	[0073.177] Sleep (dwMilliseconds=0x64) 
	[0073.724] Sleep (dwMilliseconds=0x64) 
	[0074.272] lstrcmpiW (lpString1=".ttf", lpString2=".adobe") returned 1
	[0074.272] lstrlenW (lpString="jpn_boot.ttf") returned 12
	[0074.272] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0074.734] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1984228) returned 1
	[0074.734] CloseHandle (hObject=0x184) returned 1
	[0074.734] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20
	[0074.734] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.735] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0074.735] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0074.735] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0074.735] lstrlenW (lpString=".doc") returned 4
	[0074.735] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0074.735] lstrlenW (lpString=".docx") returned 5
	[0074.735] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0074.735] lstrlenW (lpString=".pdf") returned 4
	[0074.735] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0074.735] lstrlenW (lpString=".xls") returned 4
	[0074.735] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0074.735] lstrlenW (lpString=".xlsx") returned 5
	[0074.735] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0074.735] lstrlenW (lpString=".ppt") returned 4
	[0074.735] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0074.735] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0074.735] lstrlenW (lpString=".zip") returned 4
	[0074.735] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0074.735] lstrlenW (lpString=".rar") returned 4
	[0074.735] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0074.735] lstrlenW (lpString=".bz2") returned 4
	[0074.735] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0074.735] lstrlenW (lpString=".7z") returned 3
	[0074.735] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0074.735] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0074.735] lstrlenW (lpString=".dbf") returned 4
	[0074.735] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0074.735] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0074.735] lstrlenW (lpString=".1cd") returned 4
	[0074.735] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0074.735] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0074.735] lstrlenW (lpString=".jpg") returned 4
	[0074.736] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0074.736] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0074.736] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0074.736] lstrlenW (lpString=".doc") returned 4
	[0074.736] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0074.736] lstrlenW (lpString=".docx") returned 5
	[0074.736] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0074.736] lstrlenW (lpString=".pdf") returned 4
	[0074.736] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0074.736] lstrlenW (lpString=".xls") returned 4
	[0074.736] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0074.736] lstrlenW (lpString=".xlsx") returned 5
	[0074.736] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0074.736] lstrlenW (lpString=".ppt") returned 4
	[0074.736] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0074.736] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0074.736] lstrlenW (lpString=".zip") returned 4
	[0074.736] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0074.736] lstrlenW (lpString=".rar") returned 4
	[0074.736] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0074.736] lstrlenW (lpString=".bz2") returned 4
	[0074.736] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0074.736] lstrlenW (lpString=".7z") returned 3
	[0074.736] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0074.736] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0074.736] lstrlenW (lpString=".dbf") returned 4
	[0074.736] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0074.736] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0074.736] lstrlenW (lpString=".1cd") returned 4
	[0074.736] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0074.736] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0074.736] lstrlenW (lpString=".jpg") returned 4
	[0074.736] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0074.737] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0074.737] lstrlenW (lpString="PowerPointMUI.msi") returned 17
	[0074.737] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0074.737] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2503680) returned 1
	[0074.737] CloseHandle (hObject=0x184) returned 1
	[0074.737] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020
	[0074.737] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.737] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0074.738] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0074.738] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1
	[0074.738] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0074.738] ReadFile (in: hFile=0x184, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0074.875] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0074.875] ReadFile (in: hFile=0x184, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0075.047] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0075.047] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0075.047] ReadFile (in: hFile=0x184, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0075.068] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.068] WriteFile (in: hFile=0x184, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc010e, lpOverlapped=0x0) returned 1
	[0075.146] SetEndOfFile (hFile=0x184) returned 1
	[0075.147] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f01060
	[0075.148] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0075.148] WriteFile (in: hFile=0x184, lpBuffer=0x3f01060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f01060*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0075.150] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0075.151] WriteFile (in: hFile=0x184, lpBuffer=0x3f01060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f01060*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0075.158] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0075.158] WriteFile (in: hFile=0x184, lpBuffer=0x3f01060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f01060*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0075.162] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f01060 | out: hHeap=0x5e0000) returned 1
	[0075.162] CloseHandle (hObject=0x184) returned 1
	[0075.400] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0075.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0075.401] lstrlenW (lpString=".doc") returned 4
	[0075.401] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0075.401] lstrlenW (lpString=".docx") returned 5
	[0075.401] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0075.401] lstrlenW (lpString=".pdf") returned 4
	[0075.401] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0075.401] lstrlenW (lpString=".xls") returned 4
	[0075.401] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0075.401] lstrlenW (lpString=".xlsx") returned 5
	[0075.401] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0075.401] lstrlenW (lpString=".ppt") returned 4
	[0075.401] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0075.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0075.401] lstrlenW (lpString=".zip") returned 4
	[0075.401] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0075.401] lstrlenW (lpString=".rar") returned 4
	[0075.401] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0075.401] lstrlenW (lpString=".bz2") returned 4
	[0075.401] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0075.401] lstrlenW (lpString=".7z") returned 3
	[0075.401] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0075.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0075.402] lstrlenW (lpString=".dbf") returned 4
	[0075.402] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0075.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0075.402] lstrlenW (lpString=".1cd") returned 4
	[0075.402] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0075.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0075.402] lstrlenW (lpString=".jpg") returned 4
	[0075.402] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0075.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0075.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0075.402] lstrlenW (lpString=".doc") returned 4
	[0075.402] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0075.402] lstrlenW (lpString=".docx") returned 5
	[0075.402] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0075.402] lstrlenW (lpString=".pdf") returned 4
	[0075.402] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0075.402] lstrlenW (lpString=".xls") returned 4
	[0075.402] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0075.402] lstrlenW (lpString=".xlsx") returned 5
	[0075.402] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0075.402] lstrlenW (lpString=".ppt") returned 4
	[0075.402] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0075.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0075.402] lstrlenW (lpString=".zip") returned 4
	[0075.402] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0075.402] lstrlenW (lpString=".rar") returned 4
	[0075.402] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0075.402] lstrlenW (lpString=".bz2") returned 4
	[0075.402] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0075.402] lstrlenW (lpString=".7z") returned 3
	[0075.402] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0075.403] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0075.403] lstrlenW (lpString=".dbf") returned 4
	[0075.403] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0075.403] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0075.403] lstrlenW (lpString=".1cd") returned 4
	[0075.403] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0075.403] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0075.403] lstrlenW (lpString=".jpg") returned 4
	[0075.403] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0075.403] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0075.403] lstrlenW (lpString="PublisherMUI.msi") returned 16
	[0075.403] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0075.732] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2513920) returned 1
	[0075.732] CloseHandle (hObject=0x198) returned 1
	[0075.732] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020
	[0075.732] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.734] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0076.065] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0076.166] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1
	[0076.166] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0076.166] ReadFile (in: hFile=0x174, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0076.247] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0076.247] ReadFile (in: hFile=0x174, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0076.349] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0076.349] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0076.349] ReadFile (in: hFile=0x174, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0076.569] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.570] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc010c, lpOverlapped=0x0) returned 1
	[0076.590] SetEndOfFile (hFile=0x174) returned 1
	[0076.590] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f40078
	[0076.594] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0076.594] WriteFile (in: hFile=0x174, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0076.595] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0076.595] WriteFile (in: hFile=0x174, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0076.961] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0076.961] WriteFile (in: hFile=0x174, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0076.965] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f40078 | out: hHeap=0x5e0000) returned 1
	[0076.965] CloseHandle (hObject=0x174) returned 1
	[0077.166] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0077.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0077.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0077.167] lstrlenW (lpString=".doc") returned 4
	[0077.167] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0077.167] lstrlenW (lpString=".docx") returned 5
	[0077.167] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0077.167] lstrlenW (lpString=".pdf") returned 4
	[0077.167] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0077.167] lstrlenW (lpString=".xls") returned 4
	[0077.167] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0077.167] lstrlenW (lpString=".xlsx") returned 5
	[0077.167] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0077.167] lstrlenW (lpString=".ppt") returned 4
	[0077.167] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0077.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0077.167] lstrlenW (lpString=".zip") returned 4
	[0077.167] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0077.167] lstrlenW (lpString=".rar") returned 4
	[0077.167] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0077.167] lstrlenW (lpString=".bz2") returned 4
	[0077.167] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0077.167] lstrlenW (lpString=".7z") returned 3
	[0077.167] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0077.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0077.167] lstrlenW (lpString=".dbf") returned 4
	[0077.167] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0077.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0077.167] lstrlenW (lpString=".1cd") returned 4
	[0077.168] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0077.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0077.168] lstrlenW (lpString=".jpg") returned 4
	[0077.168] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0077.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0077.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0077.168] lstrlenW (lpString=".doc") returned 4
	[0077.168] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0077.168] lstrlenW (lpString=".docx") returned 5
	[0077.168] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0077.168] lstrlenW (lpString=".pdf") returned 4
	[0077.168] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0077.168] lstrlenW (lpString=".xls") returned 4
	[0077.168] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0077.168] lstrlenW (lpString=".xlsx") returned 5
	[0077.168] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0077.168] lstrlenW (lpString=".ppt") returned 4
	[0077.168] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0077.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0077.168] lstrlenW (lpString=".zip") returned 4
	[0077.168] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0077.168] lstrlenW (lpString=".rar") returned 4
	[0077.168] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0077.168] lstrlenW (lpString=".bz2") returned 4
	[0077.168] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0077.168] lstrlenW (lpString=".7z") returned 3
	[0077.168] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0077.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0077.169] lstrlenW (lpString=".dbf") returned 4
	[0077.169] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0077.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0077.169] lstrlenW (lpString=".1cd") returned 4
	[0077.169] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0077.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0077.169] lstrlenW (lpString=".jpg") returned 4
	[0077.169] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0077.169] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0077.169] lstrlenW (lpString="OutlookMUI.msi") returned 14
	[0077.169] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0077.170] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2865664) returned 1
	[0077.170] CloseHandle (hObject=0x174) returned 1
	[0077.170] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020
	[0077.170] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0077.170] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0077.171] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0077.171] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1
	[0077.171] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.171] ReadFile (in: hFile=0x174, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0077.305] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.305] ReadFile (in: hFile=0x174, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0077.528] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0077.529] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.529] ReadFile (in: hFile=0x174, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0077.633] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.633] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0077.861] SetEndOfFile (hFile=0x174) returned 1
	[0077.861] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f40078
	[0077.867] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0077.867] WriteFile (in: hFile=0x174, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0077.869] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0077.869] WriteFile (in: hFile=0x174, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0077.876] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0077.876] WriteFile (in: hFile=0x174, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0077.879] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f40078 | out: hHeap=0x5e0000) returned 1
	[0077.879] CloseHandle (hObject=0x174) returned 1
	[0078.180] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0078.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0078.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0078.181] lstrlenW (lpString=".doc") returned 4
	[0078.181] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0078.181] lstrlenW (lpString=".docx") returned 5
	[0078.181] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0078.181] lstrlenW (lpString=".pdf") returned 4
	[0078.181] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0078.181] lstrlenW (lpString=".xls") returned 4
	[0078.181] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0078.181] lstrlenW (lpString=".xlsx") returned 5
	[0078.181] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0078.181] lstrlenW (lpString=".ppt") returned 4
	[0078.181] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0078.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0078.181] lstrlenW (lpString=".zip") returned 4
	[0078.181] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0078.181] lstrlenW (lpString=".rar") returned 4
	[0078.182] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0078.182] lstrlenW (lpString=".bz2") returned 4
	[0078.182] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0078.182] lstrlenW (lpString=".7z") returned 3
	[0078.182] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0078.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0078.182] lstrlenW (lpString=".dbf") returned 4
	[0078.182] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0078.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0078.182] lstrlenW (lpString=".1cd") returned 4
	[0078.182] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0078.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0078.182] lstrlenW (lpString=".jpg") returned 4
	[0078.182] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0078.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0078.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0078.182] lstrlenW (lpString=".doc") returned 4
	[0078.182] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0078.182] lstrlenW (lpString=".docx") returned 5
	[0078.182] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0078.182] lstrlenW (lpString=".pdf") returned 4
	[0078.182] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0078.182] lstrlenW (lpString=".xls") returned 4
	[0078.182] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0078.182] lstrlenW (lpString=".xlsx") returned 5
	[0078.182] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0078.183] lstrlenW (lpString=".ppt") returned 4
	[0078.183] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0078.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0078.183] lstrlenW (lpString=".zip") returned 4
	[0078.183] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0078.183] lstrlenW (lpString=".rar") returned 4
	[0078.183] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0078.183] lstrlenW (lpString=".bz2") returned 4
	[0078.183] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0078.183] lstrlenW (lpString=".7z") returned 3
	[0078.183] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0078.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0078.183] lstrlenW (lpString=".dbf") returned 4
	[0078.183] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0078.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0078.183] lstrlenW (lpString=".1cd") returned 4
	[0078.183] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0078.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0078.183] lstrlenW (lpString=".jpg") returned 4
	[0078.183] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0078.183] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0078.183] lstrlenW (lpString="Proof.cab") returned 9
	[0078.183] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0078.184] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=11482605) returned 1
	[0078.184] CloseHandle (hObject=0x174) returned 1
	[0078.184] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020
	[0078.185] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0078.186] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0078.696] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0078.702] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1
	[0078.703] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0078.703] ReadFile (in: hFile=0x198, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0078.715] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0078.715] ReadFile (in: hFile=0x198, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0078.756] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0078.756] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0078.756] ReadFile (in: hFile=0x198, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0078.811] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.811] WriteFile (in: hFile=0x198, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0078.828] SetEndOfFile (hFile=0x198) returned 1
	[0078.829] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f40078
	[0078.847] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.847] WriteFile (in: hFile=0x198, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.847] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.848] WriteFile (in: hFile=0x198, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.850] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.850] WriteFile (in: hFile=0x198, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.852] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f40078 | out: hHeap=0x5e0000) returned 1
	[0078.852] CloseHandle (hObject=0x198) returned 1
	[0079.488] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0079.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0079.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0079.489] lstrlenW (lpString=".doc") returned 4
	[0079.489] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0079.489] lstrlenW (lpString=".docx") returned 5
	[0079.489] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0079.489] lstrlenW (lpString=".pdf") returned 4
	[0079.489] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0079.489] lstrlenW (lpString=".xls") returned 4
	[0079.489] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0079.489] lstrlenW (lpString=".xlsx") returned 5
	[0079.489] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0079.489] lstrlenW (lpString=".ppt") returned 4
	[0079.489] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0079.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0079.489] lstrlenW (lpString=".zip") returned 4
	[0079.489] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0079.489] lstrlenW (lpString=".rar") returned 4
	[0079.490] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0079.490] lstrlenW (lpString=".bz2") returned 4
	[0079.490] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0079.490] lstrlenW (lpString=".7z") returned 3
	[0079.490] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0079.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0079.490] lstrlenW (lpString=".dbf") returned 4
	[0079.490] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0079.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0079.490] lstrlenW (lpString=".1cd") returned 4
	[0079.490] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0079.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0079.490] lstrlenW (lpString=".jpg") returned 4
	[0079.490] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0079.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0079.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0079.490] lstrlenW (lpString=".doc") returned 4
	[0079.490] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0079.490] lstrlenW (lpString=".docx") returned 5
	[0079.490] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0079.490] lstrlenW (lpString=".pdf") returned 4
	[0079.490] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0079.490] lstrlenW (lpString=".xls") returned 4
	[0079.490] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0079.490] lstrlenW (lpString=".xlsx") returned 5
	[0079.491] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0079.491] lstrlenW (lpString=".ppt") returned 4
	[0079.491] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0079.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0079.491] lstrlenW (lpString=".zip") returned 4
	[0079.491] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0079.491] lstrlenW (lpString=".rar") returned 4
	[0079.491] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0079.491] lstrlenW (lpString=".bz2") returned 4
	[0079.491] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0079.491] lstrlenW (lpString=".7z") returned 3
	[0079.491] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0079.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0079.491] lstrlenW (lpString=".dbf") returned 4
	[0079.491] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0079.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0079.491] lstrlenW (lpString=".1cd") returned 4
	[0079.491] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0079.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0079.491] lstrlenW (lpString=".jpg") returned 4
	[0079.491] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0079.491] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0079.492] lstrlenW (lpString="Proof.msi") returned 9
	[0079.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0079.492] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=885760) returned 1
	[0079.492] CloseHandle (hObject=0x198) returned 1
	[0079.492] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020
	[0079.493] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0079.493] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0079.493] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.493] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.493] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0079.494] GetLastError () returned 0x0
	[0079.494] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xd8400, lpOverlapped=0x0) returned 1
	[0079.611] WriteFile (in: hFile=0x184, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xd8410, lpOverlapped=0x0) returned 1
	[0079.639] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0079.639] WriteFile (in: hFile=0x184, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0079.640] SetEndOfFile (hFile=0x184) returned 1
	[0079.640] CloseHandle (hObject=0x184) returned 1
	[0079.656] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.656] SetEndOfFile (hFile=0x198) returned 1
	[0079.664] CloseHandle (hObject=0x198) returned 1
	[0079.664] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0079.664] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1
	[0079.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0079.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0079.664] lstrlenW (lpString=".doc") returned 4
	[0079.665] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0079.665] lstrlenW (lpString=".docx") returned 5
	[0079.665] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0079.665] lstrlenW (lpString=".pdf") returned 4
	[0079.665] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0079.665] lstrlenW (lpString=".xls") returned 4
	[0079.665] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0079.665] lstrlenW (lpString=".xlsx") returned 5
	[0079.665] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0079.665] lstrlenW (lpString=".ppt") returned 4
	[0079.665] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0079.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0079.665] lstrlenW (lpString=".zip") returned 4
	[0079.665] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0079.665] lstrlenW (lpString=".rar") returned 4
	[0079.665] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0079.665] lstrlenW (lpString=".bz2") returned 4
	[0079.665] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0079.665] lstrlenW (lpString=".7z") returned 3
	[0079.665] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0079.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0079.665] lstrlenW (lpString=".dbf") returned 4
	[0079.665] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0079.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0079.665] lstrlenW (lpString=".1cd") returned 4
	[0079.665] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0079.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0079.665] lstrlenW (lpString=".jpg") returned 4
	[0079.665] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0079.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0079.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0079.666] lstrlenW (lpString=".doc") returned 4
	[0079.666] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0079.666] lstrlenW (lpString=".docx") returned 5
	[0079.666] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0079.666] lstrlenW (lpString=".pdf") returned 4
	[0079.666] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0079.666] lstrlenW (lpString=".xls") returned 4
	[0079.666] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0079.666] lstrlenW (lpString=".xlsx") returned 5
	[0079.666] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0079.666] lstrlenW (lpString=".ppt") returned 4
	[0079.666] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0079.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0079.666] lstrlenW (lpString=".zip") returned 4
	[0079.666] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0079.666] lstrlenW (lpString=".rar") returned 4
	[0079.666] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0079.666] lstrlenW (lpString=".bz2") returned 4
	[0079.666] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0079.666] lstrlenW (lpString=".7z") returned 3
	[0079.666] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0079.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0079.666] lstrlenW (lpString=".dbf") returned 4
	[0079.666] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0079.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0079.666] lstrlenW (lpString=".1cd") returned 4
	[0079.666] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0079.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0079.666] lstrlenW (lpString=".jpg") returned 4
	[0079.666] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0079.667] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0079.667] lstrlenW (lpString="Proofing.msi") returned 12
	[0079.667] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0079.667] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=868864) returned 1
	[0079.667] CloseHandle (hObject=0x198) returned 1
	[0079.667] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020
	[0079.667] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0079.667] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0079.668] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.669] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.669] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0079.669] GetLastError () returned 0x0
	[0079.669] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xd4200, lpOverlapped=0x0) returned 1
	[0079.740] WriteFile (in: hFile=0x184, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xd4210, lpOverlapped=0x0) returned 1
	[0079.758] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0079.758] WriteFile (in: hFile=0x184, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0079.758] SetEndOfFile (hFile=0x184) returned 1
	[0079.759] CloseHandle (hObject=0x184) returned 1
	[0079.815] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.816] SetEndOfFile (hFile=0x198) returned 1
	[0079.823] CloseHandle (hObject=0x198) returned 1
	[0079.824] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0079.824] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1
	[0079.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0079.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0079.824] lstrlenW (lpString=".doc") returned 4
	[0079.824] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0079.824] lstrlenW (lpString=".docx") returned 5
	[0079.824] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1
	[0079.824] lstrlenW (lpString=".pdf") returned 4
	[0079.824] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0079.824] lstrlenW (lpString=".xls") returned 4
	[0079.824] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0079.824] lstrlenW (lpString=".xlsx") returned 5
	[0079.824] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1
	[0079.824] lstrlenW (lpString=".ppt") returned 4
	[0079.824] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0079.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0079.825] lstrlenW (lpString=".zip") returned 4
	[0079.825] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0079.825] lstrlenW (lpString=".rar") returned 4
	[0079.825] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0079.825] lstrlenW (lpString=".bz2") returned 4
	[0079.825] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0079.825] lstrlenW (lpString=".7z") returned 3
	[0079.825] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0079.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0079.825] lstrlenW (lpString=".dbf") returned 4
	[0079.825] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0079.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0079.825] lstrlenW (lpString=".1cd") returned 4
	[0079.825] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0079.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0079.825] lstrlenW (lpString=".jpg") returned 4
	[0079.825] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0079.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0079.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0079.825] lstrlenW (lpString=".doc") returned 4
	[0079.825] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0079.825] lstrlenW (lpString=".docx") returned 5
	[0079.825] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1
	[0079.825] lstrlenW (lpString=".pdf") returned 4
	[0079.825] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0079.825] lstrlenW (lpString=".xls") returned 4
	[0079.825] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0079.825] lstrlenW (lpString=".xlsx") returned 5
	[0079.825] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1
	[0079.825] lstrlenW (lpString=".ppt") returned 4
	[0079.825] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0079.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0079.826] lstrlenW (lpString=".zip") returned 4
	[0079.826] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0079.826] lstrlenW (lpString=".rar") returned 4
	[0079.826] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0079.826] lstrlenW (lpString=".bz2") returned 4
	[0079.826] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0079.826] lstrlenW (lpString=".7z") returned 3
	[0079.826] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0079.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0079.826] lstrlenW (lpString=".dbf") returned 4
	[0079.826] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0079.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0079.826] lstrlenW (lpString=".1cd") returned 4
	[0079.826] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0079.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0079.826] lstrlenW (lpString=".jpg") returned 4
	[0079.826] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0079.826] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0079.826] lstrlenW (lpString="Office32MUI.msi") returned 15
	[0079.826] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0079.827] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=873984) returned 1
	[0079.827] CloseHandle (hObject=0x198) returned 1
	[0079.827] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020
	[0079.827] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0079.828] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0079.828] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.828] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.828] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0079.828] GetLastError () returned 0x0
	[0079.828] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xd5600, lpOverlapped=0x0) returned 1
	[0079.846] WriteFile (in: hFile=0x184, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xd5610, lpOverlapped=0x0) returned 1
	[0079.860] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0079.860] WriteFile (in: hFile=0x184, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0079.861] SetEndOfFile (hFile=0x184) returned 1
	[0079.861] CloseHandle (hObject=0x184) returned 1
	[0079.955] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.955] SetEndOfFile (hFile=0x198) returned 1
	[0079.965] CloseHandle (hObject=0x198) returned 1
	[0079.966] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0079.966] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1
	[0079.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0079.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0079.966] lstrlenW (lpString=".doc") returned 4
	[0079.967] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0079.967] lstrlenW (lpString=".docx") returned 5
	[0079.967] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0079.967] lstrlenW (lpString=".pdf") returned 4
	[0079.967] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0079.967] lstrlenW (lpString=".xls") returned 4
	[0079.967] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0079.967] lstrlenW (lpString=".xlsx") returned 5
	[0079.967] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0079.967] lstrlenW (lpString=".ppt") returned 4
	[0079.967] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0079.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0079.967] lstrlenW (lpString=".zip") returned 4
	[0079.967] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0079.967] lstrlenW (lpString=".rar") returned 4
	[0079.967] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0079.967] lstrlenW (lpString=".bz2") returned 4
	[0079.967] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0079.967] lstrlenW (lpString=".7z") returned 3
	[0079.967] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0079.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0079.967] lstrlenW (lpString=".dbf") returned 4
	[0079.967] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0079.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0079.967] lstrlenW (lpString=".1cd") returned 4
	[0079.967] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0079.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0079.968] lstrlenW (lpString=".jpg") returned 4
	[0079.968] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0079.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0079.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0079.968] lstrlenW (lpString=".doc") returned 4
	[0079.968] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0079.968] lstrlenW (lpString=".docx") returned 5
	[0079.968] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0079.968] lstrlenW (lpString=".pdf") returned 4
	[0079.968] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0079.968] lstrlenW (lpString=".xls") returned 4
	[0079.968] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0079.968] lstrlenW (lpString=".xlsx") returned 5
	[0079.968] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0079.968] lstrlenW (lpString=".ppt") returned 4
	[0079.968] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0079.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0079.968] lstrlenW (lpString=".zip") returned 4
	[0079.968] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0079.968] lstrlenW (lpString=".rar") returned 4
	[0079.968] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0079.968] lstrlenW (lpString=".bz2") returned 4
	[0079.968] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0079.969] lstrlenW (lpString=".7z") returned 3
	[0079.969] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0079.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0079.969] lstrlenW (lpString=".dbf") returned 4
	[0079.969] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0079.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0079.969] lstrlenW (lpString=".1cd") returned 4
	[0079.969] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0079.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0079.969] lstrlenW (lpString=".jpg") returned 4
	[0079.969] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0079.969] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0079.969] lstrlenW (lpString="OWOW32LR.cab") returned 12
	[0079.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0079.970] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2928955) returned 1
	[0079.970] CloseHandle (hObject=0x198) returned 1
	[0079.970] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020
	[0079.970] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0079.970] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0079.971] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0079.972] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1
	[0079.972] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0079.972] ReadFile (in: hFile=0x198, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0079.975] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0079.975] ReadFile (in: hFile=0x198, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0079.999] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0079.999] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0079.999] ReadFile (in: hFile=0x198, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.119] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.120] WriteFile (in: hFile=0x198, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0080.140] SetEndOfFile (hFile=0x198) returned 1
	[0080.140] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f40078
	[0080.193] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.193] WriteFile (in: hFile=0x198, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.285] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.285] WriteFile (in: hFile=0x198, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.292] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.292] WriteFile (in: hFile=0x198, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.296] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f40078 | out: hHeap=0x5e0000) returned 1
	[0080.296] CloseHandle (hObject=0x198) returned 1
	[0080.454] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0080.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0080.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0080.454] lstrlenW (lpString=".doc") returned 4
	[0080.454] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0080.454] lstrlenW (lpString=".docx") returned 5
	[0080.454] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0080.454] lstrlenW (lpString=".pdf") returned 4
	[0080.454] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0080.454] lstrlenW (lpString=".xls") returned 4
	[0080.455] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0080.455] lstrlenW (lpString=".xlsx") returned 5
	[0080.455] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0080.455] lstrlenW (lpString=".ppt") returned 4
	[0080.455] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0080.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0080.455] lstrlenW (lpString=".zip") returned 4
	[0080.455] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0080.455] lstrlenW (lpString=".rar") returned 4
	[0080.455] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0080.455] lstrlenW (lpString=".bz2") returned 4
	[0080.455] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0080.455] lstrlenW (lpString=".7z") returned 3
	[0080.455] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0080.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0080.455] lstrlenW (lpString=".dbf") returned 4
	[0080.455] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0080.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0080.455] lstrlenW (lpString=".1cd") returned 4
	[0080.455] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0080.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0080.455] lstrlenW (lpString=".jpg") returned 4
	[0080.455] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0080.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0080.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0080.455] lstrlenW (lpString=".doc") returned 4
	[0080.456] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0080.456] lstrlenW (lpString=".docx") returned 5
	[0080.456] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0080.456] lstrlenW (lpString=".pdf") returned 4
	[0080.456] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0080.456] lstrlenW (lpString=".xls") returned 4
	[0080.456] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0080.456] lstrlenW (lpString=".xlsx") returned 5
	[0080.456] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0080.456] lstrlenW (lpString=".ppt") returned 4
	[0080.456] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0080.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0080.456] lstrlenW (lpString=".zip") returned 4
	[0080.456] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0080.456] lstrlenW (lpString=".rar") returned 4
	[0080.456] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0080.456] lstrlenW (lpString=".bz2") returned 4
	[0080.456] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0080.456] lstrlenW (lpString=".7z") returned 3
	[0080.456] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0080.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0080.456] lstrlenW (lpString=".dbf") returned 4
	[0080.456] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0080.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0080.456] lstrlenW (lpString=".1cd") returned 4
	[0080.456] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0080.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0080.456] lstrlenW (lpString=".jpg") returned 4
	[0080.457] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0080.457] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0080.457] lstrlenW (lpString="InfoPathMUI.msi") returned 15
	[0080.457] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0080.457] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=3124224) returned 1
	[0080.457] CloseHandle (hObject=0x198) returned 1
	[0080.458] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020
	[0080.458] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0080.458] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0080.459] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0080.459] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1
	[0080.459] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.459] ReadFile (in: hFile=0x198, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.709] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.709] ReadFile (in: hFile=0x198, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.782] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0080.782] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.782] ReadFile (in: hFile=0x198, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.873] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.873] WriteFile (in: hFile=0x198, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc010a, lpOverlapped=0x0) returned 1
	[0080.891] SetEndOfFile (hFile=0x198) returned 1
	[0080.891] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f40078
	[0080.891] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.891] WriteFile (in: hFile=0x198, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.893] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.893] WriteFile (in: hFile=0x198, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.898] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.898] WriteFile (in: hFile=0x198, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.900] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f40078 | out: hHeap=0x5e0000) returned 1
	[0080.900] CloseHandle (hObject=0x198) returned 1
	[0080.900] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0080.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0080.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0080.900] lstrlenW (lpString=".doc") returned 4
	[0080.900] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0080.900] lstrlenW (lpString=".docx") returned 5
	[0080.900] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0080.901] lstrlenW (lpString=".pdf") returned 4
	[0080.901] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0080.901] lstrlenW (lpString=".xls") returned 4
	[0080.901] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0080.901] lstrlenW (lpString=".xlsx") returned 5
	[0080.901] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0080.901] lstrlenW (lpString=".ppt") returned 4
	[0080.901] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0080.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0080.901] lstrlenW (lpString=".zip") returned 4
	[0080.901] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0080.901] lstrlenW (lpString=".rar") returned 4
	[0080.901] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0080.901] lstrlenW (lpString=".bz2") returned 4
	[0080.901] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0080.901] lstrlenW (lpString=".7z") returned 3
	[0080.901] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0080.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0080.901] lstrlenW (lpString=".dbf") returned 4
	[0080.901] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0080.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0080.901] lstrlenW (lpString=".1cd") returned 4
	[0080.901] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0080.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0080.901] lstrlenW (lpString=".jpg") returned 4
	[0080.901] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0080.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0080.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0080.901] lstrlenW (lpString=".doc") returned 4
	[0080.901] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0080.901] lstrlenW (lpString=".docx") returned 5
	[0080.901] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0080.902] lstrlenW (lpString=".pdf") returned 4
	[0080.902] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0080.902] lstrlenW (lpString=".xls") returned 4
	[0080.902] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0080.902] lstrlenW (lpString=".xlsx") returned 5
	[0080.902] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0080.902] lstrlenW (lpString=".ppt") returned 4
	[0080.902] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0080.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0080.902] lstrlenW (lpString=".zip") returned 4
	[0080.902] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0080.902] lstrlenW (lpString=".rar") returned 4
	[0080.902] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0080.902] lstrlenW (lpString=".bz2") returned 4
	[0080.902] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0080.902] lstrlenW (lpString=".7z") returned 3
	[0080.902] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0080.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0080.902] lstrlenW (lpString=".dbf") returned 4
	[0080.902] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0080.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0080.902] lstrlenW (lpString=".1cd") returned 4
	[0080.902] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0080.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0080.902] lstrlenW (lpString=".jpg") returned 4
	[0080.902] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0080.902] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0080.902] lstrlenW (lpString="OnoteLR.cab") returned 11
	[0080.902] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0080.985] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=17456632) returned 1
	[0080.985] CloseHandle (hObject=0x1a4) returned 1
	[0080.986] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020
	[0080.986] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0080.986] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0080.987] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0080.987] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1
	[0080.987] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.987] ReadFile (in: hFile=0x1a4, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.990] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.990] ReadFile (in: hFile=0x1a4, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0081.079] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0081.079] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0081.079] ReadFile (in: hFile=0x1a4, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0081.174] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.175] WriteFile (in: hFile=0x1a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0081.196] SetEndOfFile (hFile=0x1a4) returned 1
	[0081.197] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f80080
	[0081.203] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.203] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f80080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f80080*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.206] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.206] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f80080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f80080*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.207] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.207] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f80080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f80080*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.209] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f80080 | out: hHeap=0x5e0000) returned 1
	[0081.209] CloseHandle (hObject=0x1a4) returned 1
	[0081.210] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0081.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0081.210] lstrlenW (lpString=".doc") returned 4
	[0081.211] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0081.211] lstrlenW (lpString=".docx") returned 5
	[0081.211] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0081.211] lstrlenW (lpString=".pdf") returned 4
	[0081.211] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0081.211] lstrlenW (lpString=".xls") returned 4
	[0081.211] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0081.211] lstrlenW (lpString=".xlsx") returned 5
	[0081.211] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0081.211] lstrlenW (lpString=".ppt") returned 4
	[0081.211] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0081.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0081.211] lstrlenW (lpString=".zip") returned 4
	[0081.211] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0081.211] lstrlenW (lpString=".rar") returned 4
	[0081.211] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0081.211] lstrlenW (lpString=".bz2") returned 4
	[0081.211] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0081.211] lstrlenW (lpString=".7z") returned 3
	[0081.211] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0081.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0081.211] lstrlenW (lpString=".dbf") returned 4
	[0081.211] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0081.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0081.211] lstrlenW (lpString=".1cd") returned 4
	[0081.211] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0081.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0081.211] lstrlenW (lpString=".jpg") returned 4
	[0081.211] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0081.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0081.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0081.211] lstrlenW (lpString=".doc") returned 4
	[0081.212] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0081.212] lstrlenW (lpString=".docx") returned 5
	[0081.212] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0081.212] lstrlenW (lpString=".pdf") returned 4
	[0081.212] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0081.212] lstrlenW (lpString=".xls") returned 4
	[0081.212] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0081.212] lstrlenW (lpString=".xlsx") returned 5
	[0081.212] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0081.212] lstrlenW (lpString=".ppt") returned 4
	[0081.212] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0081.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0081.212] lstrlenW (lpString=".zip") returned 4
	[0081.212] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0081.212] lstrlenW (lpString=".rar") returned 4
	[0081.212] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0081.212] lstrlenW (lpString=".bz2") returned 4
	[0081.212] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0081.212] lstrlenW (lpString=".7z") returned 3
	[0081.212] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0081.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0081.212] lstrlenW (lpString=".dbf") returned 4
	[0081.212] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0081.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0081.212] lstrlenW (lpString=".1cd") returned 4
	[0081.212] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0081.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0081.212] lstrlenW (lpString=".jpg") returned 4
	[0081.212] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0081.212] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0081.213] lstrlenW (lpString="GrooveMUI.msi") returned 13
	[0081.213] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0081.214] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2507776) returned 1
	[0081.214] CloseHandle (hObject=0x1a4) returned 1
	[0081.214] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020
	[0081.214] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.214] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0081.215] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0081.215] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1
	[0081.215] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0081.216] ReadFile (in: hFile=0x1a4, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0081.324] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0081.325] ReadFile (in: hFile=0x1a4, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0081.333] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0081.333] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0081.333] ReadFile (in: hFile=0x1a4, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0081.370] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.370] WriteFile (in: hFile=0x1a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc0106, lpOverlapped=0x0) returned 1
	[0081.387] SetEndOfFile (hFile=0x1a4) returned 1
	[0081.388] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3fc0008
	[0081.403] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.403] WriteFile (in: hFile=0x1a4, lpBuffer=0x3fc0008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc0008*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.404] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.404] WriteFile (in: hFile=0x1a4, lpBuffer=0x3fc0008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc0008*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.411] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.411] WriteFile (in: hFile=0x1a4, lpBuffer=0x3fc0008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc0008*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.415] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3fc0008 | out: hHeap=0x5e0000) returned 1
	[0081.415] CloseHandle (hObject=0x1a4) returned 1
	[0081.415] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0081.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0081.415] lstrlenW (lpString=".doc") returned 4
	[0081.415] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0081.415] lstrlenW (lpString=".docx") returned 5
	[0081.415] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0081.415] lstrlenW (lpString=".pdf") returned 4
	[0081.415] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0081.415] lstrlenW (lpString=".xls") returned 4
	[0081.415] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0081.415] lstrlenW (lpString=".xlsx") returned 5
	[0081.415] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0081.416] lstrlenW (lpString=".ppt") returned 4
	[0081.416] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0081.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0081.416] lstrlenW (lpString=".zip") returned 4
	[0081.416] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0081.416] lstrlenW (lpString=".rar") returned 4
	[0081.416] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0081.416] lstrlenW (lpString=".bz2") returned 4
	[0081.416] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0081.416] lstrlenW (lpString=".7z") returned 3
	[0081.416] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0081.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0081.416] lstrlenW (lpString=".dbf") returned 4
	[0081.416] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0081.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0081.416] lstrlenW (lpString=".1cd") returned 4
	[0081.416] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0081.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0081.416] lstrlenW (lpString=".jpg") returned 4
	[0081.416] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0081.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0081.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0081.416] lstrlenW (lpString=".doc") returned 4
	[0081.416] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0081.416] lstrlenW (lpString=".docx") returned 5
	[0081.416] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0081.416] lstrlenW (lpString=".pdf") returned 4
	[0081.416] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0081.416] lstrlenW (lpString=".xls") returned 4
	[0081.416] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0081.416] lstrlenW (lpString=".xlsx") returned 5
	[0081.416] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0081.417] lstrlenW (lpString=".ppt") returned 4
	[0081.417] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0081.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0081.417] lstrlenW (lpString=".zip") returned 4
	[0081.417] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0081.417] lstrlenW (lpString=".rar") returned 4
	[0081.417] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0081.417] lstrlenW (lpString=".bz2") returned 4
	[0081.417] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0081.417] lstrlenW (lpString=".7z") returned 3
	[0081.417] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0081.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0081.417] lstrlenW (lpString=".dbf") returned 4
	[0081.417] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0081.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0081.417] lstrlenW (lpString=".1cd") returned 4
	[0081.417] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0081.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0081.417] lstrlenW (lpString=".jpg") returned 4
	[0081.417] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0081.417] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0081.417] lstrlenW (lpString="dwtrig20.exe") returned 12
	[0081.417] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0081.477] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=519584) returned 1
	[0081.477] CloseHandle (hObject=0x19c) returned 1
	[0081.477] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020
	[0081.489] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.490] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0081.520] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.520] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.520] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0081.638] GetLastError () returned 0x0
	[0081.638] ReadFile (in: hFile=0x174, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x7eda0, lpOverlapped=0x0) returned 1
	[0081.651] WriteFile (in: hFile=0x1b0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x7edb0, lpOverlapped=0x0) returned 1
	[0081.676] ReadFile (in: hFile=0x174, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.676] WriteFile (in: hFile=0x1b0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0081.676] SetEndOfFile (hFile=0x1b0) returned 1
	[0081.681] CloseHandle (hObject=0x1b0) returned 1
	[0081.718] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.718] SetEndOfFile (hFile=0x174) returned 1
	[0081.839] CloseHandle (hObject=0x174) returned 1
	[0081.844] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.846] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1
	[0081.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0081.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0081.870] lstrlenW (lpString=".doc") returned 4
	[0081.870] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0081.870] lstrlenW (lpString=".docx") returned 5
	[0081.870] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1
	[0081.871] lstrlenW (lpString=".pdf") returned 4
	[0081.871] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0081.871] lstrlenW (lpString=".xls") returned 4
	[0081.871] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0081.871] lstrlenW (lpString=".xlsx") returned 5
	[0081.871] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1
	[0081.871] lstrlenW (lpString=".ppt") returned 4
	[0081.871] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0081.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0081.871] lstrlenW (lpString=".zip") returned 4
	[0081.871] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0081.871] lstrlenW (lpString=".rar") returned 4
	[0081.871] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0081.871] lstrlenW (lpString=".bz2") returned 4
	[0081.871] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0081.871] lstrlenW (lpString=".7z") returned 3
	[0081.871] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0081.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0081.871] lstrlenW (lpString=".dbf") returned 4
	[0081.871] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0081.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0081.871] lstrlenW (lpString=".1cd") returned 4
	[0081.871] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0081.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0081.871] lstrlenW (lpString=".jpg") returned 4
	[0081.871] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0081.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0081.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0081.872] lstrlenW (lpString=".doc") returned 4
	[0081.872] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0081.872] lstrlenW (lpString=".docx") returned 5
	[0081.872] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1
	[0081.872] lstrlenW (lpString=".pdf") returned 4
	[0081.872] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0081.872] lstrlenW (lpString=".xls") returned 4
	[0081.872] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0081.872] lstrlenW (lpString=".xlsx") returned 5
	[0081.872] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1
	[0081.872] lstrlenW (lpString=".ppt") returned 4
	[0081.872] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0081.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0081.872] lstrlenW (lpString=".zip") returned 4
	[0081.872] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0081.872] lstrlenW (lpString=".rar") returned 4
	[0081.872] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0081.872] lstrlenW (lpString=".bz2") returned 4
	[0081.872] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0081.872] lstrlenW (lpString=".7z") returned 3
	[0081.872] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0081.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0081.872] lstrlenW (lpString=".dbf") returned 4
	[0081.872] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0081.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0081.873] lstrlenW (lpString=".1cd") returned 4
	[0081.873] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0081.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0081.873] lstrlenW (lpString=".jpg") returned 4
	[0081.873] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0081.873] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0081.873] lstrlenW (lpString="msvcr90.dll") returned 11
	[0081.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.963] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=655872) returned 1
	[0081.963] CloseHandle (hObject=0x184) returned 1
	[0081.963] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020
	[0081.972] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.972] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0081.979] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.979] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.979] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0081.986] GetLastError () returned 0x0
	[0081.986] ReadFile (in: hFile=0x194, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xa0200, lpOverlapped=0x0) returned 1
	[0082.010] WriteFile (in: hFile=0x1b4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xa0210, lpOverlapped=0x0) returned 1
	[0082.028] ReadFile (in: hFile=0x194, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0082.028] WriteFile (in: hFile=0x1b4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0082.028] SetEndOfFile (hFile=0x1b4) returned 1
	[0082.078] CloseHandle (hObject=0x1b4) returned 1
	[0082.079] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.079] SetEndOfFile (hFile=0x194) returned 1
	[0082.098] CloseHandle (hObject=0x194) returned 1
	[0082.099] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0082.104] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1
	[0082.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0082.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0082.113] lstrlenW (lpString=".doc") returned 4
	[0082.113] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.113] lstrlenW (lpString=".docx") returned 5
	[0082.113] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0082.113] lstrlenW (lpString=".pdf") returned 4
	[0082.113] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.114] lstrlenW (lpString=".xls") returned 4
	[0082.114] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.114] lstrlenW (lpString=".xlsx") returned 5
	[0082.114] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0082.114] lstrlenW (lpString=".ppt") returned 4
	[0082.114] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0082.114] lstrlenW (lpString=".zip") returned 4
	[0082.114] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.114] lstrlenW (lpString=".rar") returned 4
	[0082.114] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.114] lstrlenW (lpString=".bz2") returned 4
	[0082.114] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.114] lstrlenW (lpString=".7z") returned 3
	[0082.114] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0082.114] lstrlenW (lpString=".dbf") returned 4
	[0082.114] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0082.114] lstrlenW (lpString=".1cd") returned 4
	[0082.114] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0082.114] lstrlenW (lpString=".jpg") returned 4
	[0082.114] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0082.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0082.115] lstrlenW (lpString=".doc") returned 4
	[0082.115] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.115] lstrlenW (lpString=".docx") returned 5
	[0082.115] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0082.115] lstrlenW (lpString=".pdf") returned 4
	[0082.115] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.115] lstrlenW (lpString=".xls") returned 4
	[0082.115] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.115] lstrlenW (lpString=".xlsx") returned 5
	[0082.115] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0082.115] lstrlenW (lpString=".ppt") returned 4
	[0082.115] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0082.115] lstrlenW (lpString=".zip") returned 4
	[0082.115] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.115] lstrlenW (lpString=".rar") returned 4
	[0082.115] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.115] lstrlenW (lpString=".bz2") returned 4
	[0082.115] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.115] lstrlenW (lpString=".7z") returned 3
	[0082.115] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0082.115] lstrlenW (lpString=".dbf") returned 4
	[0082.115] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0082.115] lstrlenW (lpString=".1cd") returned 4
	[0082.115] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0082.116] lstrlenW (lpString=".jpg") returned 4
	[0082.116] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.116] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0082.116] lstrlenW (lpString="osetupui.dll") returned 12
	[0082.116] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0082.303] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=191872) returned 1
	[0082.303] CloseHandle (hObject=0x19c) returned 1
	[0082.303] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020
	[0082.576] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0082.730] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.730] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.730] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0082.743] GetLastError () returned 0x0
	[0082.743] ReadFile (in: hFile=0x174, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x2ed80, lpOverlapped=0x0) returned 1
	[0082.750] WriteFile (in: hFile=0x1a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x2ed90, lpOverlapped=0x0) returned 1
	[0082.754] ReadFile (in: hFile=0x174, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0082.754] WriteFile (in: hFile=0x1a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0082.754] SetEndOfFile (hFile=0x1a8) returned 1
	[0082.755] CloseHandle (hObject=0x1a8) returned 1
	[0082.756] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.756] SetEndOfFile (hFile=0x174) returned 1
	[0082.759] CloseHandle (hObject=0x174) returned 1
	[0082.759] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0082.759] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1
	[0082.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0082.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0082.760] lstrlenW (lpString=".doc") returned 4
	[0082.760] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.760] lstrlenW (lpString=".docx") returned 5
	[0082.760] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0082.760] lstrlenW (lpString=".pdf") returned 4
	[0082.760] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.760] lstrlenW (lpString=".xls") returned 4
	[0082.760] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.760] lstrlenW (lpString=".xlsx") returned 5
	[0082.760] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0082.760] lstrlenW (lpString=".ppt") returned 4
	[0082.760] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0082.760] lstrlenW (lpString=".zip") returned 4
	[0082.760] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.760] lstrlenW (lpString=".rar") returned 4
	[0082.760] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.760] lstrlenW (lpString=".bz2") returned 4
	[0082.760] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.760] lstrlenW (lpString=".7z") returned 3
	[0082.760] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0082.760] lstrlenW (lpString=".dbf") returned 4
	[0082.761] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0082.761] lstrlenW (lpString=".1cd") returned 4
	[0082.761] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0082.761] lstrlenW (lpString=".jpg") returned 4
	[0082.761] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0082.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0082.761] lstrlenW (lpString=".doc") returned 4
	[0082.761] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.761] lstrlenW (lpString=".docx") returned 5
	[0082.761] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0082.761] lstrlenW (lpString=".pdf") returned 4
	[0082.761] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.761] lstrlenW (lpString=".xls") returned 4
	[0082.761] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.761] lstrlenW (lpString=".xlsx") returned 5
	[0082.761] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0082.761] lstrlenW (lpString=".ppt") returned 4
	[0082.761] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0082.761] lstrlenW (lpString=".zip") returned 4
	[0082.761] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.761] lstrlenW (lpString=".rar") returned 4
	[0082.762] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.762] lstrlenW (lpString=".bz2") returned 4
	[0082.762] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.762] lstrlenW (lpString=".7z") returned 3
	[0082.762] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0082.762] lstrlenW (lpString=".dbf") returned 4
	[0082.762] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0082.762] lstrlenW (lpString=".1cd") returned 4
	[0082.762] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0082.762] lstrlenW (lpString=".jpg") returned 4
	[0082.762] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.762] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0082.762] lstrlenW (lpString="PidGenX.dll") returned 11
	[0082.762] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0082.809] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1463568) returned 1
	[0082.809] CloseHandle (hObject=0x1b0) returned 1
	[0082.809] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020
	[0082.824] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.830] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0082.944] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.945] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0083.012] GetLastError () returned 0x0
	[0083.012] ReadFile (in: hFile=0x1b0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0083.036] WriteFile (in: hFile=0x160, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0083.059] ReadFile (in: hFile=0x1b0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x65520, lpOverlapped=0x0) returned 1
	[0083.115] WriteFile (in: hFile=0x160, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x65530, lpOverlapped=0x0) returned 1
	[0083.129] ReadFile (in: hFile=0x1b0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0083.129] WriteFile (in: hFile=0x160, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0083.130] SetEndOfFile (hFile=0x160) returned 1
	[0083.147] CloseHandle (hObject=0x160) returned 1
	[0083.172] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.173] SetEndOfFile (hFile=0x1b0) returned 1
	[0083.237] CloseHandle (hObject=0x1b0) returned 1
	[0083.252] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0083.253] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1
	[0083.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0083.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0083.261] lstrlenW (lpString=".doc") returned 4
	[0083.261] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.261] lstrlenW (lpString=".docx") returned 5
	[0083.261] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0083.261] lstrlenW (lpString=".pdf") returned 4
	[0083.261] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.261] lstrlenW (lpString=".xls") returned 4
	[0083.261] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.261] lstrlenW (lpString=".xlsx") returned 5
	[0083.261] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0083.261] lstrlenW (lpString=".ppt") returned 4
	[0083.261] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0083.262] lstrlenW (lpString=".zip") returned 4
	[0083.262] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.262] lstrlenW (lpString=".rar") returned 4
	[0083.262] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.262] lstrlenW (lpString=".bz2") returned 4
	[0083.262] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.262] lstrlenW (lpString=".7z") returned 3
	[0083.262] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0083.262] lstrlenW (lpString=".dbf") returned 4
	[0083.262] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0083.262] lstrlenW (lpString=".1cd") returned 4
	[0083.262] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0083.262] lstrlenW (lpString=".jpg") returned 4
	[0083.262] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0083.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0083.262] lstrlenW (lpString=".doc") returned 4
	[0083.263] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.263] lstrlenW (lpString=".docx") returned 5
	[0083.263] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0083.263] lstrlenW (lpString=".pdf") returned 4
	[0083.263] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.263] lstrlenW (lpString=".xls") returned 4
	[0083.263] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.263] lstrlenW (lpString=".xlsx") returned 5
	[0083.263] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0083.263] lstrlenW (lpString=".ppt") returned 4
	[0083.263] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0083.263] lstrlenW (lpString=".zip") returned 4
	[0083.263] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.263] lstrlenW (lpString=".rar") returned 4
	[0083.263] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.263] lstrlenW (lpString=".bz2") returned 4
	[0083.263] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.263] lstrlenW (lpString=".7z") returned 3
	[0083.263] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0083.263] lstrlenW (lpString=".dbf") returned 4
	[0083.263] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0083.263] lstrlenW (lpString=".1cd") returned 4
	[0083.263] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0083.264] lstrlenW (lpString=".jpg") returned 4
	[0083.264] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.264] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0083.264] lstrlenW (lpString="setup.exe") returned 9
	[0083.264] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0083.272] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1377656) returned 1
	[0083.272] CloseHandle (hObject=0x1a4) returned 1
	[0083.272] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020
	[0083.285] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.289] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0083.299] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.299] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.299] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0083.307] GetLastError () returned 0x0
	[0083.307] ReadFile (in: hFile=0x160, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0083.338] WriteFile (in: hFile=0x1b0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0083.369] ReadFile (in: hFile=0x160, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x50588, lpOverlapped=0x0) returned 1
	[0083.398] WriteFile (in: hFile=0x1b0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x50590, lpOverlapped=0x0) returned 1
	[0083.414] ReadFile (in: hFile=0x160, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0083.415] WriteFile (in: hFile=0x1b0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0083.415] SetEndOfFile (hFile=0x1b0) returned 1
	[0083.473] CloseHandle (hObject=0x1b0) returned 1
	[0083.477] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.477] SetEndOfFile (hFile=0x160) returned 1
	[0083.510] CloseHandle (hObject=0x160) returned 1
	[0083.552] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0083.556] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1
	[0083.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0083.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0083.669] lstrlenW (lpString=".doc") returned 4
	[0083.669] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.669] lstrlenW (lpString=".docx") returned 5
	[0083.669] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0083.669] lstrlenW (lpString=".pdf") returned 4
	[0083.669] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.669] lstrlenW (lpString=".xls") returned 4
	[0083.669] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.670] lstrlenW (lpString=".xlsx") returned 5
	[0083.670] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0083.670] lstrlenW (lpString=".ppt") returned 4
	[0083.670] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0083.670] lstrlenW (lpString=".zip") returned 4
	[0083.670] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.670] lstrlenW (lpString=".rar") returned 4
	[0083.670] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.670] lstrlenW (lpString=".bz2") returned 4
	[0083.670] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.670] lstrlenW (lpString=".7z") returned 3
	[0083.670] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0083.670] lstrlenW (lpString=".dbf") returned 4
	[0083.670] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0083.670] lstrlenW (lpString=".1cd") returned 4
	[0083.670] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0083.671] lstrlenW (lpString=".jpg") returned 4
	[0083.671] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0083.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0083.671] lstrlenW (lpString=".doc") returned 4
	[0083.671] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.671] lstrlenW (lpString=".docx") returned 5
	[0083.671] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0083.671] lstrlenW (lpString=".pdf") returned 4
	[0083.671] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.671] lstrlenW (lpString=".xls") returned 4
	[0083.671] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.671] lstrlenW (lpString=".xlsx") returned 5
	[0083.671] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0083.671] lstrlenW (lpString=".ppt") returned 4
	[0083.671] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0083.671] lstrlenW (lpString=".zip") returned 4
	[0083.671] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.671] lstrlenW (lpString=".rar") returned 4
	[0083.671] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.671] lstrlenW (lpString=".bz2") returned 4
	[0083.671] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.672] lstrlenW (lpString=".7z") returned 3
	[0083.672] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0083.672] lstrlenW (lpString=".dbf") returned 4
	[0083.672] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0083.672] lstrlenW (lpString=".1cd") returned 4
	[0083.672] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0083.672] lstrlenW (lpString=".jpg") returned 4
	[0083.672] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.672] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0083.672] lstrlenW (lpString="osetup.dll") returned 10
	[0083.672] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.673] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=7378792) returned 1
	[0083.673] CloseHandle (hObject=0x1a8) returned 1
	[0083.673] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020
	[0083.673] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.673] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0083.674] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.675] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1
	[0083.675] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.675] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.722] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.722] ReadFile (in: hFile=0x1a8, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.726] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0083.727] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.727] ReadFile (in: hFile=0x1a8, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.777] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.777] WriteFile (in: hFile=0x1a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0083.805] SetEndOfFile (hFile=0x1a8) returned 1
	[0083.830] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0083.836] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.836] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.837] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.837] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.839] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.839] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.841] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0083.841] CloseHandle (hObject=0x1a8) returned 1
	[0083.842] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0083.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.843] lstrlenW (lpString=".doc") returned 4
	[0083.843] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.843] lstrlenW (lpString=".docx") returned 5
	[0083.843] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0083.843] lstrlenW (lpString=".pdf") returned 4
	[0083.843] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.843] lstrlenW (lpString=".xls") returned 4
	[0083.843] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.843] lstrlenW (lpString=".xlsx") returned 5
	[0083.843] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0083.843] lstrlenW (lpString=".ppt") returned 4
	[0083.843] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.843] lstrlenW (lpString=".zip") returned 4
	[0083.843] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.843] lstrlenW (lpString=".rar") returned 4
	[0083.843] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.844] lstrlenW (lpString=".bz2") returned 4
	[0083.844] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.844] lstrlenW (lpString=".7z") returned 3
	[0083.844] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.844] lstrlenW (lpString=".dbf") returned 4
	[0083.844] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.844] lstrlenW (lpString=".1cd") returned 4
	[0083.844] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.844] lstrlenW (lpString=".jpg") returned 4
	[0083.844] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.844] lstrlenW (lpString=".doc") returned 4
	[0083.844] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.844] lstrlenW (lpString=".docx") returned 5
	[0083.844] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0083.844] lstrlenW (lpString=".pdf") returned 4
	[0083.844] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.844] lstrlenW (lpString=".xls") returned 4
	[0083.844] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.844] lstrlenW (lpString=".xlsx") returned 5
	[0083.844] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0083.844] lstrlenW (lpString=".ppt") returned 4
	[0083.844] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.844] lstrlenW (lpString=".zip") returned 4
	[0083.845] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.845] lstrlenW (lpString=".rar") returned 4
	[0083.845] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.845] lstrlenW (lpString=".bz2") returned 4
	[0083.845] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.845] lstrlenW (lpString=".7z") returned 3
	[0083.845] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.845] lstrlenW (lpString=".dbf") returned 4
	[0083.845] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.845] lstrlenW (lpString=".1cd") returned 4
	[0083.845] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.845] lstrlenW (lpString=".jpg") returned 4
	[0083.845] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.845] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0083.845] lstrlenW (lpString="PrjProrWW.msi") returned 13
	[0083.845] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.855] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=10798080) returned 1
	[0083.855] CloseHandle (hObject=0x1a8) returned 1
	[0083.855] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020
	[0083.892] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.896] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0084.069] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.081] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1
	[0084.081] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.081] ReadFile (in: hFile=0x1b0, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.089] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.089] ReadFile (in: hFile=0x1b0, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.134] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0084.134] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.134] ReadFile (in: hFile=0x1b0, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.159] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.159] WriteFile (in: hFile=0x1b0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc0106, lpOverlapped=0x0) returned 1
	[0084.187] SetEndOfFile (hFile=0x1b0) returned 1
	[0084.205] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0084.205] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0084.205] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0084.206] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0084.206] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0084.209] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0084.209] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0084.215] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0084.215] CloseHandle (hObject=0x1b0) returned 1
	[0084.233] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0084.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0084.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0084.311] lstrlenW (lpString=".doc") returned 4
	[0084.311] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0084.311] lstrlenW (lpString=".docx") returned 5
	[0084.311] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0084.312] lstrlenW (lpString=".pdf") returned 4
	[0084.312] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0084.312] lstrlenW (lpString=".xls") returned 4
	[0084.312] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0084.312] lstrlenW (lpString=".xlsx") returned 5
	[0084.312] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0084.312] lstrlenW (lpString=".ppt") returned 4
	[0084.312] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0084.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0084.312] lstrlenW (lpString=".zip") returned 4
	[0084.312] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0084.312] lstrlenW (lpString=".rar") returned 4
	[0084.312] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0084.312] lstrlenW (lpString=".bz2") returned 4
	[0084.312] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0084.312] lstrlenW (lpString=".7z") returned 3
	[0084.312] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0084.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0084.312] lstrlenW (lpString=".dbf") returned 4
	[0084.312] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0084.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0084.312] lstrlenW (lpString=".1cd") returned 4
	[0084.312] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0084.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0084.313] lstrlenW (lpString=".jpg") returned 4
	[0084.313] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0084.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0084.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0084.313] lstrlenW (lpString=".doc") returned 4
	[0084.313] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0084.313] lstrlenW (lpString=".docx") returned 5
	[0084.313] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0084.313] lstrlenW (lpString=".pdf") returned 4
	[0084.313] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0084.313] lstrlenW (lpString=".xls") returned 4
	[0084.313] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0084.313] lstrlenW (lpString=".xlsx") returned 5
	[0084.313] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0084.313] lstrlenW (lpString=".ppt") returned 4
	[0084.313] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0084.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0084.313] lstrlenW (lpString=".zip") returned 4
	[0084.313] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0084.314] lstrlenW (lpString=".rar") returned 4
	[0084.314] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0084.314] lstrlenW (lpString=".bz2") returned 4
	[0084.314] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0084.314] lstrlenW (lpString=".7z") returned 3
	[0084.314] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0084.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0084.314] lstrlenW (lpString=".dbf") returned 4
	[0084.314] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0084.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0084.314] lstrlenW (lpString=".1cd") returned 4
	[0084.314] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0084.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0084.314] lstrlenW (lpString=".jpg") returned 4
	[0084.314] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0084.314] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0084.314] lstrlenW (lpString="osetup.dll") returned 10
	[0084.314] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0084.322] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=7378792) returned 1
	[0084.322] CloseHandle (hObject=0x1a4) returned 1
	[0084.322] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020
	[0084.334] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.337] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0084.933] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0085.031] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1
	[0085.031] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0085.031] ReadFile (in: hFile=0x188, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0085.037] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0085.037] ReadFile (in: hFile=0x188, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0085.041] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0085.041] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0085.042] ReadFile (in: hFile=0x188, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0085.067] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.067] WriteFile (in: hFile=0x188, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0085.088] SetEndOfFile (hFile=0x188) returned 1
	[0085.092] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0085.097] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0085.097] WriteFile (in: hFile=0x188, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0085.099] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0085.099] WriteFile (in: hFile=0x188, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0085.102] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0085.102] WriteFile (in: hFile=0x188, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0085.104] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0085.104] CloseHandle (hObject=0x188) returned 1
	[0085.114] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0085.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0085.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0085.119] lstrlenW (lpString=".doc") returned 4
	[0085.119] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.119] lstrlenW (lpString=".docx") returned 5
	[0085.119] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0085.119] lstrlenW (lpString=".pdf") returned 4
	[0085.119] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.119] lstrlenW (lpString=".xls") returned 4
	[0085.119] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.119] lstrlenW (lpString=".xlsx") returned 5
	[0085.119] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0085.119] lstrlenW (lpString=".ppt") returned 4
	[0085.119] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0085.119] lstrlenW (lpString=".zip") returned 4
	[0085.119] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.119] lstrlenW (lpString=".rar") returned 4
	[0085.119] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.119] lstrlenW (lpString=".bz2") returned 4
	[0085.120] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.120] lstrlenW (lpString=".7z") returned 3
	[0085.120] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0085.120] lstrlenW (lpString=".dbf") returned 4
	[0085.120] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0085.120] lstrlenW (lpString=".1cd") returned 4
	[0085.120] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0085.120] lstrlenW (lpString=".jpg") returned 4
	[0085.120] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0085.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0085.120] lstrlenW (lpString=".doc") returned 4
	[0085.120] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.120] lstrlenW (lpString=".docx") returned 5
	[0085.120] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0085.120] lstrlenW (lpString=".pdf") returned 4
	[0085.120] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.120] lstrlenW (lpString=".xls") returned 4
	[0085.120] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.120] lstrlenW (lpString=".xlsx") returned 5
	[0085.120] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0085.120] lstrlenW (lpString=".ppt") returned 4
	[0085.121] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0085.121] lstrlenW (lpString=".zip") returned 4
	[0085.121] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.121] lstrlenW (lpString=".rar") returned 4
	[0085.121] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.121] lstrlenW (lpString=".bz2") returned 4
	[0085.121] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.121] lstrlenW (lpString=".7z") returned 3
	[0085.121] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0085.121] lstrlenW (lpString=".dbf") returned 4
	[0085.121] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0085.121] lstrlenW (lpString=".1cd") returned 4
	[0085.121] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0085.121] lstrlenW (lpString=".jpg") returned 4
	[0085.121] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.121] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0085.121] lstrlenW (lpString="setup.exe") returned 9
	[0085.121] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.302] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1377656) returned 1
	[0085.302] CloseHandle (hObject=0x1a4) returned 1
	[0085.302] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020
	[0085.515] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.587] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0085.768] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.768] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.769] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0085.925] GetLastError () returned 0x0
	[0085.925] ReadFile (in: hFile=0x174, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0085.949] WriteFile (in: hFile=0x19c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0085.971] ReadFile (in: hFile=0x174, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x50588, lpOverlapped=0x0) returned 1
	[0086.000] WriteFile (in: hFile=0x19c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x50590, lpOverlapped=0x0) returned 1
	[0086.010] ReadFile (in: hFile=0x174, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.010] WriteFile (in: hFile=0x19c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0086.010] SetEndOfFile (hFile=0x19c) returned 1
	[0086.019] CloseHandle (hObject=0x19c) returned 1
	[0086.025] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.025] SetEndOfFile (hFile=0x174) returned 1
	[0086.036] CloseHandle (hObject=0x174) returned 1
	[0086.037] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0086.038] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1
	[0086.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0086.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0086.039] lstrlenW (lpString=".doc") returned 4
	[0086.039] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.039] lstrlenW (lpString=".docx") returned 5
	[0086.039] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0086.040] lstrlenW (lpString=".pdf") returned 4
	[0086.040] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.040] lstrlenW (lpString=".xls") returned 4
	[0086.040] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.040] lstrlenW (lpString=".xlsx") returned 5
	[0086.040] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0086.040] lstrlenW (lpString=".ppt") returned 4
	[0086.040] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0086.040] lstrlenW (lpString=".zip") returned 4
	[0086.040] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.040] lstrlenW (lpString=".rar") returned 4
	[0086.040] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.040] lstrlenW (lpString=".bz2") returned 4
	[0086.040] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.040] lstrlenW (lpString=".7z") returned 3
	[0086.040] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0086.040] lstrlenW (lpString=".dbf") returned 4
	[0086.040] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0086.040] lstrlenW (lpString=".1cd") returned 4
	[0086.040] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0086.040] lstrlenW (lpString=".jpg") returned 4
	[0086.040] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0086.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0086.040] lstrlenW (lpString=".doc") returned 4
	[0086.040] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.040] lstrlenW (lpString=".docx") returned 5
	[0086.041] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0086.041] lstrlenW (lpString=".pdf") returned 4
	[0086.041] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.041] lstrlenW (lpString=".xls") returned 4
	[0086.041] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.041] lstrlenW (lpString=".xlsx") returned 5
	[0086.041] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0086.041] lstrlenW (lpString=".ppt") returned 4
	[0086.041] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0086.041] lstrlenW (lpString=".zip") returned 4
	[0086.041] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.041] lstrlenW (lpString=".rar") returned 4
	[0086.041] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.041] lstrlenW (lpString=".bz2") returned 4
	[0086.041] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.041] lstrlenW (lpString=".7z") returned 3
	[0086.041] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0086.041] lstrlenW (lpString=".dbf") returned 4
	[0086.041] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0086.041] lstrlenW (lpString=".1cd") returned 4
	[0086.041] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0086.041] lstrlenW (lpString=".jpg") returned 4
	[0086.041] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.042] lstrcmpiW (lpString1=".manifest", lpString2=".adobe") returned 1
	[0086.042] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21
	[0086.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.222] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=566) returned 1
	[0086.222] CloseHandle (hObject=0x19c) returned 1
	[0086.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20
	[0086.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0086.373] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.373] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.610] GetLastError () returned 0x0
	[0086.610] ReadFile (in: hFile=0x188, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x236, lpOverlapped=0x0) returned 1
	[0086.611] WriteFile (in: hFile=0x19c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x240, lpOverlapped=0x0) returned 1
	[0086.614] ReadFile (in: hFile=0x188, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.614] WriteFile (in: hFile=0x19c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfe, lpOverlapped=0x0) returned 1
	[0086.614] SetEndOfFile (hFile=0x19c) returned 1
	[0086.614] CloseHandle (hObject=0x19c) returned 1
	[0086.614] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.614] SetEndOfFile (hFile=0x188) returned 1
	[0086.615] CloseHandle (hObject=0x188) returned 1
	[0086.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.616] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1
	[0086.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0086.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0086.616] lstrlenW (lpString=".doc") returned 4
	[0086.616] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0086.616] lstrlenW (lpString=".docx") returned 5
	[0086.616] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0086.616] lstrlenW (lpString=".pdf") returned 4
	[0086.616] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0086.616] lstrlenW (lpString=".xls") returned 4
	[0086.617] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0086.617] lstrlenW (lpString=".xlsx") returned 5
	[0086.617] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0086.617] lstrlenW (lpString=".ppt") returned 4
	[0086.617] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0086.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0086.617] lstrlenW (lpString=".zip") returned 4
	[0086.617] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0086.617] lstrlenW (lpString=".rar") returned 4
	[0086.617] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0086.617] lstrlenW (lpString=".bz2") returned 4
	[0086.617] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0086.617] lstrlenW (lpString=".7z") returned 3
	[0086.617] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0086.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0086.617] lstrlenW (lpString=".dbf") returned 4
	[0086.617] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0086.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0086.617] lstrlenW (lpString=".1cd") returned 4
	[0086.617] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0086.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0086.617] lstrlenW (lpString=".jpg") returned 4
	[0086.617] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0086.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0086.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0086.617] lstrlenW (lpString=".doc") returned 4
	[0086.618] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0086.618] lstrlenW (lpString=".docx") returned 5
	[0086.618] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0086.618] lstrlenW (lpString=".pdf") returned 4
	[0086.618] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0086.618] lstrlenW (lpString=".xls") returned 4
	[0086.618] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0086.618] lstrlenW (lpString=".xlsx") returned 5
	[0086.618] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0086.618] lstrlenW (lpString=".ppt") returned 4
	[0086.618] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0086.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0086.618] lstrlenW (lpString=".zip") returned 4
	[0086.618] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0086.618] lstrlenW (lpString=".rar") returned 4
	[0086.618] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0086.618] lstrlenW (lpString=".bz2") returned 4
	[0086.618] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0086.618] lstrlenW (lpString=".7z") returned 3
	[0086.618] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0086.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0086.618] lstrlenW (lpString=".dbf") returned 4
	[0086.618] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0086.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0086.618] lstrlenW (lpString=".1cd") returned 4
	[0086.618] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0086.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0086.619] lstrlenW (lpString=".jpg") returned 4
	[0086.619] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0086.619] lstrcmpiW (lpString1=".CFG", lpString2=".adobe") returned 1
	[0086.619] lstrlenW (lpString="CGMIMP32.CFG") returned 12
	[0086.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.621] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=6811) returned 1
	[0086.621] CloseHandle (hObject=0x19c) returned 1
	[0086.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20
	[0086.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.622] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.622] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0086.627] GetLastError () returned 0x0
	[0086.627] ReadFile (in: hFile=0x19c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x1a9b, lpOverlapped=0x0) returned 1
	[0086.639] WriteFile (in: hFile=0x1b4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x1aa0, lpOverlapped=0x0) returned 1
	[0086.640] ReadFile (in: hFile=0x19c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.640] WriteFile (in: hFile=0x1b4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0086.640] SetEndOfFile (hFile=0x1b4) returned 1
	[0086.640] CloseHandle (hObject=0x1b4) returned 1
	[0086.640] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.640] SetEndOfFile (hFile=0x19c) returned 1
	[0086.642] CloseHandle (hObject=0x19c) returned 1
	[0086.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.642] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1
	[0086.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67
	[0086.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67
	[0086.642] lstrlenW (lpString=".doc") returned 4
	[0086.642] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1
	[0086.642] lstrlenW (lpString=".docx") returned 5
	[0086.642] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1
	[0086.642] lstrlenW (lpString=".pdf") returned 4
	[0086.642] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1
	[0086.643] lstrlenW (lpString=".xls") returned 4
	[0086.643] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1
	[0086.643] lstrlenW (lpString=".xlsx") returned 5
	[0086.643] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1
	[0086.643] lstrlenW (lpString=".ppt") returned 4
	[0086.643] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1
	[0086.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67
	[0086.643] lstrlenW (lpString=".zip") returned 4
	[0086.643] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1
	[0086.643] lstrlenW (lpString=".rar") returned 4
	[0086.643] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1
	[0086.643] lstrlenW (lpString=".bz2") returned 4
	[0086.643] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1
	[0086.643] lstrlenW (lpString=".7z") returned 3
	[0086.643] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1
	[0086.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67
	[0086.643] lstrlenW (lpString=".dbf") returned 4
	[0086.643] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1
	[0086.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67
	[0086.643] lstrlenW (lpString=".1cd") returned 4
	[0086.643] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1
	[0086.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67
	[0086.643] lstrlenW (lpString=".jpg") returned 4
	[0086.643] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1
	[0086.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67
	[0086.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67
	[0086.644] lstrlenW (lpString=".doc") returned 4
	[0086.644] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1
	[0086.644] lstrlenW (lpString=".docx") returned 5
	[0086.644] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1
	[0086.644] lstrlenW (lpString=".pdf") returned 4
	[0086.644] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1
	[0086.644] lstrlenW (lpString=".xls") returned 4
	[0086.644] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1
	[0086.644] lstrlenW (lpString=".xlsx") returned 5
	[0086.644] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1
	[0086.644] lstrlenW (lpString=".ppt") returned 4
	[0086.644] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1
	[0086.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67
	[0086.644] lstrlenW (lpString=".zip") returned 4
	[0086.644] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1
	[0086.644] lstrlenW (lpString=".rar") returned 4
	[0086.644] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1
	[0086.644] lstrlenW (lpString=".bz2") returned 4
	[0086.644] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1
	[0086.644] lstrlenW (lpString=".7z") returned 3
	[0086.644] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1
	[0086.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67
	[0086.644] lstrlenW (lpString=".dbf") returned 4
	[0086.644] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1
	[0086.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67
	[0086.644] lstrlenW (lpString=".1cd") returned 4
	[0086.644] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1
	[0086.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67
	[0086.645] lstrlenW (lpString=".jpg") returned 4
	[0086.645] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1
	[0086.645] lstrcmpiW (lpString1=".FLT", lpString2=".adobe") returned 1
	[0086.645] lstrlenW (lpString="CGMIMP32.FLT") returned 12
	[0086.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.724] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=323936) returned 1
	[0086.724] CloseHandle (hObject=0x194) returned 1
	[0086.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20
	[0086.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0086.799] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.799] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.027] GetLastError () returned 0x0
	[0087.027] ReadFile (in: hFile=0x190, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x4f160, lpOverlapped=0x0) returned 1
	[0087.039] WriteFile (in: hFile=0x1ac, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x4f170, lpOverlapped=0x0) returned 1
	[0087.046] ReadFile (in: hFile=0x190, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.046] WriteFile (in: hFile=0x1ac, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0087.046] SetEndOfFile (hFile=0x1ac) returned 1
	[0087.050] CloseHandle (hObject=0x1ac) returned 1
	[0087.066] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.066] SetEndOfFile (hFile=0x190) returned 1
	[0087.110] CloseHandle (hObject=0x190) returned 1
	[0087.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0087.114] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1
	[0087.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0087.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0087.124] lstrlenW (lpString=".doc") returned 4
	[0087.124] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0087.124] lstrlenW (lpString=".docx") returned 5
	[0087.124] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0087.124] lstrlenW (lpString=".pdf") returned 4
	[0087.124] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0087.124] lstrlenW (lpString=".xls") returned 4
	[0087.124] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0087.124] lstrlenW (lpString=".xlsx") returned 5
	[0087.124] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0087.124] lstrlenW (lpString=".ppt") returned 4
	[0087.124] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0087.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0087.124] lstrlenW (lpString=".zip") returned 4
	[0087.124] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0087.124] lstrlenW (lpString=".rar") returned 4
	[0087.124] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0087.124] lstrlenW (lpString=".bz2") returned 4
	[0087.124] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0087.124] lstrlenW (lpString=".7z") returned 3
	[0087.124] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0087.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0087.124] lstrlenW (lpString=".dbf") returned 4
	[0087.125] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0087.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0087.125] lstrlenW (lpString=".1cd") returned 4
	[0087.125] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0087.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0087.125] lstrlenW (lpString=".jpg") returned 4
	[0087.125] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0087.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0087.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0087.125] lstrlenW (lpString=".doc") returned 4
	[0087.125] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0087.125] lstrlenW (lpString=".docx") returned 5
	[0087.125] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0087.125] lstrlenW (lpString=".pdf") returned 4
	[0087.125] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0087.125] lstrlenW (lpString=".xls") returned 4
	[0087.125] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0087.125] lstrlenW (lpString=".xlsx") returned 5
	[0087.125] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0087.125] lstrlenW (lpString=".ppt") returned 4
	[0087.125] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0087.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0087.125] lstrlenW (lpString=".zip") returned 4
	[0087.125] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0087.125] lstrlenW (lpString=".rar") returned 4
	[0087.125] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0087.126] lstrlenW (lpString=".bz2") returned 4
	[0087.126] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0087.126] lstrlenW (lpString=".7z") returned 3
	[0087.126] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0087.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0087.126] lstrlenW (lpString=".dbf") returned 4
	[0087.126] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0087.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0087.126] lstrlenW (lpString=".1cd") returned 4
	[0087.126] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0087.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0087.126] lstrlenW (lpString=".jpg") returned 4
	[0087.126] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0087.126] lstrcmpiW (lpString1=".FLT", lpString2=".adobe") returned 1
	[0087.126] lstrlenW (lpString="JPEGIM32.FLT") returned 12
	[0087.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0087.219] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=241024) returned 1
	[0087.220] CloseHandle (hObject=0x194) returned 1
	[0087.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20
	[0087.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0087.281] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.281] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.308] GetLastError () returned 0x0
	[0087.308] ReadFile (in: hFile=0x19c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x3ad80, lpOverlapped=0x0) returned 1
	[0087.315] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x3ad90, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x3ad90, lpOverlapped=0x0) returned 1
	[0087.320] ReadFile (in: hFile=0x19c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.320] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0087.320] SetEndOfFile (hFile=0x174) returned 1
	[0087.331] CloseHandle (hObject=0x174) returned 1
	[0087.335] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.335] SetEndOfFile (hFile=0x19c) returned 1
	[0087.343] CloseHandle (hObject=0x19c) returned 1
	[0087.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0087.350] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 1
	[0087.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0087.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0087.354] lstrlenW (lpString=".doc") returned 4
	[0087.354] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0087.354] lstrlenW (lpString=".docx") returned 5
	[0087.354] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0087.354] lstrlenW (lpString=".pdf") returned 4
	[0087.354] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0087.355] lstrlenW (lpString=".xls") returned 4
	[0087.355] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0087.355] lstrlenW (lpString=".xlsx") returned 5
	[0087.355] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0087.355] lstrlenW (lpString=".ppt") returned 4
	[0087.355] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0087.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0087.355] lstrlenW (lpString=".zip") returned 4
	[0087.355] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0087.355] lstrlenW (lpString=".rar") returned 4
	[0087.355] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0087.355] lstrlenW (lpString=".bz2") returned 4
	[0087.355] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0087.355] lstrlenW (lpString=".7z") returned 3
	[0087.355] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0087.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0087.355] lstrlenW (lpString=".dbf") returned 4
	[0087.355] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0087.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0087.355] lstrlenW (lpString=".1cd") returned 4
	[0087.355] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0087.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0087.355] lstrlenW (lpString=".jpg") returned 4
	[0087.355] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0087.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0087.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0087.356] lstrlenW (lpString=".doc") returned 4
	[0087.356] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0087.356] lstrlenW (lpString=".docx") returned 5
	[0087.356] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0087.356] lstrlenW (lpString=".pdf") returned 4
	[0087.356] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0087.356] lstrlenW (lpString=".xls") returned 4
	[0087.356] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0087.356] lstrlenW (lpString=".xlsx") returned 5
	[0087.356] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0087.356] lstrlenW (lpString=".ppt") returned 4
	[0087.356] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0087.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0087.356] lstrlenW (lpString=".zip") returned 4
	[0087.356] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0087.356] lstrlenW (lpString=".rar") returned 4
	[0087.356] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0087.356] lstrlenW (lpString=".bz2") returned 4
	[0087.356] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0087.356] lstrlenW (lpString=".7z") returned 3
	[0087.356] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0087.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0087.356] lstrlenW (lpString=".dbf") returned 4
	[0087.356] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0087.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0087.356] lstrlenW (lpString=".1cd") returned 4
	[0087.356] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0087.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0087.357] lstrlenW (lpString=".jpg") returned 4
	[0087.357] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0087.357] lstrcmpiW (lpString1=".FLT", lpString2=".adobe") returned 1
	[0087.357] lstrlenW (lpString="PNG32.FLT") returned 9
	[0087.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.390] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=302976) returned 1
	[0087.390] CloseHandle (hObject=0x174) returned 1
	[0087.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20
	[0087.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.701] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.701] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0087.716] GetLastError () returned 0x0
	[0087.716] ReadFile (in: hFile=0x1ac, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x49f80, lpOverlapped=0x0) returned 1
	[0087.728] WriteFile (in: hFile=0x160, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x49f90, lpOverlapped=0x0) returned 1
	[0087.753] ReadFile (in: hFile=0x1ac, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.754] WriteFile (in: hFile=0x160, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0087.755] SetEndOfFile (hFile=0x160) returned 1
	[0087.765] CloseHandle (hObject=0x160) returned 1
	[0087.796] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.796] SetEndOfFile (hFile=0x1ac) returned 1
	[0087.804] CloseHandle (hObject=0x1ac) returned 1
	[0087.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0087.804] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1
	[0087.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64
	[0087.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64
	[0087.804] lstrlenW (lpString=".doc") returned 4
	[0087.804] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0087.804] lstrlenW (lpString=".docx") returned 5
	[0087.804] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0087.804] lstrlenW (lpString=".pdf") returned 4
	[0087.804] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0087.804] lstrlenW (lpString=".xls") returned 4
	[0087.805] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0087.805] lstrlenW (lpString=".xlsx") returned 5
	[0087.805] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0087.805] lstrlenW (lpString=".ppt") returned 4
	[0087.805] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0087.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64
	[0087.805] lstrlenW (lpString=".zip") returned 4
	[0087.805] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0087.805] lstrlenW (lpString=".rar") returned 4
	[0087.805] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0087.805] lstrlenW (lpString=".bz2") returned 4
	[0087.805] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0087.805] lstrlenW (lpString=".7z") returned 3
	[0087.805] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0087.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64
	[0087.805] lstrlenW (lpString=".dbf") returned 4
	[0087.805] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0087.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64
	[0087.805] lstrlenW (lpString=".1cd") returned 4
	[0087.805] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0087.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64
	[0087.805] lstrlenW (lpString=".jpg") returned 4
	[0087.805] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0087.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64
	[0087.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64
	[0087.806] lstrlenW (lpString=".doc") returned 4
	[0087.806] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0087.806] lstrlenW (lpString=".docx") returned 5
	[0087.806] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0087.806] lstrlenW (lpString=".pdf") returned 4
	[0087.806] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0087.806] lstrlenW (lpString=".xls") returned 4
	[0087.806] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0087.806] lstrlenW (lpString=".xlsx") returned 5
	[0087.806] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0087.806] lstrlenW (lpString=".ppt") returned 4
	[0087.806] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0087.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64
	[0087.806] lstrlenW (lpString=".zip") returned 4
	[0087.806] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0087.806] lstrlenW (lpString=".rar") returned 4
	[0087.806] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0087.806] lstrlenW (lpString=".bz2") returned 4
	[0087.806] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0087.806] lstrlenW (lpString=".7z") returned 3
	[0087.806] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0087.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64
	[0087.807] lstrlenW (lpString=".dbf") returned 4
	[0087.807] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0087.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64
	[0087.807] lstrlenW (lpString=".1cd") returned 4
	[0087.807] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0087.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64
	[0087.807] lstrlenW (lpString=".jpg") returned 4
	[0087.807] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0087.807] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0087.807] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26
	[0087.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.861] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2560) returned 1
	[0087.861] CloseHandle (hObject=0x1ac) returned 1
	[0087.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20
	[0087.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0087.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0087.893] lstrlenW (lpString=".doc") returned 4
	[0087.893] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.893] lstrlenW (lpString=".docx") returned 5
	[0087.893] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.893] lstrlenW (lpString=".pdf") returned 4
	[0087.893] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.893] lstrlenW (lpString=".xls") returned 4
	[0087.893] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.893] lstrlenW (lpString=".xlsx") returned 5
	[0087.893] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.893] lstrlenW (lpString=".ppt") returned 4
	[0087.893] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0087.893] lstrlenW (lpString=".zip") returned 4
	[0087.893] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.894] lstrlenW (lpString=".rar") returned 4
	[0087.894] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.894] lstrlenW (lpString=".bz2") returned 4
	[0087.894] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.894] lstrlenW (lpString=".7z") returned 3
	[0087.894] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0087.894] lstrlenW (lpString=".dbf") returned 4
	[0087.894] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0087.894] lstrlenW (lpString=".1cd") returned 4
	[0087.894] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0087.894] lstrlenW (lpString=".jpg") returned 4
	[0087.894] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0087.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0087.894] lstrlenW (lpString=".doc") returned 4
	[0087.894] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.894] lstrlenW (lpString=".docx") returned 5
	[0087.894] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.894] lstrlenW (lpString=".pdf") returned 4
	[0087.894] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.894] lstrlenW (lpString=".xls") returned 4
	[0087.894] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.894] lstrlenW (lpString=".xlsx") returned 5
	[0087.895] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.895] lstrlenW (lpString=".ppt") returned 4
	[0087.895] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0087.895] lstrlenW (lpString=".zip") returned 4
	[0087.895] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.895] lstrlenW (lpString=".rar") returned 4
	[0087.895] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.895] lstrlenW (lpString=".bz2") returned 4
	[0087.895] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.895] lstrlenW (lpString=".7z") returned 3
	[0087.895] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0087.895] lstrlenW (lpString=".dbf") returned 4
	[0087.895] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0087.895] lstrlenW (lpString=".1cd") returned 4
	[0087.895] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0087.895] lstrlenW (lpString=".jpg") returned 4
	[0087.895] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.896] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0087.896] lstrlenW (lpString="rtscom.dll.mui") returned 14
	[0087.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0087.955] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2560) returned 1
	[0087.955] CloseHandle (hObject=0x188) returned 1
	[0087.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20
	[0088.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0088.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0088.075] lstrlenW (lpString=".doc") returned 4
	[0088.075] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.075] lstrlenW (lpString=".docx") returned 5
	[0088.075] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.075] lstrlenW (lpString=".pdf") returned 4
	[0088.075] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.075] lstrlenW (lpString=".xls") returned 4
	[0088.075] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.075] lstrlenW (lpString=".xlsx") returned 5
	[0088.075] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.075] lstrlenW (lpString=".ppt") returned 4
	[0088.075] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0088.075] lstrlenW (lpString=".zip") returned 4
	[0088.075] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.075] lstrlenW (lpString=".rar") returned 4
	[0088.075] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.075] lstrlenW (lpString=".bz2") returned 4
	[0088.075] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.075] lstrlenW (lpString=".7z") returned 3
	[0088.076] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0088.076] lstrlenW (lpString=".dbf") returned 4
	[0088.076] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0088.076] lstrlenW (lpString=".1cd") returned 4
	[0088.076] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0088.076] lstrlenW (lpString=".jpg") returned 4
	[0088.076] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0088.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0088.076] lstrlenW (lpString=".doc") returned 4
	[0088.076] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.076] lstrlenW (lpString=".docx") returned 5
	[0088.076] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.076] lstrlenW (lpString=".pdf") returned 4
	[0088.076] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.076] lstrlenW (lpString=".xls") returned 4
	[0088.076] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.076] lstrlenW (lpString=".xlsx") returned 5
	[0088.076] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.076] lstrlenW (lpString=".ppt") returned 4
	[0088.076] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0088.076] lstrlenW (lpString=".zip") returned 4
	[0088.077] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.077] lstrlenW (lpString=".rar") returned 4
	[0088.077] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.077] lstrlenW (lpString=".bz2") returned 4
	[0088.077] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.077] lstrlenW (lpString=".7z") returned 3
	[0088.077] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0088.077] lstrlenW (lpString=".dbf") returned 4
	[0088.077] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0088.077] lstrlenW (lpString=".1cd") returned 4
	[0088.077] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0088.077] lstrlenW (lpString=".jpg") returned 4
	[0088.077] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.077] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0088.077] lstrlenW (lpString="TipRes.dll.mui") returned 14
	[0088.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.139] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=32768) returned 1
	[0088.139] CloseHandle (hObject=0x188) returned 1
	[0088.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20
	[0088.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71
	[0088.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71
	[0088.281] lstrlenW (lpString=".doc") returned 4
	[0088.281] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.281] lstrlenW (lpString=".docx") returned 5
	[0088.281] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.282] lstrlenW (lpString=".pdf") returned 4
	[0088.282] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.282] lstrlenW (lpString=".xls") returned 4
	[0088.282] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.282] lstrlenW (lpString=".xlsx") returned 5
	[0088.282] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.282] lstrlenW (lpString=".ppt") returned 4
	[0088.282] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71
	[0088.282] lstrlenW (lpString=".zip") returned 4
	[0088.282] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.282] lstrlenW (lpString=".rar") returned 4
	[0088.282] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.282] lstrlenW (lpString=".bz2") returned 4
	[0088.282] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.282] lstrlenW (lpString=".7z") returned 3
	[0088.282] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71
	[0088.282] lstrlenW (lpString=".dbf") returned 4
	[0088.282] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71
	[0088.282] lstrlenW (lpString=".1cd") returned 4
	[0088.282] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71
	[0088.282] lstrlenW (lpString=".jpg") returned 4
	[0088.282] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71
	[0088.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71
	[0088.283] lstrlenW (lpString=".doc") returned 4
	[0088.283] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.283] lstrlenW (lpString=".docx") returned 5
	[0088.283] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.283] lstrlenW (lpString=".pdf") returned 4
	[0088.283] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.283] lstrlenW (lpString=".xls") returned 4
	[0088.283] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.283] lstrlenW (lpString=".xlsx") returned 5
	[0088.283] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.283] lstrlenW (lpString=".ppt") returned 4
	[0088.283] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71
	[0088.283] lstrlenW (lpString=".zip") returned 4
	[0088.283] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.283] lstrlenW (lpString=".rar") returned 4
	[0088.283] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.283] lstrlenW (lpString=".bz2") returned 4
	[0088.283] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.283] lstrlenW (lpString=".7z") returned 3
	[0088.283] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71
	[0088.283] lstrlenW (lpString=".dbf") returned 4
	[0088.283] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71
	[0088.283] lstrlenW (lpString=".1cd") returned 4
	[0088.284] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71
	[0088.284] lstrlenW (lpString=".jpg") returned 4
	[0088.284] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.284] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0088.284] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0088.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0088.290] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=3584) returned 1
	[0088.290] CloseHandle (hObject=0x1a4) returned 1
	[0088.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20
	[0088.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72
	[0088.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72
	[0088.291] lstrlenW (lpString=".doc") returned 4
	[0088.291] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.291] lstrlenW (lpString=".docx") returned 5
	[0088.291] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.291] lstrlenW (lpString=".pdf") returned 4
	[0088.291] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.291] lstrlenW (lpString=".xls") returned 4
	[0088.291] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.291] lstrlenW (lpString=".xlsx") returned 5
	[0088.291] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.291] lstrlenW (lpString=".ppt") returned 4
	[0088.291] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72
	[0088.291] lstrlenW (lpString=".zip") returned 4
	[0088.291] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.291] lstrlenW (lpString=".rar") returned 4
	[0088.292] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.292] lstrlenW (lpString=".bz2") returned 4
	[0088.292] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.292] lstrlenW (lpString=".7z") returned 3
	[0088.292] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72
	[0088.292] lstrlenW (lpString=".dbf") returned 4
	[0088.292] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72
	[0088.292] lstrlenW (lpString=".1cd") returned 4
	[0088.292] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72
	[0088.292] lstrlenW (lpString=".jpg") returned 4
	[0088.292] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72
	[0088.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72
	[0088.292] lstrlenW (lpString=".doc") returned 4
	[0088.292] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.292] lstrlenW (lpString=".docx") returned 5
	[0088.292] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.292] lstrlenW (lpString=".pdf") returned 4
	[0088.292] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.292] lstrlenW (lpString=".xls") returned 4
	[0088.292] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.292] lstrlenW (lpString=".xlsx") returned 5
	[0088.292] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.293] lstrlenW (lpString=".ppt") returned 4
	[0088.293] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72
	[0088.293] lstrlenW (lpString=".zip") returned 4
	[0088.293] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.293] lstrlenW (lpString=".rar") returned 4
	[0088.293] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.293] lstrlenW (lpString=".bz2") returned 4
	[0088.293] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.293] lstrlenW (lpString=".7z") returned 3
	[0088.293] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72
	[0088.293] lstrlenW (lpString=".dbf") returned 4
	[0088.293] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72
	[0088.293] lstrlenW (lpString=".1cd") returned 4
	[0088.293] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72
	[0088.293] lstrlenW (lpString=".jpg") returned 4
	[0088.293] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.293] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0088.294] lstrlenW (lpString="ShapeCollector.exe") returned 18
	[0088.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.301] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=695296) returned 1
	[0088.301] CloseHandle (hObject=0x188) returned 1
	[0088.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20
	[0088.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69
	[0088.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69
	[0088.348] lstrlenW (lpString=".doc") returned 4
	[0088.348] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0088.348] lstrlenW (lpString=".docx") returned 5
	[0088.348] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0088.348] lstrlenW (lpString=".pdf") returned 4
	[0088.348] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0088.348] lstrlenW (lpString=".xls") returned 4
	[0088.348] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0088.348] lstrlenW (lpString=".xlsx") returned 5
	[0088.348] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0088.348] lstrlenW (lpString=".ppt") returned 4
	[0088.348] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0088.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69
	[0088.348] lstrlenW (lpString=".zip") returned 4
	[0088.348] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0088.348] lstrlenW (lpString=".rar") returned 4
	[0088.348] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0088.348] lstrlenW (lpString=".bz2") returned 4
	[0088.348] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0088.348] lstrlenW (lpString=".7z") returned 3
	[0088.348] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0088.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69
	[0088.348] lstrlenW (lpString=".dbf") returned 4
	[0088.349] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0088.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69
	[0088.349] lstrlenW (lpString=".1cd") returned 4
	[0088.349] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0088.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69
	[0088.349] lstrlenW (lpString=".jpg") returned 4
	[0088.349] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0088.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69
	[0088.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69
	[0088.349] lstrlenW (lpString=".doc") returned 4
	[0088.349] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0088.349] lstrlenW (lpString=".docx") returned 5
	[0088.349] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0088.349] lstrlenW (lpString=".pdf") returned 4
	[0088.349] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0088.349] lstrlenW (lpString=".xls") returned 4
	[0088.349] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0088.349] lstrlenW (lpString=".xlsx") returned 5
	[0088.349] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0088.349] lstrlenW (lpString=".ppt") returned 4
	[0088.349] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0088.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69
	[0088.349] lstrlenW (lpString=".zip") returned 4
	[0088.349] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0088.349] lstrlenW (lpString=".rar") returned 4
	[0088.349] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0088.350] lstrlenW (lpString=".bz2") returned 4
	[0088.350] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0088.350] lstrlenW (lpString=".7z") returned 3
	[0088.350] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0088.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69
	[0088.350] lstrlenW (lpString=".dbf") returned 4
	[0088.350] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0088.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69
	[0088.350] lstrlenW (lpString=".1cd") returned 4
	[0088.350] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0088.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69
	[0088.350] lstrlenW (lpString=".jpg") returned 4
	[0088.350] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0088.350] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0088.350] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0088.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0088.375] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=3584) returned 1
	[0088.375] CloseHandle (hObject=0x190) returned 1
	[0088.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui")) returned 0x20
	[0088.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77
	[0088.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77
	[0088.431] lstrlenW (lpString=".doc") returned 4
	[0088.431] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.431] lstrlenW (lpString=".docx") returned 5
	[0088.431] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0088.431] lstrlenW (lpString=".pdf") returned 4
	[0088.431] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.431] lstrlenW (lpString=".xls") returned 4
	[0088.431] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.431] lstrlenW (lpString=".xlsx") returned 5
	[0088.431] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0088.431] lstrlenW (lpString=".ppt") returned 4
	[0088.431] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77
	[0088.431] lstrlenW (lpString=".zip") returned 4
	[0088.431] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.431] lstrlenW (lpString=".rar") returned 4
	[0088.431] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.431] lstrlenW (lpString=".bz2") returned 4
	[0088.431] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.431] lstrlenW (lpString=".7z") returned 3
	[0088.431] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77
	[0088.431] lstrlenW (lpString=".dbf") returned 4
	[0088.431] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0089.221] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.222] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0089.222] GetLastError () returned 0x0
	[0089.222] ReadFile (in: hFile=0x1b8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xd980, lpOverlapped=0x0) returned 1
	[0089.239] WriteFile (in: hFile=0x1bc, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xd990, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xd990, lpOverlapped=0x0) returned 1
	[0089.241] ReadFile (in: hFile=0x1b8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.241] WriteFile (in: hFile=0x1bc, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0089.241] SetEndOfFile (hFile=0x1bc) returned 1
	[0089.241] CloseHandle (hObject=0x1bc) returned 1
	[0089.241] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.241] SetEndOfFile (hFile=0x1b8) returned 1
	[0089.242] CloseHandle (hObject=0x1b8) returned 1
	[0089.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.243] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 1
	[0089.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80
	[0089.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80
	[0089.244] lstrlenW (lpString=".doc") returned 4
	[0089.244] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0089.244] lstrlenW (lpString=".docx") returned 5
	[0089.244] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0089.244] lstrlenW (lpString=".pdf") returned 4
	[0089.244] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0089.244] lstrlenW (lpString=".xls") returned 4
	[0089.244] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0089.244] lstrlenW (lpString=".xlsx") returned 5
	[0089.244] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0089.244] lstrlenW (lpString=".ppt") returned 4
	[0089.244] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0089.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80
	[0089.244] lstrlenW (lpString=".zip") returned 4
	[0089.244] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0089.244] lstrlenW (lpString=".rar") returned 4
	[0089.244] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0089.244] lstrlenW (lpString=".bz2") returned 4
	[0089.244] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0089.244] lstrlenW (lpString=".7z") returned 3
	[0089.244] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80
	[0089.244] lstrlenW (lpString=".dbf") returned 4
	[0089.244] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0089.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80
	[0089.244] lstrlenW (lpString=".1cd") returned 4
	[0089.244] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0089.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80
	[0089.244] lstrlenW (lpString=".jpg") returned 4
	[0089.244] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0089.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80
	[0089.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80
	[0089.245] lstrlenW (lpString=".doc") returned 4
	[0089.245] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0089.245] lstrlenW (lpString=".docx") returned 5
	[0089.245] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0089.245] lstrlenW (lpString=".pdf") returned 4
	[0089.245] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0089.245] lstrlenW (lpString=".xls") returned 4
	[0089.245] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0089.245] lstrlenW (lpString=".xlsx") returned 5
	[0089.245] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0089.245] lstrlenW (lpString=".ppt") returned 4
	[0089.245] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0089.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80
	[0089.245] lstrlenW (lpString=".zip") returned 4
	[0089.245] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0089.245] lstrlenW (lpString=".rar") returned 4
	[0089.245] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0089.245] lstrlenW (lpString=".bz2") returned 4
	[0089.245] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0089.245] lstrlenW (lpString=".7z") returned 3
	[0089.245] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80
	[0089.245] lstrlenW (lpString=".dbf") returned 4
	[0089.245] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0089.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80
	[0089.245] lstrlenW (lpString=".1cd") returned 4
	[0089.245] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0089.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80
	[0089.245] lstrlenW (lpString=".jpg") returned 4
	[0089.245] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0089.246] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".adobe") returned 1
	[0089.246] lstrlenW (lpString="MSOINTL.REST.IDX_DLL") returned 20
	[0089.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0089.246] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1388416) returned 1
	[0089.246] CloseHandle (hObject=0x1b8) returned 1
	[0089.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20
	[0089.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0089.247] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.247] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0089.248] GetLastError () returned 0x0
	[0089.248] ReadFile (in: hFile=0x1b8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0089.328] WriteFile (in: hFile=0x1bc, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0089.363] ReadFile (in: hFile=0x1b8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x52f90, lpOverlapped=0x0) returned 1
	[0089.399] WriteFile (in: hFile=0x1bc, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x52fa0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x52fa0, lpOverlapped=0x0) returned 1
	[0089.410] ReadFile (in: hFile=0x1b8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.411] WriteFile (in: hFile=0x1bc, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0089.411] SetEndOfFile (hFile=0x1bc) returned 1
	[0089.434] CloseHandle (hObject=0x1bc) returned 1
	[0089.457] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.457] SetEndOfFile (hFile=0x1b8) returned 1
	[0089.581] CloseHandle (hObject=0x1b8) returned 1
	[0089.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.602] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 1
	[0089.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81
	[0089.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81
	[0089.701] lstrlenW (lpString=".doc") returned 4
	[0089.701] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0089.701] lstrlenW (lpString=".docx") returned 5
	[0089.701] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0089.701] lstrlenW (lpString=".pdf") returned 4
	[0089.701] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0089.701] lstrlenW (lpString=".xls") returned 4
	[0089.701] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0089.701] lstrlenW (lpString=".xlsx") returned 5
	[0089.701] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0089.701] lstrlenW (lpString=".ppt") returned 4
	[0089.701] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0089.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81
	[0089.701] lstrlenW (lpString=".zip") returned 4
	[0089.701] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0089.702] lstrlenW (lpString=".rar") returned 4
	[0089.702] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0089.702] lstrlenW (lpString=".bz2") returned 4
	[0089.702] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0089.702] lstrlenW (lpString=".7z") returned 3
	[0089.702] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81
	[0089.702] lstrlenW (lpString=".dbf") returned 4
	[0089.702] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0089.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81
	[0089.702] lstrlenW (lpString=".1cd") returned 4
	[0089.702] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0089.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81
	[0089.702] lstrlenW (lpString=".jpg") returned 4
	[0089.702] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0089.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81
	[0089.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81
	[0089.702] lstrlenW (lpString=".doc") returned 4
	[0089.702] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0089.702] lstrlenW (lpString=".docx") returned 5
	[0089.702] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0089.702] lstrlenW (lpString=".pdf") returned 4
	[0089.702] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0089.702] lstrlenW (lpString=".xls") returned 4
	[0089.702] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0089.702] lstrlenW (lpString=".xlsx") returned 5
	[0089.702] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0089.702] lstrlenW (lpString=".ppt") returned 4
	[0089.703] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0089.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81
	[0089.703] lstrlenW (lpString=".zip") returned 4
	[0089.703] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0089.703] lstrlenW (lpString=".rar") returned 4
	[0089.703] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0089.703] lstrlenW (lpString=".bz2") returned 4
	[0089.703] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0089.703] lstrlenW (lpString=".7z") returned 3
	[0089.703] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81
	[0089.703] lstrlenW (lpString=".dbf") returned 4
	[0089.703] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0089.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81
	[0089.703] lstrlenW (lpString=".1cd") returned 4
	[0089.703] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0089.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81
	[0089.703] lstrlenW (lpString=".jpg") returned 4
	[0089.703] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0089.703] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.703] lstrlenW (lpString="ACEEXCL.DLL") returned 11
	[0089.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0089.704] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=899992) returned 1
	[0089.704] CloseHandle (hObject=0x1ac) returned 1
	[0089.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20
	[0089.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0089.705] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.705] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.706] GetLastError () returned 0x0
	[0089.706] ReadFile (in: hFile=0x1ac, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xdbb98, lpOverlapped=0x0) returned 1
	[0089.777] WriteFile (in: hFile=0x1b0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xdbba0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xdbba0, lpOverlapped=0x0) returned 1
	[0089.797] ReadFile (in: hFile=0x1ac, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.797] WriteFile (in: hFile=0x1b0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.797] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.797] CloseHandle (hObject=0x1b0) returned 1
	[0089.797] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.798] SetEndOfFile (hFile=0x1ac) returned 1
	[0089.846] CloseHandle (hObject=0x1ac) returned 1
	[0089.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.846] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 1
	[0089.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67
	[0089.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67
	[0089.847] lstrlenW (lpString=".doc") returned 4
	[0089.847] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.847] lstrlenW (lpString=".docx") returned 5
	[0089.847] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0089.847] lstrlenW (lpString=".pdf") returned 4
	[0089.847] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.847] lstrlenW (lpString=".xls") returned 4
	[0089.847] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.847] lstrlenW (lpString=".xlsx") returned 5
	[0089.847] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0089.847] lstrlenW (lpString=".ppt") returned 4
	[0089.847] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67
	[0089.847] lstrlenW (lpString=".zip") returned 4
	[0089.847] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.847] lstrlenW (lpString=".rar") returned 4
	[0089.847] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.847] lstrlenW (lpString=".bz2") returned 4
	[0089.847] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.847] lstrlenW (lpString=".7z") returned 3
	[0089.847] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67
	[0089.847] lstrlenW (lpString=".dbf") returned 4
	[0089.847] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67
	[0089.848] lstrlenW (lpString=".1cd") returned 4
	[0089.848] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67
	[0089.848] lstrlenW (lpString=".jpg") returned 4
	[0089.848] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67
	[0089.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67
	[0089.848] lstrlenW (lpString=".doc") returned 4
	[0089.848] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.848] lstrlenW (lpString=".docx") returned 5
	[0089.848] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0089.848] lstrlenW (lpString=".pdf") returned 4
	[0089.848] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.848] lstrlenW (lpString=".xls") returned 4
	[0089.848] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.848] lstrlenW (lpString=".xlsx") returned 5
	[0089.848] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0089.848] lstrlenW (lpString=".ppt") returned 4
	[0089.848] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67
	[0089.848] lstrlenW (lpString=".zip") returned 4
	[0089.848] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.848] lstrlenW (lpString=".rar") returned 4
	[0089.848] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.848] lstrlenW (lpString=".bz2") returned 4
	[0089.848] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.848] lstrlenW (lpString=".7z") returned 3
	[0089.848] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67
	[0089.848] lstrlenW (lpString=".dbf") returned 4
	[0089.848] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67
	[0089.849] lstrlenW (lpString=".1cd") returned 4
	[0089.849] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67
	[0089.849] lstrlenW (lpString=".jpg") returned 4
	[0089.849] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.849] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.849] lstrlenW (lpString="ACEODEXL.DLL") returned 12
	[0089.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0089.853] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=15800) returned 1
	[0089.853] CloseHandle (hObject=0x1ac) returned 1
	[0089.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20
	[0089.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0089.854] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.854] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0089.855] GetLastError () returned 0x0
	[0089.855] ReadFile (in: hFile=0x1ac, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x3db8, lpOverlapped=0x0) returned 1
	[0089.890] WriteFile (in: hFile=0x1b4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x3dc0, lpOverlapped=0x0) returned 1
	[0089.892] ReadFile (in: hFile=0x1ac, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.894] WriteFile (in: hFile=0x1b4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.895] SetEndOfFile (hFile=0x1b4) returned 1
	[0089.895] CloseHandle (hObject=0x1b4) returned 1
	[0089.895] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.895] SetEndOfFile (hFile=0x1ac) returned 1
	[0089.896] CloseHandle (hObject=0x1ac) returned 1
	[0089.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.896] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 1
	[0089.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68
	[0089.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68
	[0089.897] lstrlenW (lpString=".doc") returned 4
	[0089.897] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.897] lstrlenW (lpString=".docx") returned 5
	[0089.897] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0089.897] lstrlenW (lpString=".pdf") returned 4
	[0089.897] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.897] lstrlenW (lpString=".xls") returned 4
	[0089.897] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.897] lstrlenW (lpString=".xlsx") returned 5
	[0089.897] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0089.897] lstrlenW (lpString=".ppt") returned 4
	[0089.897] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68
	[0089.897] lstrlenW (lpString=".zip") returned 4
	[0089.897] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.897] lstrlenW (lpString=".rar") returned 4
	[0089.897] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.897] lstrlenW (lpString=".bz2") returned 4
	[0089.897] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.897] lstrlenW (lpString=".7z") returned 3
	[0089.897] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68
	[0089.897] lstrlenW (lpString=".dbf") returned 4
	[0089.897] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68
	[0089.897] lstrlenW (lpString=".1cd") returned 4
	[0089.897] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68
	[0089.897] lstrlenW (lpString=".jpg") returned 4
	[0089.897] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68
	[0089.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68
	[0089.898] lstrlenW (lpString=".doc") returned 4
	[0089.898] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.898] lstrlenW (lpString=".docx") returned 5
	[0089.898] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0089.898] lstrlenW (lpString=".pdf") returned 4
	[0089.898] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.898] lstrlenW (lpString=".xls") returned 4
	[0089.898] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.898] lstrlenW (lpString=".xlsx") returned 5
	[0089.898] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0089.898] lstrlenW (lpString=".ppt") returned 4
	[0089.898] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68
	[0089.898] lstrlenW (lpString=".zip") returned 4
	[0089.898] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.898] lstrlenW (lpString=".rar") returned 4
	[0089.898] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.898] lstrlenW (lpString=".bz2") returned 4
	[0089.898] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.898] lstrlenW (lpString=".7z") returned 3
	[0089.898] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68
	[0089.898] lstrlenW (lpString=".dbf") returned 4
	[0089.898] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68
	[0089.898] lstrlenW (lpString=".1cd") returned 4
	[0089.898] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68
	[0089.898] lstrlenW (lpString=".jpg") returned 4
	[0089.899] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.899] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.899] lstrlenW (lpString="ACEOLEDB.DLL") returned 12
	[0089.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0089.976] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=537504) returned 1
	[0089.976] CloseHandle (hObject=0x184) returned 1
	[0089.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 0x20
	[0090.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0090.235] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.235] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0090.325] GetLastError () returned 0x0
	[0090.325] ReadFile (in: hFile=0x1b4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x833a0, lpOverlapped=0x0) returned 1
	[0090.338] WriteFile (in: hFile=0x1b0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x833b0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x833b0, lpOverlapped=0x0) returned 1
	[0090.350] ReadFile (in: hFile=0x1b4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.351] WriteFile (in: hFile=0x1b0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.351] SetEndOfFile (hFile=0x1b0) returned 1
	[0090.370] CloseHandle (hObject=0x1b0) returned 1
	[0090.384] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.384] SetEndOfFile (hFile=0x1b4) returned 1
	[0090.423] CloseHandle (hObject=0x1b4) returned 1
	[0090.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.457] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 1
	[0090.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68
	[0090.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68
	[0090.483] lstrlenW (lpString=".doc") returned 4
	[0090.483] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0090.483] lstrlenW (lpString=".docx") returned 5
	[0090.483] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1
	[0090.483] lstrlenW (lpString=".pdf") returned 4
	[0090.483] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0090.483] lstrlenW (lpString=".xls") returned 4
	[0090.484] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0090.484] lstrlenW (lpString=".xlsx") returned 5
	[0090.484] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1
	[0090.484] lstrlenW (lpString=".ppt") returned 4
	[0090.484] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0090.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68
	[0090.484] lstrlenW (lpString=".zip") returned 4
	[0090.484] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0090.484] lstrlenW (lpString=".rar") returned 4
	[0090.484] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0090.484] lstrlenW (lpString=".bz2") returned 4
	[0090.484] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0090.484] lstrlenW (lpString=".7z") returned 3
	[0090.484] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0090.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68
	[0090.484] lstrlenW (lpString=".dbf") returned 4
	[0090.484] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0090.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68
	[0090.484] lstrlenW (lpString=".1cd") returned 4
	[0090.484] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0090.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68
	[0090.484] lstrlenW (lpString=".jpg") returned 4
	[0090.484] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0090.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68
	[0090.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68
	[0090.484] lstrlenW (lpString=".doc") returned 4
	[0090.484] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0090.485] lstrlenW (lpString=".docx") returned 5
	[0090.485] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1
	[0090.485] lstrlenW (lpString=".pdf") returned 4
	[0090.485] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0090.485] lstrlenW (lpString=".xls") returned 4
	[0090.485] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0090.485] lstrlenW (lpString=".xlsx") returned 5
	[0090.485] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1
	[0090.485] lstrlenW (lpString=".ppt") returned 4
	[0090.485] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0090.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68
	[0090.485] lstrlenW (lpString=".zip") returned 4
	[0090.485] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0090.485] lstrlenW (lpString=".rar") returned 4
	[0090.485] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0090.485] lstrlenW (lpString=".bz2") returned 4
	[0090.485] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0090.485] lstrlenW (lpString=".7z") returned 3
	[0090.486] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0090.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68
	[0090.486] lstrlenW (lpString=".dbf") returned 4
	[0090.486] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0090.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68
	[0090.486] lstrlenW (lpString=".1cd") returned 4
	[0090.486] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0090.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68
	[0090.486] lstrlenW (lpString=".jpg") returned 4
	[0090.486] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0090.486] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0090.486] lstrlenW (lpString="ACETXT.DLL") returned 10
	[0090.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.570] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=297360) returned 1
	[0090.570] CloseHandle (hObject=0x184) returned 1
	[0090.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 0x20
	[0090.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0090.666] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.666] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0090.686] GetLastError () returned 0x0
	[0090.686] ReadFile (in: hFile=0x190, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x48990, lpOverlapped=0x0) returned 1
	[0090.818] WriteFile (in: hFile=0x1b8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x489a0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x489a0, lpOverlapped=0x0) returned 1
	[0090.825] ReadFile (in: hFile=0x190, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.825] WriteFile (in: hFile=0x1b8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0090.826] SetEndOfFile (hFile=0x1b8) returned 1
	[0090.826] CloseHandle (hObject=0x1b8) returned 1
	[0090.826] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.826] SetEndOfFile (hFile=0x190) returned 1
	[0090.830] CloseHandle (hObject=0x190) returned 1
	[0090.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.830] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 1
	[0090.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66
	[0090.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66
	[0090.935] lstrlenW (lpString=".doc") returned 4
	[0090.935] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0090.935] lstrlenW (lpString=".docx") returned 5
	[0090.935] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0090.935] lstrlenW (lpString=".pdf") returned 4
	[0090.935] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0090.935] lstrlenW (lpString=".xls") returned 4
	[0090.935] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0090.935] lstrlenW (lpString=".xlsx") returned 5
	[0090.935] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0090.935] lstrlenW (lpString=".ppt") returned 4
	[0090.935] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0090.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66
	[0090.935] lstrlenW (lpString=".zip") returned 4
	[0090.935] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0090.935] lstrlenW (lpString=".rar") returned 4
	[0090.935] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0090.935] lstrlenW (lpString=".bz2") returned 4
	[0090.935] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0090.935] lstrlenW (lpString=".7z") returned 3
	[0090.935] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0090.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66
	[0090.935] lstrlenW (lpString=".dbf") returned 4
	[0090.935] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0090.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66
	[0090.935] lstrlenW (lpString=".1cd") returned 4
	[0090.935] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0090.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66
	[0090.935] lstrlenW (lpString=".jpg") returned 4
	[0090.935] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0090.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66
	[0090.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66
	[0090.936] lstrlenW (lpString=".doc") returned 4
	[0090.936] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0090.936] lstrlenW (lpString=".docx") returned 5
	[0090.936] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0090.936] lstrlenW (lpString=".pdf") returned 4
	[0090.936] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0090.936] lstrlenW (lpString=".xls") returned 4
	[0090.936] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0090.936] lstrlenW (lpString=".xlsx") returned 5
	[0090.936] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0090.936] lstrlenW (lpString=".ppt") returned 4
	[0090.936] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0090.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66
	[0090.936] lstrlenW (lpString=".zip") returned 4
	[0090.936] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0090.936] lstrlenW (lpString=".rar") returned 4
	[0090.936] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0090.936] lstrlenW (lpString=".bz2") returned 4
	[0090.936] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0090.936] lstrlenW (lpString=".7z") returned 3
	[0090.936] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0090.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66
	[0090.936] lstrlenW (lpString=".dbf") returned 4
	[0090.936] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0090.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66
	[0090.936] lstrlenW (lpString=".1cd") returned 4
	[0090.936] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0090.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66
	[0090.937] lstrlenW (lpString=".jpg") returned 4
	[0090.937] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0090.937] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0090.937] lstrlenW (lpString="Csi.dll") returned 7
	[0090.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0090.952] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=5072816) returned 1
	[0090.952] CloseHandle (hObject=0x198) returned 1
	[0090.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll")) returned 0x20
	[0090.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.965] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0090.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0090.986] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1
	[0090.986] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0090.986] ReadFile (in: hFile=0x198, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0091.234] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0091.235] ReadFile (in: hFile=0x198, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0091.248] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0091.248] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0091.248] ReadFile (in: hFile=0x198, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0091.330] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.330] WriteFile (in: hFile=0x198, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc00fa, lpOverlapped=0x0) returned 1
	[0091.357] SetEndOfFile (hFile=0x198) returned 1
	[0091.357] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f60070
	[0091.362] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.362] WriteFile (in: hFile=0x198, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.364] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.364] WriteFile (in: hFile=0x198, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.367] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.367] WriteFile (in: hFile=0x198, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.370] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f60070 | out: hHeap=0x5e0000) returned 1
	[0091.370] CloseHandle (hObject=0x198) returned 1
	[0091.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0091.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63
	[0091.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63
	[0091.371] lstrlenW (lpString=".doc") returned 4
	[0091.371] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0091.371] lstrlenW (lpString=".docx") returned 5
	[0091.371] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0091.371] lstrlenW (lpString=".pdf") returned 4
	[0091.371] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0091.371] lstrlenW (lpString=".xls") returned 4
	[0091.371] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0091.371] lstrlenW (lpString=".xlsx") returned 5
	[0091.371] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0091.371] lstrlenW (lpString=".ppt") returned 4
	[0091.371] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0091.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63
	[0091.371] lstrlenW (lpString=".zip") returned 4
	[0091.371] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0091.371] lstrlenW (lpString=".rar") returned 4
	[0091.371] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0091.371] lstrlenW (lpString=".bz2") returned 4
	[0091.371] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0091.371] lstrlenW (lpString=".7z") returned 3
	[0091.372] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0091.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63
	[0091.372] lstrlenW (lpString=".dbf") returned 4
	[0091.372] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0091.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63
	[0091.372] lstrlenW (lpString=".1cd") returned 4
	[0091.372] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0091.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63
	[0091.372] lstrlenW (lpString=".jpg") returned 4
	[0091.372] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0091.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63
	[0091.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63
	[0091.372] lstrlenW (lpString=".doc") returned 4
	[0091.372] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0091.372] lstrlenW (lpString=".docx") returned 5
	[0091.372] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0091.372] lstrlenW (lpString=".pdf") returned 4
	[0091.372] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0091.372] lstrlenW (lpString=".xls") returned 4
	[0091.372] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0091.372] lstrlenW (lpString=".xlsx") returned 5
	[0091.372] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0091.372] lstrlenW (lpString=".ppt") returned 4
	[0091.372] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0091.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63
	[0091.373] lstrlenW (lpString=".zip") returned 4
	[0091.373] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0091.373] lstrlenW (lpString=".rar") returned 4
	[0091.373] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0091.373] lstrlenW (lpString=".bz2") returned 4
	[0091.373] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0091.373] lstrlenW (lpString=".7z") returned 3
	[0091.373] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0091.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63
	[0091.373] lstrlenW (lpString=".dbf") returned 4
	[0091.373] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0091.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63
	[0091.373] lstrlenW (lpString=".1cd") returned 4
	[0091.373] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0091.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63
	[0091.373] lstrlenW (lpString=".jpg") returned 4
	[0091.373] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0091.373] lstrcmpiW (lpString1=".ODF", lpString2=".adobe") returned 1
	[0091.373] lstrlenW (lpString="OFFICE.ODF") returned 10
	[0091.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0091.374] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=4297568) returned 1
	[0091.374] CloseHandle (hObject=0x198) returned 1
	[0091.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20
	[0091.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0091.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0091.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0091.376] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[fire_show@tuta.io].adobe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 1
	[0091.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75
	[0091.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75
	[0091.377] lstrlenW (lpString=".doc") returned 4
	[0091.377] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1
	[0091.377] lstrlenW (lpString=".docx") returned 5
	[0091.377] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1
	[0091.377] lstrlenW (lpString=".pdf") returned 4
	[0091.377] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1
	[0091.377] lstrlenW (lpString=".xls") returned 4
	[0091.377] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1
	[0091.377] lstrlenW (lpString=".xlsx") returned 5
	[0091.377] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1
	[0091.377] lstrlenW (lpString=".ppt") returned 4
	[0091.377] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1
	[0091.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75
	[0091.377] lstrlenW (lpString=".zip") returned 4
	[0091.377] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1
	[0091.377] lstrlenW (lpString=".rar") returned 4
	[0091.377] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1
	[0091.377] lstrlenW (lpString=".bz2") returned 4
	[0091.377] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1
	[0091.377] lstrlenW (lpString=".7z") returned 3
	[0091.377] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1
	[0091.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75
	[0091.377] lstrlenW (lpString=".dbf") returned 4
	[0091.377] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1
	[0091.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75
	[0091.378] lstrlenW (lpString=".1cd") returned 4
	[0091.378] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1
	[0091.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75
	[0091.378] lstrlenW (lpString=".jpg") returned 4
	[0091.378] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1
	[0091.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75
	[0091.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75
	[0091.378] lstrlenW (lpString=".doc") returned 4
	[0091.378] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1
	[0091.378] lstrlenW (lpString=".docx") returned 5
	[0091.378] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1
	[0091.378] lstrlenW (lpString=".pdf") returned 4
	[0091.378] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1
	[0091.378] lstrlenW (lpString=".xls") returned 4
	[0091.378] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1
	[0091.378] lstrlenW (lpString=".xlsx") returned 5
	[0091.378] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1
	[0091.378] lstrlenW (lpString=".ppt") returned 4
	[0091.378] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1
	[0091.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75
	[0091.378] lstrlenW (lpString=".zip") returned 4
	[0091.378] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1
	[0091.378] lstrlenW (lpString=".rar") returned 4
	[0091.378] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1
	[0091.378] lstrlenW (lpString=".bz2") returned 4
	[0091.378] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1
	[0091.378] lstrlenW (lpString=".7z") returned 3
	[0091.378] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1
	[0091.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75
	[0091.379] lstrlenW (lpString=".dbf") returned 4
	[0091.379] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1
	[0091.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75
	[0091.379] lstrlenW (lpString=".1cd") returned 4
	[0091.379] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1
	[0091.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75
	[0091.379] lstrlenW (lpString=".jpg") returned 4
	[0091.379] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1
	[0091.379] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0091.379] lstrlenW (lpString="EXPSRV.DLL") returned 10
	[0091.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0091.380] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=518984) returned 1
	[0091.380] CloseHandle (hObject=0x198) returned 1
	[0091.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 0x20
	[0091.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0091.381] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.381] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0091.382] GetLastError () returned 0x0
	[0091.382] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x7eb48, lpOverlapped=0x0) returned 1
	[0091.569] WriteFile (in: hFile=0x160, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x7eb50, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x7eb50, lpOverlapped=0x0) returned 1
	[0091.582] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.582] WriteFile (in: hFile=0x160, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0091.582] SetEndOfFile (hFile=0x160) returned 1
	[0091.582] CloseHandle (hObject=0x160) returned 1
	[0091.583] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.583] SetEndOfFile (hFile=0x198) returned 1
	[0091.588] CloseHandle (hObject=0x198) returned 1
	[0091.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0091.588] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 1
	[0091.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66
	[0091.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66
	[0091.589] lstrlenW (lpString=".doc") returned 4
	[0091.589] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0091.589] lstrlenW (lpString=".docx") returned 5
	[0091.589] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1
	[0091.589] lstrlenW (lpString=".pdf") returned 4
	[0091.589] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0091.589] lstrlenW (lpString=".xls") returned 4
	[0091.589] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0091.589] lstrlenW (lpString=".xlsx") returned 5
	[0091.589] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1
	[0091.589] lstrlenW (lpString=".ppt") returned 4
	[0091.589] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0091.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66
	[0091.589] lstrlenW (lpString=".zip") returned 4
	[0091.589] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0091.589] lstrlenW (lpString=".rar") returned 4
	[0091.589] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0091.589] lstrlenW (lpString=".bz2") returned 4
	[0091.590] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0091.590] lstrlenW (lpString=".7z") returned 3
	[0091.590] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0091.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66
	[0091.590] lstrlenW (lpString=".dbf") returned 4
	[0091.590] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0091.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66
	[0091.590] lstrlenW (lpString=".1cd") returned 4
	[0091.590] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0091.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66
	[0091.590] lstrlenW (lpString=".jpg") returned 4
	[0091.590] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0091.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66
	[0091.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66
	[0091.590] lstrlenW (lpString=".doc") returned 4
	[0091.590] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0091.590] lstrlenW (lpString=".docx") returned 5
	[0091.590] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1
	[0091.590] lstrlenW (lpString=".pdf") returned 4
	[0091.590] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0091.590] lstrlenW (lpString=".xls") returned 4
	[0091.590] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0091.590] lstrlenW (lpString=".xlsx") returned 5
	[0091.590] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1
	[0091.590] lstrlenW (lpString=".ppt") returned 4
	[0091.590] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0091.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66
	[0091.591] lstrlenW (lpString=".zip") returned 4
	[0091.591] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0091.591] lstrlenW (lpString=".rar") returned 4
	[0091.591] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0091.591] lstrlenW (lpString=".bz2") returned 4
	[0091.591] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0091.591] lstrlenW (lpString=".7z") returned 3
	[0091.591] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0091.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66
	[0091.591] lstrlenW (lpString=".dbf") returned 4
	[0091.591] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0091.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66
	[0091.591] lstrlenW (lpString=".1cd") returned 4
	[0091.591] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0091.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66
	[0091.591] lstrlenW (lpString=".jpg") returned 4
	[0091.591] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0091.591] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0091.591] lstrlenW (lpString="EXP_XPS.DLL") returned 11
	[0091.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0091.704] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=71032) returned 1
	[0091.704] CloseHandle (hObject=0x1c4) returned 1
	[0091.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 0x20
	[0091.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0091.869] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.869] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0091.918] GetLastError () returned 0x0
	[0091.919] ReadFile (in: hFile=0x1c4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x11578, lpOverlapped=0x0) returned 1
	[0091.959] WriteFile (in: hFile=0x1b0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x11580, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x11580, lpOverlapped=0x0) returned 1
	[0091.961] ReadFile (in: hFile=0x1c4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.961] WriteFile (in: hFile=0x1b0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0091.961] SetEndOfFile (hFile=0x1b0) returned 1
	[0091.990] CloseHandle (hObject=0x1b0) returned 1
	[0091.990] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.991] SetEndOfFile (hFile=0x1c4) returned 1
	[0091.998] CloseHandle (hObject=0x1c4) returned 1
	[0091.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.003] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 1
	[0092.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67
	[0092.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67
	[0092.025] lstrlenW (lpString=".doc") returned 4
	[0092.025] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.025] lstrlenW (lpString=".docx") returned 5
	[0092.025] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0092.025] lstrlenW (lpString=".pdf") returned 4
	[0092.025] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.025] lstrlenW (lpString=".xls") returned 4
	[0092.025] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.025] lstrlenW (lpString=".xlsx") returned 5
	[0092.025] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0092.025] lstrlenW (lpString=".ppt") returned 4
	[0092.025] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67
	[0092.025] lstrlenW (lpString=".zip") returned 4
	[0092.025] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.025] lstrlenW (lpString=".rar") returned 4
	[0092.025] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.025] lstrlenW (lpString=".bz2") returned 4
	[0092.025] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.025] lstrlenW (lpString=".7z") returned 3
	[0092.025] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67
	[0092.025] lstrlenW (lpString=".dbf") returned 4
	[0092.026] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67
	[0092.026] lstrlenW (lpString=".1cd") returned 4
	[0092.026] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67
	[0092.026] lstrlenW (lpString=".jpg") returned 4
	[0092.026] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67
	[0092.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67
	[0092.026] lstrlenW (lpString=".doc") returned 4
	[0092.026] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.026] lstrlenW (lpString=".docx") returned 5
	[0092.026] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0092.026] lstrlenW (lpString=".pdf") returned 4
	[0092.026] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.026] lstrlenW (lpString=".xls") returned 4
	[0092.026] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.026] lstrlenW (lpString=".xlsx") returned 5
	[0092.026] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0092.026] lstrlenW (lpString=".ppt") returned 4
	[0092.026] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67
	[0092.026] lstrlenW (lpString=".zip") returned 4
	[0092.026] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.026] lstrlenW (lpString=".rar") returned 4
	[0092.026] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.027] lstrlenW (lpString=".bz2") returned 4
	[0092.027] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.027] lstrlenW (lpString=".7z") returned 3
	[0092.027] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67
	[0092.027] lstrlenW (lpString=".dbf") returned 4
	[0092.027] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67
	[0092.027] lstrlenW (lpString=".1cd") returned 4
	[0092.027] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67
	[0092.027] lstrlenW (lpString=".jpg") returned 4
	[0092.027] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.027] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0092.027] lstrlenW (lpString="MSO.DLL") returned 7
	[0092.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0092.060] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=25417600) returned 1
	[0092.060] CloseHandle (hObject=0x184) returned 1
	[0092.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll")) returned 0x20
	[0092.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0092.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0092.314] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1
	[0092.314] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.315] ReadFile (in: hFile=0x198, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.331] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.331] ReadFile (in: hFile=0x198, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.393] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0092.393] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.393] ReadFile (in: hFile=0x198, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.492] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.492] WriteFile (in: hFile=0x198, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc00fa, lpOverlapped=0x0) returned 1
	[0092.560] SetEndOfFile (hFile=0x198) returned 1
	[0092.561] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x4001020
	[0092.640] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0092.640] WriteFile (in: hFile=0x198, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0092.641] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0092.641] WriteFile (in: hFile=0x198, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0092.644] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0092.644] WriteFile (in: hFile=0x198, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0092.646] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x4001020 | out: hHeap=0x5e0000) returned 1
	[0092.646] CloseHandle (hObject=0x198) returned 1
	[0092.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63
	[0092.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63
	[0092.647] lstrlenW (lpString=".doc") returned 4
	[0092.647] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.647] lstrlenW (lpString=".docx") returned 5
	[0092.647] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1
	[0092.647] lstrlenW (lpString=".pdf") returned 4
	[0092.647] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.647] lstrlenW (lpString=".xls") returned 4
	[0092.647] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.647] lstrlenW (lpString=".xlsx") returned 5
	[0092.647] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1
	[0092.647] lstrlenW (lpString=".ppt") returned 4
	[0092.647] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63
	[0092.647] lstrlenW (lpString=".zip") returned 4
	[0092.647] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.647] lstrlenW (lpString=".rar") returned 4
	[0092.647] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.647] lstrlenW (lpString=".bz2") returned 4
	[0092.647] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.647] lstrlenW (lpString=".7z") returned 3
	[0092.647] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63
	[0092.648] lstrlenW (lpString=".dbf") returned 4
	[0092.648] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63
	[0092.648] lstrlenW (lpString=".1cd") returned 4
	[0092.648] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63
	[0092.648] lstrlenW (lpString=".jpg") returned 4
	[0092.648] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63
	[0092.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63
	[0092.648] lstrlenW (lpString=".doc") returned 4
	[0092.648] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.648] lstrlenW (lpString=".docx") returned 5
	[0092.648] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1
	[0092.648] lstrlenW (lpString=".pdf") returned 4
	[0092.648] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.648] lstrlenW (lpString=".xls") returned 4
	[0092.648] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.648] lstrlenW (lpString=".xlsx") returned 5
	[0092.648] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1
	[0092.648] lstrlenW (lpString=".ppt") returned 4
	[0092.648] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63
	[0092.648] lstrlenW (lpString=".zip") returned 4
	[0092.648] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.648] lstrlenW (lpString=".rar") returned 4
	[0092.648] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.648] lstrlenW (lpString=".bz2") returned 4
	[0092.648] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.648] lstrlenW (lpString=".7z") returned 3
	[0092.648] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63
	[0092.649] lstrlenW (lpString=".dbf") returned 4
	[0092.649] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63
	[0092.649] lstrlenW (lpString=".1cd") returned 4
	[0092.649] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63
	[0092.649] lstrlenW (lpString=".jpg") returned 4
	[0092.649] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.649] lstrcmpiW (lpString1=".CAB", lpString2=".adobe") returned 1
	[0092.649] lstrlenW (lpString="MUAUTH.CAB") returned 10
	[0092.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0092.728] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=6747) returned 1
	[0092.728] CloseHandle (hObject=0x190) returned 1
	[0092.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 0x20
	[0092.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0092.758] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.758] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0092.767] GetLastError () returned 0x0
	[0092.767] ReadFile (in: hFile=0x184, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x1a5b, lpOverlapped=0x0) returned 1
	[0092.776] WriteFile (in: hFile=0x188, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x1a60, lpOverlapped=0x0) returned 1
	[0092.777] ReadFile (in: hFile=0x184, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.777] WriteFile (in: hFile=0x188, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0092.777] SetEndOfFile (hFile=0x188) returned 1
	[0092.778] CloseHandle (hObject=0x188) returned 1
	[0092.779] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.779] SetEndOfFile (hFile=0x184) returned 1
	[0092.783] CloseHandle (hObject=0x184) returned 1
	[0092.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.783] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 1
	[0092.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66
	[0092.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66
	[0092.784] lstrlenW (lpString=".doc") returned 4
	[0092.784] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1
	[0092.784] lstrlenW (lpString=".docx") returned 5
	[0092.784] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1
	[0092.784] lstrlenW (lpString=".pdf") returned 4
	[0092.784] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1
	[0092.785] lstrlenW (lpString=".xls") returned 4
	[0092.785] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1
	[0092.785] lstrlenW (lpString=".xlsx") returned 5
	[0092.785] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1
	[0092.785] lstrlenW (lpString=".ppt") returned 4
	[0092.785] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1
	[0092.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66
	[0092.785] lstrlenW (lpString=".zip") returned 4
	[0092.785] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1
	[0092.785] lstrlenW (lpString=".rar") returned 4
	[0092.785] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1
	[0092.785] lstrlenW (lpString=".bz2") returned 4
	[0092.785] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1
	[0092.785] lstrlenW (lpString=".7z") returned 3
	[0092.785] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1
	[0092.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66
	[0092.786] lstrlenW (lpString=".dbf") returned 4
	[0092.786] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1
	[0092.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66
	[0092.786] lstrlenW (lpString=".1cd") returned 4
	[0092.786] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1
	[0092.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66
	[0092.786] lstrlenW (lpString=".jpg") returned 4
	[0092.786] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1
	[0092.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66
	[0092.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66
	[0092.786] lstrlenW (lpString=".doc") returned 4
	[0092.786] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1
	[0092.786] lstrlenW (lpString=".docx") returned 5
	[0092.786] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1
	[0092.786] lstrlenW (lpString=".pdf") returned 4
	[0092.786] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1
	[0092.786] lstrlenW (lpString=".xls") returned 4
	[0092.786] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1
	[0092.786] lstrlenW (lpString=".xlsx") returned 5
	[0092.786] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1
	[0092.786] lstrlenW (lpString=".ppt") returned 4
	[0092.786] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1
	[0092.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66
	[0092.786] lstrlenW (lpString=".zip") returned 4
	[0092.786] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1
	[0092.786] lstrlenW (lpString=".rar") returned 4
	[0092.786] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1
	[0092.786] lstrlenW (lpString=".bz2") returned 4
	[0092.786] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1
	[0092.787] lstrlenW (lpString=".7z") returned 3
	[0092.787] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1
	[0092.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66
	[0092.787] lstrlenW (lpString=".dbf") returned 4
	[0092.787] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1
	[0092.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66
	[0092.787] lstrlenW (lpString=".1cd") returned 4
	[0092.787] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1
	[0092.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66
	[0092.787] lstrlenW (lpString=".jpg") returned 4
	[0092.787] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1
	[0092.787] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0092.787] lstrlenW (lpString="ODeploy.exe") returned 11
	[0092.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0092.788] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=571320) returned 1
	[0092.788] CloseHandle (hObject=0x184) returned 1
	[0092.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 0x20
	[0092.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0092.788] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.788] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0092.789] GetLastError () returned 0x0
	[0092.789] ReadFile (in: hFile=0x184, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x8b7b8, lpOverlapped=0x0) returned 1
	[0092.833] WriteFile (in: hFile=0x160, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x8b7c0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x8b7c0, lpOverlapped=0x0) returned 1
	[0092.843] ReadFile (in: hFile=0x184, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.843] WriteFile (in: hFile=0x160, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0092.843] SetEndOfFile (hFile=0x160) returned 1
	[0092.844] CloseHandle (hObject=0x160) returned 1
	[0092.844] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.844] SetEndOfFile (hFile=0x184) returned 1
	[0092.849] CloseHandle (hObject=0x184) returned 1
	[0092.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.850] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 1
	[0092.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91
	[0092.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91
	[0092.850] lstrlenW (lpString=".doc") returned 4
	[0092.850] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0092.850] lstrlenW (lpString=".docx") returned 5
	[0092.850] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0092.850] lstrlenW (lpString=".pdf") returned 4
	[0092.850] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0092.850] lstrlenW (lpString=".xls") returned 4
	[0092.850] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0092.850] lstrlenW (lpString=".xlsx") returned 5
	[0092.850] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0092.850] lstrlenW (lpString=".ppt") returned 4
	[0092.850] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0092.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91
	[0092.850] lstrlenW (lpString=".zip") returned 4
	[0092.850] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0092.850] lstrlenW (lpString=".rar") returned 4
	[0092.850] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0092.850] lstrlenW (lpString=".bz2") returned 4
	[0092.851] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0092.851] lstrlenW (lpString=".7z") returned 3
	[0092.851] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0092.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91
	[0092.851] lstrlenW (lpString=".dbf") returned 4
	[0092.851] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0092.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91
	[0092.851] lstrlenW (lpString=".1cd") returned 4
	[0092.851] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0092.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91
	[0092.851] lstrlenW (lpString=".jpg") returned 4
	[0092.851] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0092.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91
	[0092.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91
	[0092.851] lstrlenW (lpString=".doc") returned 4
	[0092.851] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0092.851] lstrlenW (lpString=".docx") returned 5
	[0092.851] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0092.851] lstrlenW (lpString=".pdf") returned 4
	[0092.851] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0092.851] lstrlenW (lpString=".xls") returned 4
	[0092.851] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0092.851] lstrlenW (lpString=".xlsx") returned 5
	[0092.851] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0092.851] lstrlenW (lpString=".ppt") returned 4
	[0092.851] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0092.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91
	[0092.851] lstrlenW (lpString=".zip") returned 4
	[0092.851] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0092.851] lstrlenW (lpString=".rar") returned 4
	[0092.851] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0092.851] lstrlenW (lpString=".bz2") returned 4
	[0092.851] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0092.852] lstrlenW (lpString=".7z") returned 3
	[0092.852] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0092.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91
	[0092.852] lstrlenW (lpString=".dbf") returned 4
	[0092.852] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0092.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91
	[0092.852] lstrlenW (lpString=".1cd") returned 4
	[0092.852] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0092.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91
	[0092.852] lstrlenW (lpString=".jpg") returned 4
	[0092.852] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0092.852] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0092.852] lstrlenW (lpString="OSETUP.DLL") returned 10
	[0092.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0092.869] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=7379816) returned 1
	[0092.869] CloseHandle (hObject=0x184) returned 1
	[0092.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll")) returned 0x20
	[0092.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0092.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0092.871] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1
	[0092.871] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.871] ReadFile (in: hFile=0x184, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.880] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.880] ReadFile (in: hFile=0x184, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.920] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0092.920] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x6c9b68, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.920] ReadFile (in: hFile=0x184, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.985] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.986] WriteFile (in: hFile=0x184, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0093.023] SetEndOfFile (hFile=0x184) returned 1
	[0093.028] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f60070
	[0093.033] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0093.033] WriteFile (in: hFile=0x184, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0093.035] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0093.035] WriteFile (in: hFile=0x184, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0093.038] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x6c9b68, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0093.038] WriteFile (in: hFile=0x184, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0093.039] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f60070 | out: hHeap=0x5e0000) returned 1
	[0093.039] CloseHandle (hObject=0x184) returned 1
	[0093.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90
	[0093.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90
	[0093.043] lstrlenW (lpString=".doc") returned 4
	[0093.043] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.043] lstrlenW (lpString=".docx") returned 5
	[0093.043] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1
	[0093.043] lstrlenW (lpString=".pdf") returned 4
	[0093.043] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.043] lstrlenW (lpString=".xls") returned 4
	[0093.043] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.043] lstrlenW (lpString=".xlsx") returned 5
	[0093.043] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1
	[0093.043] lstrlenW (lpString=".ppt") returned 4
	[0093.043] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90
	[0093.043] lstrlenW (lpString=".zip") returned 4
	[0093.043] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.043] lstrlenW (lpString=".rar") returned 4
	[0093.043] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.043] lstrlenW (lpString=".bz2") returned 4
	[0093.043] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.043] lstrlenW (lpString=".7z") returned 3
	[0093.043] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90
	[0093.044] lstrlenW (lpString=".dbf") returned 4
	[0093.044] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90
	[0093.044] lstrlenW (lpString=".1cd") returned 4
	[0093.044] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90
	[0093.044] lstrlenW (lpString=".jpg") returned 4
	[0093.044] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90
	[0093.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90
	[0093.044] lstrlenW (lpString=".doc") returned 4
	[0093.044] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.044] lstrlenW (lpString=".docx") returned 5
	[0093.044] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1
	[0093.044] lstrlenW (lpString=".pdf") returned 4
	[0093.044] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.044] lstrlenW (lpString=".xls") returned 4
	[0093.044] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.044] lstrlenW (lpString=".xlsx") returned 5
	[0093.044] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1
	[0093.044] lstrlenW (lpString=".ppt") returned 4
	[0093.044] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90
	[0093.045] lstrlenW (lpString=".zip") returned 4
	[0093.045] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.045] lstrlenW (lpString=".rar") returned 4
	[0093.045] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.045] lstrlenW (lpString=".bz2") returned 4
	[0093.045] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.045] lstrlenW (lpString=".7z") returned 3
	[0093.045] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90
	[0093.045] lstrlenW (lpString=".dbf") returned 4
	[0093.045] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90
	[0093.045] lstrlenW (lpString=".1cd") returned 4
	[0093.045] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90
	[0093.045] lstrlenW (lpString=".jpg") returned 4
	[0093.045] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.045] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0093.045] lstrlenW (lpString="Setup.exe") returned 9
	[0093.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.065] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1377144) returned 1
	[0093.065] CloseHandle (hObject=0x190) returned 1
	[0093.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 0x20
	[0093.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0093.097] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.097] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0093.115] GetLastError () returned 0x0
	[0093.115] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0093.342] WriteFile (in: hFile=0x1b8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0093.364] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x50388, lpOverlapped=0x0) returned 1
	[0093.485] WriteFile (in: hFile=0x1b8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x50390, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x50390, lpOverlapped=0x0) returned 1
	[0093.496] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.496] WriteFile (in: hFile=0x1b8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0093.496] SetEndOfFile (hFile=0x1b8) returned 1
	[0093.496] CloseHandle (hObject=0x1b8) returned 1
	[0093.497] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.497] SetEndOfFile (hFile=0x198) returned 1
	[0093.500] CloseHandle (hObject=0x198) returned 1
	[0093.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.500] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 1
	[0093.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89
	[0093.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89
	[0093.501] lstrlenW (lpString=".doc") returned 4
	[0093.501] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0093.501] lstrlenW (lpString=".docx") returned 5
	[0093.501] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0093.501] lstrlenW (lpString=".pdf") returned 4
	[0093.501] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0093.501] lstrlenW (lpString=".xls") returned 4
	[0093.501] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0093.501] lstrlenW (lpString=".xlsx") returned 5
	[0093.501] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0093.501] lstrlenW (lpString=".ppt") returned 4
	[0093.501] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0093.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89
	[0093.501] lstrlenW (lpString=".zip") returned 4
	[0093.501] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0093.501] lstrlenW (lpString=".rar") returned 4
	[0093.501] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0093.501] lstrlenW (lpString=".bz2") returned 4
	[0093.501] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0093.501] lstrlenW (lpString=".7z") returned 3
	[0093.501] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0093.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89
	[0093.501] lstrlenW (lpString=".dbf") returned 4
	[0093.501] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0093.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89
	[0093.501] lstrlenW (lpString=".1cd") returned 4
	[0093.501] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0093.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89
	[0093.501] lstrlenW (lpString=".jpg") returned 4
	[0093.501] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0093.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89
	[0093.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89
	[0093.502] lstrlenW (lpString=".doc") returned 4
	[0093.502] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0093.502] lstrlenW (lpString=".docx") returned 5
	[0093.502] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0093.502] lstrlenW (lpString=".pdf") returned 4
	[0093.502] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0093.502] lstrlenW (lpString=".xls") returned 4
	[0093.502] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0093.502] lstrlenW (lpString=".xlsx") returned 5
	[0093.502] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0093.502] lstrlenW (lpString=".ppt") returned 4
	[0093.502] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0093.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89
	[0093.502] lstrlenW (lpString=".zip") returned 4
	[0093.502] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0093.502] lstrlenW (lpString=".rar") returned 4
	[0093.502] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0093.502] lstrlenW (lpString=".bz2") returned 4
	[0093.502] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0093.502] lstrlenW (lpString=".7z") returned 3
	[0093.502] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0093.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89
	[0093.502] lstrlenW (lpString=".dbf") returned 4
	[0093.502] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0093.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89
	[0093.502] lstrlenW (lpString=".1cd") returned 4
	[0093.502] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0093.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89
	[0093.502] lstrlenW (lpString=".jpg") returned 4
	[0093.502] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0093.503] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0093.503] lstrlenW (lpString="PJRESC.DLL") returned 10
	[0093.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0093.521] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=261008) returned 1
	[0093.521] CloseHandle (hObject=0x198) returned 1
	[0093.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll")) returned 0x20
	[0093.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.529] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.529] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0093.546] GetLastError () returned 0x0
	[0093.546] ReadFile (in: hFile=0x190, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x3fb90, lpOverlapped=0x0) returned 1
	[0093.557] WriteFile (in: hFile=0x1a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x3fba0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x3fba0, lpOverlapped=0x0) returned 1
	[0093.562] ReadFile (in: hFile=0x190, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.563] WriteFile (in: hFile=0x1a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0093.563] SetEndOfFile (hFile=0x1a8) returned 1
	[0093.563] CloseHandle (hObject=0x1a8) returned 1
	[0093.563] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.563] SetEndOfFile (hFile=0x190) returned 1
	[0093.566] CloseHandle (hObject=0x190) returned 1
	[0093.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.566] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll")) returned 1
	[0093.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66
	[0093.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66
	[0093.593] lstrlenW (lpString=".doc") returned 4
	[0093.593] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.594] lstrlenW (lpString=".docx") returned 5
	[0093.594] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1
	[0093.594] lstrlenW (lpString=".pdf") returned 4
	[0093.594] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.594] lstrlenW (lpString=".xls") returned 4
	[0093.594] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.594] lstrlenW (lpString=".xlsx") returned 5
	[0093.594] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1
	[0093.594] lstrlenW (lpString=".ppt") returned 4
	[0093.594] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66
	[0093.594] lstrlenW (lpString=".zip") returned 4
	[0093.594] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.594] lstrlenW (lpString=".rar") returned 4
	[0093.594] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.594] lstrlenW (lpString=".bz2") returned 4
	[0093.594] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.594] lstrlenW (lpString=".7z") returned 3
	[0093.594] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66
	[0093.594] lstrlenW (lpString=".dbf") returned 4
	[0093.594] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66
	[0093.594] lstrlenW (lpString=".1cd") returned 4
	[0093.594] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66
	[0093.594] lstrlenW (lpString=".jpg") returned 4
	[0093.594] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66
	[0093.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66
	[0093.594] lstrlenW (lpString=".doc") returned 4
	[0093.594] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.594] lstrlenW (lpString=".docx") returned 5
	[0093.594] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1
	[0093.595] lstrlenW (lpString=".pdf") returned 4
	[0093.595] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.595] lstrlenW (lpString=".xls") returned 4
	[0093.595] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.595] lstrlenW (lpString=".xlsx") returned 5
	[0093.595] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1
	[0093.595] lstrlenW (lpString=".ppt") returned 4
	[0093.595] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66
	[0093.595] lstrlenW (lpString=".zip") returned 4
	[0093.595] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.595] lstrlenW (lpString=".rar") returned 4
	[0093.595] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.595] lstrlenW (lpString=".bz2") returned 4
	[0093.595] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.595] lstrlenW (lpString=".7z") returned 3
	[0093.595] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66
	[0093.595] lstrlenW (lpString=".dbf") returned 4
	[0093.595] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66
	[0093.595] lstrlenW (lpString=".1cd") returned 4
	[0093.595] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66
	[0093.595] lstrlenW (lpString=".jpg") returned 4
	[0093.595] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.595] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0093.595] lstrlenW (lpString="RICHED20.DLL") returned 12
	[0093.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0093.650] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1870696) returned 1
	[0093.650] CloseHandle (hObject=0x1a0) returned 1
	[0093.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll")) returned 0x20
	[0093.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0093.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0093.712] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1
	[0093.712] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.712] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0093.715] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x983cd, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.715] ReadFile (in: hFile=0x1a8, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0093.765] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.765] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x188b68, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.765] ReadFile (in: hFile=0x1a8, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0093.833] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.833] WriteFile (in: hFile=0x1a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0093.889] SetEndOfFile (hFile=0x1a8) returned 1
	[0093.890] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x4001020
	[0093.894] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0093.894] WriteFile (in: hFile=0x1a8, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0093.895] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x983cd, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0093.895] WriteFile (in: hFile=0x1a8, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0093.897] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x188b68, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1
	[0093.897] WriteFile (in: hFile=0x1a8, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0093.899] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x4001020 | out: hHeap=0x5e0000) returned 1
	[0093.899] CloseHandle (hObject=0x1a8) returned 1
	[0093.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68
	[0093.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68
	[0093.900] lstrlenW (lpString=".doc") returned 4
	[0093.900] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.900] lstrlenW (lpString=".docx") returned 5
	[0093.900] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0093.900] lstrlenW (lpString=".pdf") returned 4
	[0093.900] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.900] lstrlenW (lpString=".xls") returned 4
	[0093.900] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.900] lstrlenW (lpString=".xlsx") returned 5
	[0093.900] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0093.900] lstrlenW (lpString=".ppt") returned 4
	[0093.900] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68
	[0093.900] lstrlenW (lpString=".zip") returned 4
	[0093.900] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.900] lstrlenW (lpString=".rar") returned 4
	[0093.900] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.900] lstrlenW (lpString=".bz2") returned 4
	[0093.900] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.901] lstrlenW (lpString=".7z") returned 3
	[0093.901] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68
	[0093.901] lstrlenW (lpString=".dbf") returned 4
	[0093.901] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68
	[0093.901] lstrlenW (lpString=".1cd") returned 4
	[0093.901] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68
	[0093.901] lstrlenW (lpString=".jpg") returned 4
	[0093.901] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68
	[0093.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68
	[0093.901] lstrlenW (lpString=".doc") returned 4
	[0093.901] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.901] lstrlenW (lpString=".docx") returned 5
	[0093.901] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0093.901] lstrlenW (lpString=".pdf") returned 4
	[0093.901] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.901] lstrlenW (lpString=".xls") returned 4
	[0093.901] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.901] lstrlenW (lpString=".xlsx") returned 5
	[0093.901] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0093.901] lstrlenW (lpString=".ppt") returned 4
	[0093.901] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68
	[0093.901] lstrlenW (lpString=".zip") returned 4
	[0093.901] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.901] lstrlenW (lpString=".rar") returned 4
	[0093.901] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.902] lstrlenW (lpString=".bz2") returned 4
	[0093.902] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.902] lstrlenW (lpString=".7z") returned 3
	[0093.902] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68
	[0093.902] lstrlenW (lpString=".dbf") returned 4
	[0093.902] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68
	[0093.902] lstrlenW (lpString=".1cd") returned 4
	[0093.902] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68
	[0093.902] lstrlenW (lpString=".jpg") returned 4
	[0093.902] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.902] lstrcmpiW (lpString1=".xrm-ms", lpString2=".adobe") returned 1
	[0093.902] lstrlenW (lpString="osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 42
	[0093.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0093.903] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=11646) returned 1
	[0093.903] CloseHandle (hObject=0x1a8) returned 1
	[0093.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 0x20
	[0093.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0093.904] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.904] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0093.904] GetLastError () returned 0x0
	[0093.904] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x2d7e, lpOverlapped=0x0) returned 1
	[0093.928] WriteFile (in: hFile=0x1a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x2d80, lpOverlapped=0x0) returned 1
	[0093.929] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.929] WriteFile (in: hFile=0x1a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x128, lpOverlapped=0x0) returned 1
	[0093.930] SetEndOfFile (hFile=0x1a4) returned 1
	[0093.930] CloseHandle (hObject=0x1a4) returned 1
	[0093.930] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.930] SetEndOfFile (hFile=0x1a8) returned 1
	[0093.931] CloseHandle (hObject=0x1a8) returned 1
	[0093.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.931] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 1
	[0093.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122
	[0093.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122
	[0093.931] lstrlenW (lpString=".doc") returned 4
	[0093.931] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0093.932] lstrlenW (lpString=".docx") returned 5
	[0093.932] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0093.932] lstrlenW (lpString=".pdf") returned 4
	[0093.932] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0093.932] lstrlenW (lpString=".xls") returned 4
	[0093.932] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0093.932] lstrlenW (lpString=".xlsx") returned 5
	[0093.932] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0093.932] lstrlenW (lpString=".ppt") returned 4
	[0093.932] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0093.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122
	[0093.932] lstrlenW (lpString=".zip") returned 4
	[0093.932] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0093.932] lstrlenW (lpString=".rar") returned 4
	[0093.932] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0093.932] lstrlenW (lpString=".bz2") returned 4
	[0093.932] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0093.932] lstrlenW (lpString=".7z") returned 3
	[0093.932] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0093.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122
	[0093.932] lstrlenW (lpString=".dbf") returned 4
	[0093.932] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0093.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122
	[0093.932] lstrlenW (lpString=".1cd") returned 4
	[0093.932] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0093.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122
	[0093.932] lstrlenW (lpString=".jpg") returned 4
	[0093.932] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0093.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122
	[0093.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122
	[0093.933] lstrlenW (lpString=".doc") returned 4
	[0093.933] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0093.933] lstrlenW (lpString=".docx") returned 5
	[0093.933] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0093.933] lstrlenW (lpString=".pdf") returned 4
	[0093.933] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0093.933] lstrlenW (lpString=".xls") returned 4
	[0093.933] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0093.933] lstrlenW (lpString=".xlsx") returned 5
	[0093.933] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0093.933] lstrlenW (lpString=".ppt") returned 4
	[0093.933] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0093.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122
	[0093.933] lstrlenW (lpString=".zip") returned 4
	[0093.933] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0093.933] lstrlenW (lpString=".rar") returned 4
	[0093.933] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0093.933] lstrlenW (lpString=".bz2") returned 4
	[0093.933] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0093.933] lstrlenW (lpString=".7z") returned 3
	[0093.933] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0093.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122
	[0093.933] lstrlenW (lpString=".dbf") returned 4
	[0093.934] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0093.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122
	[0093.934] lstrlenW (lpString=".1cd") returned 4
	[0093.934] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0093.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122
	[0093.934] lstrlenW (lpString=".jpg") returned 4
	[0093.934] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0093.934] lstrcmpiW (lpString1=".EXE", lpString2=".adobe") returned 1
	[0093.934] lstrlenW (lpString="OSPPREARM.EXE") returned 13
	[0093.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0093.935] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=15712) returned 1
	[0093.935] CloseHandle (hObject=0x1a8) returned 1
	[0093.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 0x20
	[0093.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0093.936] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.936] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0093.936] GetLastError () returned 0x0
	[0093.937] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x3d60, lpOverlapped=0x0) returned 1
	[0094.045] WriteFile (in: hFile=0x1a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x3d70, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x3d70, lpOverlapped=0x0) returned 1
	[0094.047] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.047] WriteFile (in: hFile=0x1a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xee, lpOverlapped=0x0) returned 1
	[0094.047] SetEndOfFile (hFile=0x1a4) returned 1
	[0094.047] CloseHandle (hObject=0x1a4) returned 1
	[0094.047] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.047] SetEndOfFile (hFile=0x1a8) returned 1
	[0094.048] CloseHandle (hObject=0x1a8) returned 1
	[0094.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.048] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 1
	[0094.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93
	[0094.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93
	[0094.049] lstrlenW (lpString=".doc") returned 4
	[0094.049] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0094.049] lstrlenW (lpString=".docx") returned 5
	[0094.049] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1
	[0094.049] lstrlenW (lpString=".pdf") returned 4
	[0094.049] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0094.049] lstrlenW (lpString=".xls") returned 4
	[0094.049] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0094.049] lstrlenW (lpString=".xlsx") returned 5
	[0094.049] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1
	[0094.049] lstrlenW (lpString=".ppt") returned 4
	[0094.049] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0094.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93
	[0094.049] lstrlenW (lpString=".zip") returned 4
	[0094.049] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0094.049] lstrlenW (lpString=".rar") returned 4
	[0094.049] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0094.049] lstrlenW (lpString=".bz2") returned 4
	[0094.049] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0094.049] lstrlenW (lpString=".7z") returned 3
	[0094.049] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0094.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93
	[0094.049] lstrlenW (lpString=".dbf") returned 4
	[0094.050] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0094.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93
	[0094.050] lstrlenW (lpString=".1cd") returned 4
	[0094.050] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0094.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93
	[0094.050] lstrlenW (lpString=".jpg") returned 4
	[0094.050] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0094.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93
	[0094.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93
	[0094.050] lstrlenW (lpString=".doc") returned 4
	[0094.050] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0094.050] lstrlenW (lpString=".docx") returned 5
	[0094.050] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1
	[0094.050] lstrlenW (lpString=".pdf") returned 4
	[0094.050] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0094.050] lstrlenW (lpString=".xls") returned 4
	[0094.050] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0094.050] lstrlenW (lpString=".xlsx") returned 5
	[0094.050] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1
	[0094.050] lstrlenW (lpString=".ppt") returned 4
	[0094.050] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0094.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93
	[0094.050] lstrlenW (lpString=".zip") returned 4
	[0094.050] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0094.050] lstrlenW (lpString=".rar") returned 4
	[0094.050] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0094.050] lstrlenW (lpString=".bz2") returned 4
	[0094.050] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0094.050] lstrlenW (lpString=".7z") returned 3
	[0094.050] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0094.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93
	[0094.050] lstrlenW (lpString=".dbf") returned 4
	[0094.050] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0094.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93
	[0094.051] lstrlenW (lpString=".1cd") returned 4
	[0094.051] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0094.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93
	[0094.051] lstrlenW (lpString=".jpg") returned 4
	[0094.051] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0094.051] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0094.051] lstrlenW (lpString="OSPPWMI.DLL") returned 11
	[0094.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0094.052] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=146192) returned 1
	[0094.052] CloseHandle (hObject=0x1a8) returned 1
	[0094.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll")) returned 0x20
	[0094.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0094.052] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.052] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0094.053] GetLastError () returned 0x0
	[0094.053] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x23b10, lpOverlapped=0x0) returned 1
	[0094.065] WriteFile (in: hFile=0x1a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x23b20, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x23b20, lpOverlapped=0x0) returned 1
	[0094.069] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.069] WriteFile (in: hFile=0x1a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0094.070] SetEndOfFile (hFile=0x1a4) returned 1
	[0094.070] CloseHandle (hObject=0x1a4) returned 1
	[0094.070] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.070] SetEndOfFile (hFile=0x1a8) returned 1
	[0094.072] CloseHandle (hObject=0x1a8) returned 1
	[0094.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.072] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll")) returned 1
	[0094.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91
	[0094.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91
	[0094.072] lstrlenW (lpString=".doc") returned 4
	[0094.072] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.072] lstrlenW (lpString=".docx") returned 5
	[0094.072] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0094.072] lstrlenW (lpString=".pdf") returned 4
	[0094.072] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.072] lstrlenW (lpString=".xls") returned 4
	[0094.072] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.072] lstrlenW (lpString=".xlsx") returned 5
	[0094.072] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0094.073] lstrlenW (lpString=".ppt") returned 4
	[0094.073] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91
	[0094.073] lstrlenW (lpString=".zip") returned 4
	[0094.073] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.073] lstrlenW (lpString=".rar") returned 4
	[0094.073] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.073] lstrlenW (lpString=".bz2") returned 4
	[0094.073] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.073] lstrlenW (lpString=".7z") returned 3
	[0094.073] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91
	[0094.073] lstrlenW (lpString=".dbf") returned 4
	[0094.073] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91
	[0094.073] lstrlenW (lpString=".1cd") returned 4
	[0094.073] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91
	[0094.073] lstrlenW (lpString=".jpg") returned 4
	[0094.073] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91
	[0094.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91
	[0094.073] lstrlenW (lpString=".doc") returned 4
	[0094.073] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.073] lstrlenW (lpString=".docx") returned 5
	[0094.073] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0094.073] lstrlenW (lpString=".pdf") returned 4
	[0094.073] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.073] lstrlenW (lpString=".xls") returned 4
	[0094.073] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.073] lstrlenW (lpString=".xlsx") returned 5
	[0094.073] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0094.073] lstrlenW (lpString=".ppt") returned 4
	[0094.074] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91
	[0094.074] lstrlenW (lpString=".zip") returned 4
	[0094.074] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.074] lstrlenW (lpString=".rar") returned 4
	[0094.074] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.074] lstrlenW (lpString=".bz2") returned 4
	[0094.074] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.074] lstrlenW (lpString=".7z") returned 3
	[0094.074] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91
	[0094.074] lstrlenW (lpString=".dbf") returned 4
	[0094.074] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91
	[0094.074] lstrlenW (lpString=".1cd") returned 4
	[0094.074] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91
	[0094.074] lstrlenW (lpString=".jpg") returned 4
	[0094.074] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.074] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0094.074] lstrlenW (lpString="MSLID.DLL") returned 9
	[0094.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0094.075] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=591168) returned 1
	[0094.075] CloseHandle (hObject=0x1a8) returned 1
	[0094.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll")) returned 0x20
	[0094.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0094.076] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.076] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0094.208] GetLastError () returned 0x0
	[0094.208] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x90540, lpOverlapped=0x0) returned 1
	[0094.259] WriteFile (in: hFile=0x184, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x90550, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x90550, lpOverlapped=0x0) returned 1
	[0094.272] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.272] WriteFile (in: hFile=0x184, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0094.272] SetEndOfFile (hFile=0x184) returned 1
	[0094.273] CloseHandle (hObject=0x184) returned 1
	[0094.276] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.276] SetEndOfFile (hFile=0x1a8) returned 1
	[0094.287] CloseHandle (hObject=0x1a8) returned 1
	[0094.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.289] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll")) returned 1
	[0094.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62
	[0094.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62
	[0094.290] lstrlenW (lpString=".doc") returned 4
	[0094.290] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.290] lstrlenW (lpString=".docx") returned 5
	[0094.290] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1
	[0094.290] lstrlenW (lpString=".pdf") returned 4
	[0094.290] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.290] lstrlenW (lpString=".xls") returned 4
	[0094.290] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.290] lstrlenW (lpString=".xlsx") returned 5
	[0094.290] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1
	[0094.290] lstrlenW (lpString=".ppt") returned 4
	[0094.290] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62
	[0094.290] lstrlenW (lpString=".zip") returned 4
	[0094.290] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.290] lstrlenW (lpString=".rar") returned 4
	[0094.291] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.291] lstrlenW (lpString=".bz2") returned 4
	[0094.291] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.291] lstrlenW (lpString=".7z") returned 3
	[0094.291] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62
	[0094.291] lstrlenW (lpString=".dbf") returned 4
	[0094.291] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62
	[0094.291] lstrlenW (lpString=".1cd") returned 4
	[0094.291] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62
	[0094.291] lstrlenW (lpString=".jpg") returned 4
	[0094.291] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62
	[0094.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62
	[0094.291] lstrlenW (lpString=".doc") returned 4
	[0094.291] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.291] lstrlenW (lpString=".docx") returned 5
	[0094.291] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1
	[0094.291] lstrlenW (lpString=".pdf") returned 4
	[0094.291] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.291] lstrlenW (lpString=".xls") returned 4
	[0094.291] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.291] lstrlenW (lpString=".xlsx") returned 5
	[0094.291] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1
	[0094.291] lstrlenW (lpString=".ppt") returned 4
	[0094.291] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62
	[0094.292] lstrlenW (lpString=".zip") returned 4
	[0094.292] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.292] lstrlenW (lpString=".rar") returned 4
	[0094.292] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.292] lstrlenW (lpString=".bz2") returned 4
	[0094.292] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.292] lstrlenW (lpString=".7z") returned 3
	[0094.292] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62
	[0094.292] lstrlenW (lpString=".dbf") returned 4
	[0094.292] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62
	[0094.292] lstrlenW (lpString=".1cd") returned 4
	[0094.292] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62
	[0094.292] lstrlenW (lpString=".jpg") returned 4
	[0094.292] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.292] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0094.292] lstrlenW (lpString="STINTL.DLL") returned 10
	[0094.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0094.293] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=17280) returned 1
	[0094.293] CloseHandle (hObject=0x1a8) returned 1
	[0094.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 0x20
	[0094.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0094.294] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.294] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0094.294] GetLastError () returned 0x0
	[0094.294] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x4380, lpOverlapped=0x0) returned 1
	[0094.301] WriteFile (in: hFile=0x190, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x4390, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x4390, lpOverlapped=0x0) returned 1
	[0094.302] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.302] WriteFile (in: hFile=0x190, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0094.302] SetEndOfFile (hFile=0x190) returned 1
	[0094.303] CloseHandle (hObject=0x190) returned 1
	[0094.303] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.303] SetEndOfFile (hFile=0x1a8) returned 1
	[0094.304] CloseHandle (hObject=0x1a8) returned 1
	[0094.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.304] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 1
	[0094.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72
	[0094.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72
	[0094.304] lstrlenW (lpString=".doc") returned 4
	[0094.304] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.304] lstrlenW (lpString=".docx") returned 5
	[0094.305] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0094.305] lstrlenW (lpString=".pdf") returned 4
	[0094.305] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.305] lstrlenW (lpString=".xls") returned 4
	[0094.305] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.305] lstrlenW (lpString=".xlsx") returned 5
	[0094.305] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0094.305] lstrlenW (lpString=".ppt") returned 4
	[0094.305] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72
	[0094.305] lstrlenW (lpString=".zip") returned 4
	[0094.305] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.305] lstrlenW (lpString=".rar") returned 4
	[0094.305] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.305] lstrlenW (lpString=".bz2") returned 4
	[0094.305] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.305] lstrlenW (lpString=".7z") returned 3
	[0094.305] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72
	[0094.305] lstrlenW (lpString=".dbf") returned 4
	[0094.305] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72
	[0094.305] lstrlenW (lpString=".1cd") returned 4
	[0094.305] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72
	[0094.305] lstrlenW (lpString=".jpg") returned 4
	[0094.305] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72
	[0094.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72
	[0094.305] lstrlenW (lpString=".doc") returned 4
	[0094.305] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.305] lstrlenW (lpString=".docx") returned 5
	[0094.305] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0094.306] lstrlenW (lpString=".pdf") returned 4
	[0094.306] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.306] lstrlenW (lpString=".xls") returned 4
	[0094.306] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.306] lstrlenW (lpString=".xlsx") returned 5
	[0094.306] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0094.306] lstrlenW (lpString=".ppt") returned 4
	[0094.306] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72
	[0094.306] lstrlenW (lpString=".zip") returned 4
	[0094.306] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.306] lstrlenW (lpString=".rar") returned 4
	[0094.306] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.306] lstrlenW (lpString=".bz2") returned 4
	[0094.306] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.306] lstrlenW (lpString=".7z") returned 3
	[0094.306] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72
	[0094.306] lstrlenW (lpString=".dbf") returned 4
	[0094.306] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72
	[0094.306] lstrlenW (lpString=".1cd") returned 4
	[0094.306] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72
	[0094.306] lstrlenW (lpString=".jpg") returned 4
	[0094.306] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.306] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".adobe") returned 1
	[0094.306] lstrlenW (lpString="STINTL.DLL.IDX_DLL") returned 18
	[0094.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0094.310] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=13696) returned 1
	[0094.310] CloseHandle (hObject=0x190) returned 1
	[0094.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 0x20
	[0094.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0094.311] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.311] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0094.312] GetLastError () returned 0x0
	[0094.312] ReadFile (in: hFile=0x190, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x3580, lpOverlapped=0x0) returned 1
	[0094.347] WriteFile (in: hFile=0x1c4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x3590, lpOverlapped=0x0) returned 1
	[0094.349] ReadFile (in: hFile=0x190, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.349] WriteFile (in: hFile=0x1c4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf8, lpOverlapped=0x0) returned 1
	[0094.349] SetEndOfFile (hFile=0x1c4) returned 1
	[0094.349] CloseHandle (hObject=0x1c4) returned 1
	[0094.349] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.349] SetEndOfFile (hFile=0x190) returned 1
	[0094.350] CloseHandle (hObject=0x190) returned 1
	[0094.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.351] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 1
	[0094.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80
	[0094.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80
	[0094.351] lstrlenW (lpString=".doc") returned 4
	[0094.351] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0094.351] lstrlenW (lpString=".docx") returned 5
	[0094.351] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0094.351] lstrlenW (lpString=".pdf") returned 4
	[0094.351] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0094.351] lstrlenW (lpString=".xls") returned 4
	[0094.351] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0094.351] lstrlenW (lpString=".xlsx") returned 5
	[0094.351] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0094.351] lstrlenW (lpString=".ppt") returned 4
	[0094.351] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0094.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80
	[0094.352] lstrlenW (lpString=".zip") returned 4
	[0094.352] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0094.352] lstrlenW (lpString=".rar") returned 4
	[0094.352] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0094.352] lstrlenW (lpString=".bz2") returned 4
	[0094.352] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0094.352] lstrlenW (lpString=".7z") returned 3
	[0094.352] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80
	[0094.352] lstrlenW (lpString=".dbf") returned 4
	[0094.352] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0094.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80
	[0094.352] lstrlenW (lpString=".1cd") returned 4
	[0094.352] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0094.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80
	[0094.352] lstrlenW (lpString=".jpg") returned 4
	[0094.352] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0094.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80
	[0094.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80
	[0094.352] lstrlenW (lpString=".doc") returned 4
	[0094.352] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0094.352] lstrlenW (lpString=".docx") returned 5
	[0094.352] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0094.352] lstrlenW (lpString=".pdf") returned 4
	[0094.352] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0094.352] lstrlenW (lpString=".xls") returned 4
	[0094.352] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0094.352] lstrlenW (lpString=".xlsx") returned 5
	[0094.352] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0094.352] lstrlenW (lpString=".ppt") returned 4
	[0094.353] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0094.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80
	[0094.353] lstrlenW (lpString=".zip") returned 4
	[0094.353] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0094.353] lstrlenW (lpString=".rar") returned 4
	[0094.353] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0094.353] lstrlenW (lpString=".bz2") returned 4
	[0094.353] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0094.353] lstrlenW (lpString=".7z") returned 3
	[0094.353] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80
	[0094.353] lstrlenW (lpString=".dbf") returned 4
	[0094.353] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0094.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80
	[0094.353] lstrlenW (lpString=".1cd") returned 4
	[0094.353] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0094.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80
	[0094.353] lstrlenW (lpString=".jpg") returned 4
	[0094.353] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0094.353] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0094.353] lstrlenW (lpString="FDATE.DLL") returned 9
	[0094.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0094.380] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=98176) returned 1
	[0094.380] CloseHandle (hObject=0x1b8) returned 1
	[0094.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll")) returned 0x20
	[0094.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0094.438] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.438] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0094.449] GetLastError () returned 0x0
	[0094.449] ReadFile (in: hFile=0x194, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x17f80, lpOverlapped=0x0) returned 1
	[0094.454] WriteFile (in: hFile=0x1a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x17f90, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x17f90, lpOverlapped=0x0) returned 1
	[0094.457] ReadFile (in: hFile=0x194, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.457] WriteFile (in: hFile=0x1a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0094.457] SetEndOfFile (hFile=0x1a4) returned 1
	[0094.467] CloseHandle (hObject=0x1a4) returned 1
	[0094.479] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.479] SetEndOfFile (hFile=0x194) returned 1
	[0094.490] CloseHandle (hObject=0x194) returned 1
	[0094.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.497] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll")) returned 1
	[0094.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66
	[0094.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66
	[0094.502] lstrlenW (lpString=".doc") returned 4
	[0094.502] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.502] lstrlenW (lpString=".docx") returned 5
	[0094.502] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1
	[0094.502] lstrlenW (lpString=".pdf") returned 4
	[0094.502] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.502] lstrlenW (lpString=".xls") returned 4
	[0094.502] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.502] lstrlenW (lpString=".xlsx") returned 5
	[0094.502] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1
	[0094.502] lstrlenW (lpString=".ppt") returned 4
	[0094.502] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66
	[0094.502] lstrlenW (lpString=".zip") returned 4
	[0094.502] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.502] lstrlenW (lpString=".rar") returned 4
	[0094.502] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.502] lstrlenW (lpString=".bz2") returned 4
	[0094.502] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.502] lstrlenW (lpString=".7z") returned 3
	[0094.502] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66
	[0094.503] lstrlenW (lpString=".dbf") returned 4
	[0094.503] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66
	[0094.503] lstrlenW (lpString=".1cd") returned 4
	[0094.503] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66
	[0094.503] lstrlenW (lpString=".jpg") returned 4
	[0094.503] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66
	[0094.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66
	[0094.503] lstrlenW (lpString=".doc") returned 4
	[0094.503] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.503] lstrlenW (lpString=".docx") returned 5
	[0094.503] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1
	[0094.503] lstrlenW (lpString=".pdf") returned 4
	[0094.503] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.503] lstrlenW (lpString=".xls") returned 4
	[0094.503] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.503] lstrlenW (lpString=".xlsx") returned 5
	[0094.503] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1
	[0094.503] lstrlenW (lpString=".ppt") returned 4
	[0094.503] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66
	[0094.503] lstrlenW (lpString=".zip") returned 4
	[0094.503] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.504] lstrlenW (lpString=".rar") returned 4
	[0094.504] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.504] lstrlenW (lpString=".bz2") returned 4
	[0094.504] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.504] lstrlenW (lpString=".7z") returned 3
	[0094.504] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66
	[0094.504] lstrlenW (lpString=".dbf") returned 4
	[0094.504] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66
	[0094.504] lstrlenW (lpString=".1cd") returned 4
	[0094.504] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66
	[0094.504] lstrlenW (lpString=".jpg") returned 4
	[0094.504] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.504] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0094.505] lstrlenW (lpString="IETAG.DLL") returned 9
	[0094.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0094.529] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=234880) returned 1
	[0094.529] CloseHandle (hObject=0x1b8) returned 1
	[0094.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll")) returned 0x20
	[0094.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0094.573] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.573] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0094.598] GetLastError () returned 0x0
	[0094.598] ReadFile (in: hFile=0x1c4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x39580, lpOverlapped=0x0) returned 1
	[0094.610] WriteFile (in: hFile=0x1a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x39590, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x39590, lpOverlapped=0x0) returned 1
	[0094.616] ReadFile (in: hFile=0x1c4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.616] WriteFile (in: hFile=0x1a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0094.616] SetEndOfFile (hFile=0x1a8) returned 1
	[0094.629] CloseHandle (hObject=0x1a8) returned 1
	[0094.631] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.631] SetEndOfFile (hFile=0x1c4) returned 1
	[0094.638] CloseHandle (hObject=0x1c4) returned 1
	[0094.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.642] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll")) returned 1
	[0094.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66
	[0094.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66
	[0094.645] lstrlenW (lpString=".doc") returned 4
	[0094.645] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.645] lstrlenW (lpString=".docx") returned 5
	[0094.645] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1
	[0094.646] lstrlenW (lpString=".pdf") returned 4
	[0094.646] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.646] lstrlenW (lpString=".xls") returned 4
	[0094.646] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.646] lstrlenW (lpString=".xlsx") returned 5
	[0094.646] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1
	[0094.646] lstrlenW (lpString=".ppt") returned 4
	[0094.646] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66
	[0094.646] lstrlenW (lpString=".zip") returned 4
	[0094.646] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.646] lstrlenW (lpString=".rar") returned 4
	[0094.646] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.646] lstrlenW (lpString=".bz2") returned 4
	[0094.646] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.646] lstrlenW (lpString=".7z") returned 3
	[0094.646] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66
	[0094.646] lstrlenW (lpString=".dbf") returned 4
	[0094.646] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66
	[0094.646] lstrlenW (lpString=".1cd") returned 4
	[0094.646] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66
	[0094.646] lstrlenW (lpString=".jpg") returned 4
	[0094.646] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66
	[0094.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66
	[0094.647] lstrlenW (lpString=".doc") returned 4
	[0094.647] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.647] lstrlenW (lpString=".docx") returned 5
	[0094.647] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1
	[0094.647] lstrlenW (lpString=".pdf") returned 4
	[0094.647] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.647] lstrlenW (lpString=".xls") returned 4
	[0094.647] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.647] lstrlenW (lpString=".xlsx") returned 5
	[0094.647] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1
	[0094.647] lstrlenW (lpString=".ppt") returned 4
	[0094.647] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66
	[0094.647] lstrlenW (lpString=".zip") returned 4
	[0094.647] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.647] lstrlenW (lpString=".rar") returned 4
	[0094.647] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.647] lstrlenW (lpString=".bz2") returned 4
	[0094.647] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.647] lstrlenW (lpString=".7z") returned 3
	[0094.647] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66
	[0094.647] lstrlenW (lpString=".dbf") returned 4
	[0094.647] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66
	[0094.648] lstrlenW (lpString=".1cd") returned 4
	[0094.648] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66
	[0094.648] lstrlenW (lpString=".jpg") returned 4
	[0094.648] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.648] lstrcmpiW (lpString1=".TLB", lpString2=".adobe") returned 1
	[0094.648] lstrlenW (lpString="MSTAG.TLB") returned 9
	[0094.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0094.675] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=13684) returned 1
	[0094.675] CloseHandle (hObject=0x1a0) returned 1
	[0094.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb")) returned 0x20
	[0094.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0094.722] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.722] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0094.767] GetLastError () returned 0x0
	[0094.767] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x3574, lpOverlapped=0x0) returned 1
	[0094.830] WriteFile (in: hFile=0x1cc, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x3580, lpOverlapped=0x0) returned 1
	[0094.832] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.832] WriteFile (in: hFile=0x1cc, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0094.832] SetEndOfFile (hFile=0x1cc) returned 1
	[0094.832] CloseHandle (hObject=0x1cc) returned 1
	[0094.832] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.832] SetEndOfFile (hFile=0x1a8) returned 1
	[0094.833] CloseHandle (hObject=0x1a8) returned 1
	[0094.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.834] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb")) returned 1
	[0094.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66
	[0094.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66
	[0094.834] lstrlenW (lpString=".doc") returned 4
	[0094.834] lstrcmpiW (lpString1=".doc", lpString2=".TLB") returned -1
	[0094.834] lstrlenW (lpString=".docx") returned 5
	[0094.834] lstrcmpiW (lpString1=".docx", lpString2="G.TLB") returned -1
	[0094.834] lstrlenW (lpString=".pdf") returned 4
	[0094.834] lstrcmpiW (lpString1=".pdf", lpString2=".TLB") returned -1
	[0094.834] lstrlenW (lpString=".xls") returned 4
	[0094.834] lstrcmpiW (lpString1=".xls", lpString2=".TLB") returned 1
	[0094.834] lstrlenW (lpString=".xlsx") returned 5
	[0094.834] lstrcmpiW (lpString1=".xlsx", lpString2="G.TLB") returned -1
	[0094.834] lstrlenW (lpString=".ppt") returned 4
	[0094.834] lstrcmpiW (lpString1=".ppt", lpString2=".TLB") returned -1
	[0094.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66
	[0094.834] lstrlenW (lpString=".zip") returned 4
	[0094.835] lstrcmpiW (lpString1=".zip", lpString2=".TLB") returned 1
	[0094.835] lstrlenW (lpString=".rar") returned 4
	[0094.835] lstrcmpiW (lpString1=".rar", lpString2=".TLB") returned -1
	[0094.835] lstrlenW (lpString=".bz2") returned 4
	[0094.835] lstrcmpiW (lpString1=".bz2", lpString2=".TLB") returned -1
	[0094.835] lstrlenW (lpString=".7z") returned 3
	[0094.835] lstrcmpiW (lpString1=".7z", lpString2="TLB") returned -1
	[0094.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66
	[0094.835] lstrlenW (lpString=".dbf") returned 4
	[0094.835] lstrcmpiW (lpString1=".dbf", lpString2=".TLB") returned -1
	[0094.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66
	[0094.835] lstrlenW (lpString=".1cd") returned 4
	[0094.835] lstrcmpiW (lpString1=".1cd", lpString2=".TLB") returned -1
	[0094.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66
	[0094.835] lstrlenW (lpString=".jpg") returned 4
	[0094.835] lstrcmpiW (lpString1=".jpg", lpString2=".TLB") returned -1
	[0094.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66
	[0094.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66
	[0094.835] lstrlenW (lpString=".doc") returned 4
	[0094.835] lstrcmpiW (lpString1=".doc", lpString2=".TLB") returned -1
	[0094.835] lstrlenW (lpString=".docx") returned 5
	[0094.835] lstrcmpiW (lpString1=".docx", lpString2="G.TLB") returned -1
	[0094.835] lstrlenW (lpString=".pdf") returned 4
	[0094.835] lstrcmpiW (lpString1=".pdf", lpString2=".TLB") returned -1
	[0094.835] lstrlenW (lpString=".xls") returned 4
	[0094.835] lstrcmpiW (lpString1=".xls", lpString2=".TLB") returned 1
	[0094.835] lstrlenW (lpString=".xlsx") returned 5
	[0094.835] lstrcmpiW (lpString1=".xlsx", lpString2="G.TLB") returned -1
	[0094.835] lstrlenW (lpString=".ppt") returned 4
	[0094.836] lstrcmpiW (lpString1=".ppt", lpString2=".TLB") returned -1
	[0094.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66
	[0094.836] lstrlenW (lpString=".zip") returned 4
	[0094.836] lstrcmpiW (lpString1=".zip", lpString2=".TLB") returned 1
	[0094.836] lstrlenW (lpString=".rar") returned 4
	[0094.836] lstrcmpiW (lpString1=".rar", lpString2=".TLB") returned -1
	[0094.836] lstrlenW (lpString=".bz2") returned 4
	[0094.836] lstrcmpiW (lpString1=".bz2", lpString2=".TLB") returned -1
	[0094.836] lstrlenW (lpString=".7z") returned 3
	[0094.836] lstrcmpiW (lpString1=".7z", lpString2="TLB") returned -1
	[0094.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66
	[0094.836] lstrlenW (lpString=".dbf") returned 4
	[0094.836] lstrcmpiW (lpString1=".dbf", lpString2=".TLB") returned -1
	[0094.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66
	[0094.836] lstrlenW (lpString=".1cd") returned 4
	[0094.836] lstrcmpiW (lpString1=".1cd", lpString2=".TLB") returned -1
	[0094.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66
	[0094.836] lstrlenW (lpString=".jpg") returned 4
	[0094.836] lstrcmpiW (lpString1=".jpg", lpString2=".TLB") returned -1
	[0094.836] lstrcmpiW (lpString1=".CNV", lpString2=".adobe") returned 1
	[0094.836] lstrlenW (lpString="WPFT632.CNV") returned 11
	[0094.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0094.837] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=289648) returned 1
	[0094.837] CloseHandle (hObject=0x1a8) returned 1
	[0094.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv")) returned 0x20
	[0094.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0094.838] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.838] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0094.839] GetLastError () returned 0x0
	[0094.839] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x46b70, lpOverlapped=0x0) returned 1
	[0094.905] WriteFile (in: hFile=0x1cc, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x46b80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x46b80, lpOverlapped=0x0) returned 1
	[0094.911] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.912] WriteFile (in: hFile=0x1cc, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0094.912] SetEndOfFile (hFile=0x1cc) returned 1
	[0094.912] CloseHandle (hObject=0x1cc) returned 1
	[0094.912] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.912] SetEndOfFile (hFile=0x1a8) returned 1
	[0094.916] CloseHandle (hObject=0x1a8) returned 1
	[0094.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.916] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv")) returned 1
	[0094.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67
	[0094.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67
	[0094.917] lstrlenW (lpString=".doc") returned 4
	[0094.917] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1
	[0094.917] lstrlenW (lpString=".docx") returned 5
	[0094.917] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1
	[0094.917] lstrlenW (lpString=".pdf") returned 4
	[0094.917] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1
	[0094.917] lstrlenW (lpString=".xls") returned 4
	[0094.917] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1
	[0094.917] lstrlenW (lpString=".xlsx") returned 5
	[0094.917] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1
	[0094.917] lstrlenW (lpString=".ppt") returned 4
	[0094.917] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1
	[0094.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67
	[0094.917] lstrlenW (lpString=".zip") returned 4
	[0094.917] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1
	[0094.917] lstrlenW (lpString=".rar") returned 4
	[0094.917] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1
	[0094.917] lstrlenW (lpString=".bz2") returned 4
	[0094.917] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1
	[0094.917] lstrlenW (lpString=".7z") returned 3
	[0094.917] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1
	[0094.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67
	[0094.917] lstrlenW (lpString=".dbf") returned 4
	[0094.918] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1
	[0094.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67
	[0094.918] lstrlenW (lpString=".1cd") returned 4
	[0094.918] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1
	[0094.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67
	[0094.918] lstrlenW (lpString=".jpg") returned 4
	[0094.918] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1
	[0094.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67
	[0094.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67
	[0094.918] lstrlenW (lpString=".doc") returned 4
	[0094.918] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1
	[0094.918] lstrlenW (lpString=".docx") returned 5
	[0094.918] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1
	[0094.918] lstrlenW (lpString=".pdf") returned 4
	[0094.918] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1
	[0094.918] lstrlenW (lpString=".xls") returned 4
	[0094.918] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1
	[0094.918] lstrlenW (lpString=".xlsx") returned 5
	[0094.918] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1
	[0094.918] lstrlenW (lpString=".ppt") returned 4
	[0094.918] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1
	[0094.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67
	[0094.918] lstrlenW (lpString=".zip") returned 4
	[0094.918] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1
	[0094.918] lstrlenW (lpString=".rar") returned 4
	[0094.918] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1
	[0094.919] lstrlenW (lpString=".bz2") returned 4
	[0094.919] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1
	[0094.919] lstrlenW (lpString=".7z") returned 3
	[0094.919] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1
	[0094.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67
	[0094.919] lstrlenW (lpString=".dbf") returned 4
	[0094.919] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1
	[0094.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67
	[0094.919] lstrlenW (lpString=".1cd") returned 4
	[0094.919] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1
	[0094.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67
	[0094.919] lstrlenW (lpString=".jpg") returned 4
	[0094.919] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1
	[0094.919] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0094.919] lstrlenW (lpString="ARCTIC.ELM") returned 10
	[0094.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0094.920] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=69575) returned 1
	[0094.920] CloseHandle (hObject=0x1a8) returned 1
	[0094.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm")) returned 0x20
	[0094.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0094.921] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.921] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0094.922] GetLastError () returned 0x0
	[0094.922] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x10fc7, lpOverlapped=0x0) returned 1
	[0094.958] WriteFile (in: hFile=0x1cc, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x10fd0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x10fd0, lpOverlapped=0x0) returned 1
	[0094.962] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.962] WriteFile (in: hFile=0x1cc, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0094.963] SetEndOfFile (hFile=0x1cc) returned 1
	[0094.963] CloseHandle (hObject=0x1cc) returned 1
	[0094.963] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.963] SetEndOfFile (hFile=0x1a8) returned 1
	[0094.965] CloseHandle (hObject=0x1a8) returned 1
	[0094.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.965] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm")) returned 1
	[0094.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73
	[0094.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73
	[0094.966] lstrlenW (lpString=".doc") returned 4
	[0094.966] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0094.966] lstrlenW (lpString=".docx") returned 5
	[0094.966] lstrcmpiW (lpString1=".docx", lpString2="C.ELM") returned -1
	[0094.966] lstrlenW (lpString=".pdf") returned 4
	[0094.966] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0094.966] lstrlenW (lpString=".xls") returned 4
	[0094.966] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0094.966] lstrlenW (lpString=".xlsx") returned 5
	[0094.966] lstrcmpiW (lpString1=".xlsx", lpString2="C.ELM") returned -1
	[0094.966] lstrlenW (lpString=".ppt") returned 4
	[0094.966] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0094.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73
	[0094.966] lstrlenW (lpString=".zip") returned 4
	[0094.966] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0094.966] lstrlenW (lpString=".rar") returned 4
	[0094.966] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0094.966] lstrlenW (lpString=".bz2") returned 4
	[0094.966] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0094.966] lstrlenW (lpString=".7z") returned 3
	[0094.966] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0094.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73
	[0094.966] lstrlenW (lpString=".dbf") returned 4
	[0094.966] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0094.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73
	[0094.966] lstrlenW (lpString=".1cd") returned 4
	[0094.967] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0094.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73
	[0094.967] lstrlenW (lpString=".jpg") returned 4
	[0094.967] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0094.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73
	[0094.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73
	[0094.967] lstrlenW (lpString=".doc") returned 4
	[0094.967] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0094.967] lstrlenW (lpString=".docx") returned 5
	[0094.967] lstrcmpiW (lpString1=".docx", lpString2="C.ELM") returned -1
	[0094.967] lstrlenW (lpString=".pdf") returned 4
	[0094.967] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0094.967] lstrlenW (lpString=".xls") returned 4
	[0094.967] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0094.967] lstrlenW (lpString=".xlsx") returned 5
	[0094.967] lstrcmpiW (lpString1=".xlsx", lpString2="C.ELM") returned -1
	[0094.967] lstrlenW (lpString=".ppt") returned 4
	[0094.967] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0094.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73
	[0094.967] lstrlenW (lpString=".zip") returned 4
	[0094.967] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0094.967] lstrlenW (lpString=".rar") returned 4
	[0094.967] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0094.967] lstrlenW (lpString=".bz2") returned 4
	[0094.967] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0094.967] lstrlenW (lpString=".7z") returned 3
	[0094.967] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0094.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73
	[0094.968] lstrlenW (lpString=".dbf") returned 4
	[0094.968] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0094.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73
	[0094.968] lstrlenW (lpString=".1cd") returned 4
	[0094.968] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0094.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73
	[0094.968] lstrlenW (lpString=".jpg") returned 4
	[0094.968] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0094.968] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0094.968] lstrlenW (lpString="AXIS.INF") returned 8
	[0094.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0094.971] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=529) returned 1
	[0094.971] CloseHandle (hObject=0x1cc) returned 1
	[0094.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf")) returned 0x20
	[0094.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0094.972] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.972] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0094.973] GetLastError () returned 0x0
	[0094.973] ReadFile (in: hFile=0x1cc, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x211, lpOverlapped=0x0) returned 1
	[0094.974] WriteFile (in: hFile=0x1c4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x220, lpOverlapped=0x0) returned 1
	[0094.975] ReadFile (in: hFile=0x1cc, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.975] WriteFile (in: hFile=0x1c4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0094.976] SetEndOfFile (hFile=0x1c4) returned 1
	[0094.976] CloseHandle (hObject=0x1c4) returned 1
	[0094.976] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.976] SetEndOfFile (hFile=0x1cc) returned 1
	[0094.977] CloseHandle (hObject=0x1cc) returned 1
	[0094.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.977] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf")) returned 1
	[0094.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69
	[0094.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69
	[0094.978] lstrlenW (lpString=".doc") returned 4
	[0094.978] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0094.978] lstrlenW (lpString=".docx") returned 5
	[0094.978] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0094.978] lstrlenW (lpString=".pdf") returned 4
	[0094.978] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0094.978] lstrlenW (lpString=".xls") returned 4
	[0094.978] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0094.978] lstrlenW (lpString=".xlsx") returned 5
	[0094.978] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0094.978] lstrlenW (lpString=".ppt") returned 4
	[0094.978] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0094.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69
	[0094.978] lstrlenW (lpString=".zip") returned 4
	[0094.979] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0094.979] lstrlenW (lpString=".rar") returned 4
	[0094.979] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0094.979] lstrlenW (lpString=".bz2") returned 4
	[0094.979] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0094.979] lstrlenW (lpString=".7z") returned 3
	[0094.979] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0094.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69
	[0094.979] lstrlenW (lpString=".dbf") returned 4
	[0094.979] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0094.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69
	[0094.979] lstrlenW (lpString=".1cd") returned 4
	[0094.979] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0094.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69
	[0094.979] lstrlenW (lpString=".jpg") returned 4
	[0094.979] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0094.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69
	[0094.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69
	[0094.979] lstrlenW (lpString=".doc") returned 4
	[0094.979] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0094.979] lstrlenW (lpString=".docx") returned 5
	[0094.979] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0094.979] lstrlenW (lpString=".pdf") returned 4
	[0094.979] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0094.979] lstrlenW (lpString=".xls") returned 4
	[0094.980] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0094.980] lstrlenW (lpString=".xlsx") returned 5
	[0094.980] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0094.980] lstrlenW (lpString=".ppt") returned 4
	[0094.980] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0094.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69
	[0094.980] lstrlenW (lpString=".zip") returned 4
	[0094.980] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0094.980] lstrlenW (lpString=".rar") returned 4
	[0094.980] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0094.980] lstrlenW (lpString=".bz2") returned 4
	[0094.980] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0094.980] lstrlenW (lpString=".7z") returned 3
	[0094.980] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0094.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69
	[0094.980] lstrlenW (lpString=".dbf") returned 4
	[0094.980] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0094.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69
	[0094.980] lstrlenW (lpString=".1cd") returned 4
	[0094.980] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0094.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69
	[0094.980] lstrlenW (lpString=".jpg") returned 4
	[0094.980] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0094.981] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0094.981] lstrlenW (lpString="BLENDS.ELM") returned 10
	[0094.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0094.982] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=69047) returned 1
	[0094.982] CloseHandle (hObject=0x1cc) returned 1
	[0094.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm")) returned 0x20
	[0094.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0094.982] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.983] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0094.983] GetLastError () returned 0x0
	[0094.983] ReadFile (in: hFile=0x1cc, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x10db7, lpOverlapped=0x0) returned 1
	[0095.070] WriteFile (in: hFile=0x1c4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x10dc0, lpOverlapped=0x0) returned 1
	[0095.072] ReadFile (in: hFile=0x1cc, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.072] WriteFile (in: hFile=0x1c4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0095.072] SetEndOfFile (hFile=0x1c4) returned 1
	[0095.073] CloseHandle (hObject=0x1c4) returned 1
	[0095.073] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.073] SetEndOfFile (hFile=0x1cc) returned 1
	[0095.075] CloseHandle (hObject=0x1cc) returned 1
	[0095.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.075] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm")) returned 1
	[0095.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73
	[0095.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73
	[0095.076] lstrlenW (lpString=".doc") returned 4
	[0095.076] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.076] lstrlenW (lpString=".docx") returned 5
	[0095.077] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1
	[0095.077] lstrlenW (lpString=".pdf") returned 4
	[0095.077] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.077] lstrlenW (lpString=".xls") returned 4
	[0095.077] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.077] lstrlenW (lpString=".xlsx") returned 5
	[0095.077] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1
	[0095.077] lstrlenW (lpString=".ppt") returned 4
	[0095.077] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73
	[0095.077] lstrlenW (lpString=".zip") returned 4
	[0095.077] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.077] lstrlenW (lpString=".rar") returned 4
	[0095.077] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.077] lstrlenW (lpString=".bz2") returned 4
	[0095.077] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.077] lstrlenW (lpString=".7z") returned 3
	[0095.077] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73
	[0095.077] lstrlenW (lpString=".dbf") returned 4
	[0095.077] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73
	[0095.077] lstrlenW (lpString=".1cd") returned 4
	[0095.077] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73
	[0095.077] lstrlenW (lpString=".jpg") returned 4
	[0095.077] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73
	[0095.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73
	[0095.078] lstrlenW (lpString=".doc") returned 4
	[0095.078] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.078] lstrlenW (lpString=".docx") returned 5
	[0095.078] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1
	[0095.078] lstrlenW (lpString=".pdf") returned 4
	[0095.078] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.078] lstrlenW (lpString=".xls") returned 4
	[0095.078] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.078] lstrlenW (lpString=".xlsx") returned 5
	[0095.078] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1
	[0095.078] lstrlenW (lpString=".ppt") returned 4
	[0095.078] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73
	[0095.078] lstrlenW (lpString=".zip") returned 4
	[0095.078] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.078] lstrlenW (lpString=".rar") returned 4
	[0095.078] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.078] lstrlenW (lpString=".bz2") returned 4
	[0095.078] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.078] lstrlenW (lpString=".7z") returned 3
	[0095.078] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73
	[0095.078] lstrlenW (lpString=".dbf") returned 4
	[0095.078] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73
	[0095.078] lstrlenW (lpString=".1cd") returned 4
	[0095.079] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73
	[0095.079] lstrlenW (lpString=".jpg") returned 4
	[0095.079] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.079] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.079] lstrlenW (lpString="BLUECALM.ELM") returned 12
	[0095.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0095.080] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=49850) returned 1
	[0095.080] CloseHandle (hObject=0x1cc) returned 1
	[0095.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm")) returned 0x20
	[0095.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0095.081] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.081] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0095.081] GetLastError () returned 0x0
	[0095.081] ReadFile (in: hFile=0x1cc, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xc2ba, lpOverlapped=0x0) returned 1
	[0095.114] WriteFile (in: hFile=0x1c4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc2c0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xc2c0, lpOverlapped=0x0) returned 1
	[0095.117] ReadFile (in: hFile=0x1cc, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.117] WriteFile (in: hFile=0x1c4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.117] SetEndOfFile (hFile=0x1c4) returned 1
	[0095.117] CloseHandle (hObject=0x1c4) returned 1
	[0095.117] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.118] SetEndOfFile (hFile=0x1cc) returned 1
	[0095.119] CloseHandle (hObject=0x1cc) returned 1
	[0095.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.119] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm")) returned 1
	[0095.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77
	[0095.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77
	[0095.120] lstrlenW (lpString=".doc") returned 4
	[0095.120] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.120] lstrlenW (lpString=".docx") returned 5
	[0095.120] lstrcmpiW (lpString1=".docx", lpString2="M.ELM") returned -1
	[0095.120] lstrlenW (lpString=".pdf") returned 4
	[0095.120] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.120] lstrlenW (lpString=".xls") returned 4
	[0095.120] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.120] lstrlenW (lpString=".xlsx") returned 5
	[0095.120] lstrcmpiW (lpString1=".xlsx", lpString2="M.ELM") returned -1
	[0095.120] lstrlenW (lpString=".ppt") returned 4
	[0095.120] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77
	[0095.120] lstrlenW (lpString=".zip") returned 4
	[0095.120] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.120] lstrlenW (lpString=".rar") returned 4
	[0095.120] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.120] lstrlenW (lpString=".bz2") returned 4
	[0095.120] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.120] lstrlenW (lpString=".7z") returned 3
	[0095.120] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77
	[0095.120] lstrlenW (lpString=".dbf") returned 4
	[0095.120] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77
	[0095.121] lstrlenW (lpString=".1cd") returned 4
	[0095.121] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77
	[0095.121] lstrlenW (lpString=".jpg") returned 4
	[0095.121] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77
	[0095.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77
	[0095.121] lstrlenW (lpString=".doc") returned 4
	[0095.121] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.121] lstrlenW (lpString=".docx") returned 5
	[0095.121] lstrcmpiW (lpString1=".docx", lpString2="M.ELM") returned -1
	[0095.121] lstrlenW (lpString=".pdf") returned 4
	[0095.121] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.121] lstrlenW (lpString=".xls") returned 4
	[0095.121] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.121] lstrlenW (lpString=".xlsx") returned 5
	[0095.121] lstrcmpiW (lpString1=".xlsx", lpString2="M.ELM") returned -1
	[0095.121] lstrlenW (lpString=".ppt") returned 4
	[0095.121] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77
	[0095.121] lstrlenW (lpString=".zip") returned 4
	[0095.121] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.121] lstrlenW (lpString=".rar") returned 4
	[0095.121] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.121] lstrlenW (lpString=".bz2") returned 4
	[0095.121] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.121] lstrlenW (lpString=".7z") returned 3
	[0095.122] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77
	[0095.122] lstrlenW (lpString=".dbf") returned 4
	[0095.122] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77
	[0095.122] lstrlenW (lpString=".1cd") returned 4
	[0095.122] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77
	[0095.122] lstrlenW (lpString=".jpg") returned 4
	[0095.122] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.122] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.122] lstrlenW (lpString="BLUEPRNT.INF") returned 12
	[0095.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0095.140] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=549) returned 1
	[0095.140] CloseHandle (hObject=0x198) returned 1
	[0095.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf")) returned 0x20
	[0095.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0095.141] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.141] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.141] GetLastError () returned 0x0
	[0095.141] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x225, lpOverlapped=0x0) returned 1
	[0095.143] WriteFile (in: hFile=0x1c8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x230, lpOverlapped=0x0) returned 1
	[0095.144] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.144] WriteFile (in: hFile=0x1c8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.144] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.144] CloseHandle (hObject=0x1c8) returned 1
	[0095.145] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.145] SetEndOfFile (hFile=0x198) returned 1
	[0095.146] CloseHandle (hObject=0x198) returned 1
	[0095.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.146] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf")) returned 1
	[0095.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77
	[0095.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77
	[0095.147] lstrlenW (lpString=".doc") returned 4
	[0095.147] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.147] lstrlenW (lpString=".docx") returned 5
	[0095.147] lstrcmpiW (lpString1=".docx", lpString2="T.INF") returned -1
	[0095.147] lstrlenW (lpString=".pdf") returned 4
	[0095.147] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.147] lstrlenW (lpString=".xls") returned 4
	[0095.147] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.147] lstrlenW (lpString=".xlsx") returned 5
	[0095.147] lstrcmpiW (lpString1=".xlsx", lpString2="T.INF") returned -1
	[0095.147] lstrlenW (lpString=".ppt") returned 4
	[0095.147] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77
	[0095.147] lstrlenW (lpString=".zip") returned 4
	[0095.147] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.147] lstrlenW (lpString=".rar") returned 4
	[0095.147] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.147] lstrlenW (lpString=".bz2") returned 4
	[0095.148] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.148] lstrlenW (lpString=".7z") returned 3
	[0095.148] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77
	[0095.148] lstrlenW (lpString=".dbf") returned 4
	[0095.148] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77
	[0095.148] lstrlenW (lpString=".1cd") returned 4
	[0095.148] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77
	[0095.148] lstrlenW (lpString=".jpg") returned 4
	[0095.148] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77
	[0095.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77
	[0095.148] lstrlenW (lpString=".doc") returned 4
	[0095.148] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.148] lstrlenW (lpString=".docx") returned 5
	[0095.148] lstrcmpiW (lpString1=".docx", lpString2="T.INF") returned -1
	[0095.148] lstrlenW (lpString=".pdf") returned 4
	[0095.148] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.148] lstrlenW (lpString=".xls") returned 4
	[0095.148] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.148] lstrlenW (lpString=".xlsx") returned 5
	[0095.148] lstrcmpiW (lpString1=".xlsx", lpString2="T.INF") returned -1
	[0095.148] lstrlenW (lpString=".ppt") returned 4
	[0095.148] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77
	[0095.149] lstrlenW (lpString=".zip") returned 4
	[0095.149] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.149] lstrlenW (lpString=".rar") returned 4
	[0095.149] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.149] lstrlenW (lpString=".bz2") returned 4
	[0095.149] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.149] lstrlenW (lpString=".7z") returned 3
	[0095.149] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77
	[0095.149] lstrlenW (lpString=".dbf") returned 4
	[0095.149] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77
	[0095.149] lstrlenW (lpString=".1cd") returned 4
	[0095.149] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77
	[0095.149] lstrlenW (lpString=".jpg") returned 4
	[0095.149] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.149] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.150] lstrlenW (lpString="BOLDSTRI.INF") returned 12
	[0095.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0095.150] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=596) returned 1
	[0095.150] CloseHandle (hObject=0x198) returned 1
	[0095.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 0x20
	[0095.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0095.151] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.151] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.152] GetLastError () returned 0x0
	[0095.152] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x254, lpOverlapped=0x0) returned 1
	[0095.153] WriteFile (in: hFile=0x1c8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x260, lpOverlapped=0x0) returned 1
	[0095.155] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.155] WriteFile (in: hFile=0x1c8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.155] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.155] CloseHandle (hObject=0x1c8) returned 1
	[0095.155] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.155] SetEndOfFile (hFile=0x198) returned 1
	[0095.156] CloseHandle (hObject=0x198) returned 1
	[0095.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.157] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 1
	[0095.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77
	[0095.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77
	[0095.157] lstrlenW (lpString=".doc") returned 4
	[0095.157] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.157] lstrlenW (lpString=".docx") returned 5
	[0095.157] lstrcmpiW (lpString1=".docx", lpString2="I.INF") returned -1
	[0095.157] lstrlenW (lpString=".pdf") returned 4
	[0095.157] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.157] lstrlenW (lpString=".xls") returned 4
	[0095.157] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.157] lstrlenW (lpString=".xlsx") returned 5
	[0095.157] lstrcmpiW (lpString1=".xlsx", lpString2="I.INF") returned -1
	[0095.157] lstrlenW (lpString=".ppt") returned 4
	[0095.157] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77
	[0095.157] lstrlenW (lpString=".zip") returned 4
	[0095.157] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.157] lstrlenW (lpString=".rar") returned 4
	[0095.158] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.158] lstrlenW (lpString=".bz2") returned 4
	[0095.158] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.158] lstrlenW (lpString=".7z") returned 3
	[0095.158] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77
	[0095.158] lstrlenW (lpString=".dbf") returned 4
	[0095.158] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77
	[0095.158] lstrlenW (lpString=".1cd") returned 4
	[0095.158] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77
	[0095.158] lstrlenW (lpString=".jpg") returned 4
	[0095.158] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77
	[0095.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77
	[0095.158] lstrlenW (lpString=".doc") returned 4
	[0095.158] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.158] lstrlenW (lpString=".docx") returned 5
	[0095.158] lstrcmpiW (lpString1=".docx", lpString2="I.INF") returned -1
	[0095.158] lstrlenW (lpString=".pdf") returned 4
	[0095.158] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.158] lstrlenW (lpString=".xls") returned 4
	[0095.158] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.159] lstrlenW (lpString=".xlsx") returned 5
	[0095.159] lstrcmpiW (lpString1=".xlsx", lpString2="I.INF") returned -1
	[0095.159] lstrlenW (lpString=".ppt") returned 4
	[0095.159] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77
	[0095.159] lstrlenW (lpString=".zip") returned 4
	[0095.159] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.159] lstrlenW (lpString=".rar") returned 4
	[0095.159] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.159] lstrlenW (lpString=".bz2") returned 4
	[0095.159] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.159] lstrlenW (lpString=".7z") returned 3
	[0095.159] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77
	[0095.159] lstrlenW (lpString=".dbf") returned 4
	[0095.159] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77
	[0095.159] lstrlenW (lpString=".1cd") returned 4
	[0095.159] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77
	[0095.159] lstrlenW (lpString=".jpg") returned 4
	[0095.159] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.159] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.160] lstrlenW (lpString="BREEZE.ELM") returned 10
	[0095.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0095.160] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=107831) returned 1
	[0095.160] CloseHandle (hObject=0x198) returned 1
	[0095.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm")) returned 0x20
	[0095.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0095.161] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.161] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.162] GetLastError () returned 0x0
	[0095.162] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x1a537, lpOverlapped=0x0) returned 1
	[0095.196] WriteFile (in: hFile=0x1c8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x1a540, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x1a540, lpOverlapped=0x0) returned 1
	[0095.200] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.200] WriteFile (in: hFile=0x1c8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0095.200] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.200] CloseHandle (hObject=0x1c8) returned 1
	[0095.200] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.201] SetEndOfFile (hFile=0x198) returned 1
	[0095.202] CloseHandle (hObject=0x198) returned 1
	[0095.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.202] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm")) returned 1
	[0095.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73
	[0095.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73
	[0095.209] lstrlenW (lpString=".doc") returned 4
	[0095.209] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.209] lstrlenW (lpString=".docx") returned 5
	[0095.209] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.209] lstrlenW (lpString=".pdf") returned 4
	[0095.209] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.209] lstrlenW (lpString=".xls") returned 4
	[0095.209] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.209] lstrlenW (lpString=".xlsx") returned 5
	[0095.209] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.209] lstrlenW (lpString=".ppt") returned 4
	[0095.209] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73
	[0095.209] lstrlenW (lpString=".zip") returned 4
	[0095.209] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.209] lstrlenW (lpString=".rar") returned 4
	[0095.209] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.209] lstrlenW (lpString=".bz2") returned 4
	[0095.209] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.209] lstrlenW (lpString=".7z") returned 3
	[0095.209] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73
	[0095.209] lstrlenW (lpString=".dbf") returned 4
	[0095.209] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73
	[0095.210] lstrlenW (lpString=".1cd") returned 4
	[0095.210] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73
	[0095.210] lstrlenW (lpString=".jpg") returned 4
	[0095.210] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73
	[0095.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73
	[0095.210] lstrlenW (lpString=".doc") returned 4
	[0095.210] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.210] lstrlenW (lpString=".docx") returned 5
	[0095.210] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.210] lstrlenW (lpString=".pdf") returned 4
	[0095.210] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.210] lstrlenW (lpString=".xls") returned 4
	[0095.210] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.210] lstrlenW (lpString=".xlsx") returned 5
	[0095.210] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.210] lstrlenW (lpString=".ppt") returned 4
	[0095.210] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73
	[0095.210] lstrlenW (lpString=".zip") returned 4
	[0095.210] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.210] lstrlenW (lpString=".rar") returned 4
	[0095.210] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.210] lstrlenW (lpString=".bz2") returned 4
	[0095.211] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.211] lstrlenW (lpString=".7z") returned 3
	[0095.211] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73
	[0095.211] lstrlenW (lpString=".dbf") returned 4
	[0095.211] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73
	[0095.211] lstrlenW (lpString=".1cd") returned 4
	[0095.211] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73
	[0095.211] lstrlenW (lpString=".jpg") returned 4
	[0095.211] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.211] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.211] lstrlenW (lpString="CAPSULES.ELM") returned 12
	[0095.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.255] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=57786) returned 1
	[0095.255] CloseHandle (hObject=0x1a0) returned 1
	[0095.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm")) returned 0x20
	[0095.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.276] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.276] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0095.294] GetLastError () returned 0x0
	[0095.294] ReadFile (in: hFile=0x19c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xe1ba, lpOverlapped=0x0) returned 1
	[0095.313] WriteFile (in: hFile=0x198, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe1c0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe1c0, lpOverlapped=0x0) returned 1
	[0095.314] ReadFile (in: hFile=0x19c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.315] WriteFile (in: hFile=0x198, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.315] SetEndOfFile (hFile=0x198) returned 1
	[0095.315] CloseHandle (hObject=0x198) returned 1
	[0095.315] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.315] SetEndOfFile (hFile=0x19c) returned 1
	[0095.316] CloseHandle (hObject=0x19c) returned 1
	[0095.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.317] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm")) returned 1
	[0095.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77
	[0095.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77
	[0095.317] lstrlenW (lpString=".doc") returned 4
	[0095.317] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.317] lstrlenW (lpString=".docx") returned 5
	[0095.317] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1
	[0095.317] lstrlenW (lpString=".pdf") returned 4
	[0095.317] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.317] lstrlenW (lpString=".xls") returned 4
	[0095.317] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.317] lstrlenW (lpString=".xlsx") returned 5
	[0095.317] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1
	[0095.317] lstrlenW (lpString=".ppt") returned 4
	[0095.317] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77
	[0095.317] lstrlenW (lpString=".zip") returned 4
	[0095.317] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.317] lstrlenW (lpString=".rar") returned 4
	[0095.317] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.317] lstrlenW (lpString=".bz2") returned 4
	[0095.317] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.317] lstrlenW (lpString=".7z") returned 3
	[0095.317] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77
	[0095.318] lstrlenW (lpString=".dbf") returned 4
	[0095.318] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77
	[0095.318] lstrlenW (lpString=".1cd") returned 4
	[0095.318] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77
	[0095.318] lstrlenW (lpString=".jpg") returned 4
	[0095.318] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77
	[0095.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77
	[0095.318] lstrlenW (lpString=".doc") returned 4
	[0095.318] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.318] lstrlenW (lpString=".docx") returned 5
	[0095.318] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1
	[0095.318] lstrlenW (lpString=".pdf") returned 4
	[0095.318] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.318] lstrlenW (lpString=".xls") returned 4
	[0095.319] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.319] lstrlenW (lpString=".xlsx") returned 5
	[0095.319] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1
	[0095.319] lstrlenW (lpString=".ppt") returned 4
	[0095.319] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77
	[0095.319] lstrlenW (lpString=".zip") returned 4
	[0095.319] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.319] lstrlenW (lpString=".rar") returned 4
	[0095.319] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.319] lstrlenW (lpString=".bz2") returned 4
	[0095.319] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.319] lstrlenW (lpString=".7z") returned 3
	[0095.319] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77
	[0095.319] lstrlenW (lpString=".dbf") returned 4
	[0095.319] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77
	[0095.319] lstrlenW (lpString=".1cd") returned 4
	[0095.319] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77
	[0095.319] lstrlenW (lpString=".jpg") returned 4
	[0095.319] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.320] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.320] lstrlenW (lpString="CONCRETE.INF") returned 12
	[0095.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.374] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=480) returned 1
	[0095.375] CloseHandle (hObject=0x188) returned 1
	[0095.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf")) returned 0x20
	[0095.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.375] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.375] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.376] GetLastError () returned 0x0
	[0095.376] ReadFile (in: hFile=0x188, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x1e0, lpOverlapped=0x0) returned 1
	[0095.377] WriteFile (in: hFile=0x1a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x1f0, lpOverlapped=0x0) returned 1
	[0095.378] ReadFile (in: hFile=0x188, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.378] WriteFile (in: hFile=0x1a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.378] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.378] CloseHandle (hObject=0x1a8) returned 1
	[0095.378] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.378] SetEndOfFile (hFile=0x188) returned 1
	[0095.379] CloseHandle (hObject=0x188) returned 1
	[0095.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.379] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf")) returned 1
	[0095.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77
	[0095.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77
	[0095.380] lstrlenW (lpString=".doc") returned 4
	[0095.380] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.380] lstrlenW (lpString=".docx") returned 5
	[0095.380] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.380] lstrlenW (lpString=".pdf") returned 4
	[0095.380] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.380] lstrlenW (lpString=".xls") returned 4
	[0095.380] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.380] lstrlenW (lpString=".xlsx") returned 5
	[0095.380] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.380] lstrlenW (lpString=".ppt") returned 4
	[0095.380] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77
	[0095.380] lstrlenW (lpString=".zip") returned 4
	[0095.380] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.380] lstrlenW (lpString=".rar") returned 4
	[0095.380] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.380] lstrlenW (lpString=".bz2") returned 4
	[0095.380] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.380] lstrlenW (lpString=".7z") returned 3
	[0095.380] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77
	[0095.380] lstrlenW (lpString=".dbf") returned 4
	[0095.380] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77
	[0095.380] lstrlenW (lpString=".1cd") returned 4
	[0095.380] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77
	[0095.380] lstrlenW (lpString=".jpg") returned 4
	[0095.380] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77
	[0095.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77
	[0095.381] lstrlenW (lpString=".doc") returned 4
	[0095.381] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.381] lstrlenW (lpString=".docx") returned 5
	[0095.381] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.381] lstrlenW (lpString=".pdf") returned 4
	[0095.381] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.381] lstrlenW (lpString=".xls") returned 4
	[0095.381] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.381] lstrlenW (lpString=".xlsx") returned 5
	[0095.381] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.381] lstrlenW (lpString=".ppt") returned 4
	[0095.381] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77
	[0095.381] lstrlenW (lpString=".zip") returned 4
	[0095.381] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.381] lstrlenW (lpString=".rar") returned 4
	[0095.381] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.381] lstrlenW (lpString=".bz2") returned 4
	[0095.381] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.381] lstrlenW (lpString=".7z") returned 3
	[0095.381] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77
	[0095.381] lstrlenW (lpString=".dbf") returned 4
	[0095.381] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77
	[0095.381] lstrlenW (lpString=".1cd") returned 4
	[0095.381] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77
	[0095.381] lstrlenW (lpString=".jpg") returned 4
	[0095.381] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.382] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.382] lstrlenW (lpString="EDGE.ELM") returned 8
	[0095.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.382] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=47352) returned 1
	[0095.382] CloseHandle (hObject=0x188) returned 1
	[0095.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm")) returned 0x20
	[0095.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.383] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.383] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.384] GetLastError () returned 0x0
	[0095.384] ReadFile (in: hFile=0x188, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xb8f8, lpOverlapped=0x0) returned 1
	[0095.418] WriteFile (in: hFile=0x1a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xb900, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xb900, lpOverlapped=0x0) returned 1
	[0095.420] ReadFile (in: hFile=0x188, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.420] WriteFile (in: hFile=0x1a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0095.420] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.420] CloseHandle (hObject=0x1a8) returned 1
	[0095.420] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.420] SetEndOfFile (hFile=0x188) returned 1
	[0095.421] CloseHandle (hObject=0x188) returned 1
	[0095.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.422] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm")) returned 1
	[0095.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69
	[0095.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69
	[0095.422] lstrlenW (lpString=".doc") returned 4
	[0095.422] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.422] lstrlenW (lpString=".docx") returned 5
	[0095.422] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.422] lstrlenW (lpString=".pdf") returned 4
	[0095.422] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.422] lstrlenW (lpString=".xls") returned 4
	[0095.422] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.422] lstrlenW (lpString=".xlsx") returned 5
	[0095.422] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.422] lstrlenW (lpString=".ppt") returned 4
	[0095.422] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69
	[0095.422] lstrlenW (lpString=".zip") returned 4
	[0095.422] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.422] lstrlenW (lpString=".rar") returned 4
	[0095.422] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.422] lstrlenW (lpString=".bz2") returned 4
	[0095.422] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.423] lstrlenW (lpString=".7z") returned 3
	[0095.423] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69
	[0095.423] lstrlenW (lpString=".dbf") returned 4
	[0095.423] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69
	[0095.423] lstrlenW (lpString=".1cd") returned 4
	[0095.423] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69
	[0095.423] lstrlenW (lpString=".jpg") returned 4
	[0095.423] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69
	[0095.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69
	[0095.423] lstrlenW (lpString=".doc") returned 4
	[0095.423] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.423] lstrlenW (lpString=".docx") returned 5
	[0095.423] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.423] lstrlenW (lpString=".pdf") returned 4
	[0095.423] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.423] lstrlenW (lpString=".xls") returned 4
	[0095.423] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.423] lstrlenW (lpString=".xlsx") returned 5
	[0095.423] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.423] lstrlenW (lpString=".ppt") returned 4
	[0095.423] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69
	[0095.423] lstrlenW (lpString=".zip") returned 4
	[0095.423] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.423] lstrlenW (lpString=".rar") returned 4
	[0095.423] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.423] lstrlenW (lpString=".bz2") returned 4
	[0095.423] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.423] lstrlenW (lpString=".7z") returned 3
	[0095.424] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69
	[0095.424] lstrlenW (lpString=".dbf") returned 4
	[0095.424] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69
	[0095.424] lstrlenW (lpString=".1cd") returned 4
	[0095.424] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69
	[0095.424] lstrlenW (lpString=".jpg") returned 4
	[0095.424] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.424] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.424] lstrlenW (lpString="EVRGREEN.INF") returned 12
	[0095.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.456] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=547) returned 1
	[0095.456] CloseHandle (hObject=0x188) returned 1
	[0095.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf")) returned 0x20
	[0095.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.457] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.457] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.457] GetLastError () returned 0x0
	[0095.457] ReadFile (in: hFile=0x188, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x223, lpOverlapped=0x0) returned 1
	[0095.458] WriteFile (in: hFile=0x1a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x230, lpOverlapped=0x0) returned 1
	[0095.460] ReadFile (in: hFile=0x188, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.460] WriteFile (in: hFile=0x1a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.460] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.460] CloseHandle (hObject=0x1a8) returned 1
	[0095.460] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.460] SetEndOfFile (hFile=0x188) returned 1
	[0095.461] CloseHandle (hObject=0x188) returned 1
	[0095.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.462] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf")) returned 1
	[0095.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77
	[0095.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77
	[0095.462] lstrlenW (lpString=".doc") returned 4
	[0095.462] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.462] lstrlenW (lpString=".docx") returned 5
	[0095.462] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1
	[0095.462] lstrlenW (lpString=".pdf") returned 4
	[0095.462] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.462] lstrlenW (lpString=".xls") returned 4
	[0095.462] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.462] lstrlenW (lpString=".xlsx") returned 5
	[0095.462] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1
	[0095.462] lstrlenW (lpString=".ppt") returned 4
	[0095.462] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77
	[0095.462] lstrlenW (lpString=".zip") returned 4
	[0095.462] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.462] lstrlenW (lpString=".rar") returned 4
	[0095.462] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.462] lstrlenW (lpString=".bz2") returned 4
	[0095.463] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.463] lstrlenW (lpString=".7z") returned 3
	[0095.463] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77
	[0095.463] lstrlenW (lpString=".dbf") returned 4
	[0095.463] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77
	[0095.463] lstrlenW (lpString=".1cd") returned 4
	[0095.463] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77
	[0095.463] lstrlenW (lpString=".jpg") returned 4
	[0095.463] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77
	[0095.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77
	[0095.463] lstrlenW (lpString=".doc") returned 4
	[0095.463] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.463] lstrlenW (lpString=".docx") returned 5
	[0095.463] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1
	[0095.463] lstrlenW (lpString=".pdf") returned 4
	[0095.463] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.463] lstrlenW (lpString=".xls") returned 4
	[0095.463] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.463] lstrlenW (lpString=".xlsx") returned 5
	[0095.463] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1
	[0095.463] lstrlenW (lpString=".ppt") returned 4
	[0095.463] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77
	[0095.464] lstrlenW (lpString=".zip") returned 4
	[0095.464] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.464] lstrlenW (lpString=".rar") returned 4
	[0095.464] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.464] lstrlenW (lpString=".bz2") returned 4
	[0095.464] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.464] lstrlenW (lpString=".7z") returned 3
	[0095.464] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77
	[0095.464] lstrlenW (lpString=".dbf") returned 4
	[0095.464] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77
	[0095.464] lstrlenW (lpString=".1cd") returned 4
	[0095.464] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77
	[0095.464] lstrlenW (lpString=".jpg") returned 4
	[0095.464] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.464] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.464] lstrlenW (lpString="ICE.INF") returned 7
	[0095.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.500] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=429) returned 1
	[0095.500] CloseHandle (hObject=0x188) returned 1
	[0095.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf")) returned 0x20
	[0095.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.515] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.515] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.520] GetLastError () returned 0x0
	[0095.520] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x1ad, lpOverlapped=0x0) returned 1
	[0095.521] WriteFile (in: hFile=0x19c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x1b0, lpOverlapped=0x0) returned 1
	[0095.522] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.522] WriteFile (in: hFile=0x19c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0095.522] SetEndOfFile (hFile=0x19c) returned 1
	[0095.523] CloseHandle (hObject=0x19c) returned 1
	[0095.523] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.523] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.524] CloseHandle (hObject=0x1a8) returned 1
	[0095.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.524] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf")) returned 1
	[0095.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67
	[0095.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67
	[0095.525] lstrlenW (lpString=".doc") returned 4
	[0095.525] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.525] lstrlenW (lpString=".docx") returned 5
	[0095.525] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.525] lstrlenW (lpString=".pdf") returned 4
	[0095.525] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.525] lstrlenW (lpString=".xls") returned 4
	[0095.525] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.525] lstrlenW (lpString=".xlsx") returned 5
	[0095.525] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.525] lstrlenW (lpString=".ppt") returned 4
	[0095.525] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67
	[0095.525] lstrlenW (lpString=".zip") returned 4
	[0095.525] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.525] lstrlenW (lpString=".rar") returned 4
	[0095.525] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.525] lstrlenW (lpString=".bz2") returned 4
	[0095.525] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.525] lstrlenW (lpString=".7z") returned 3
	[0095.526] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67
	[0095.526] lstrlenW (lpString=".dbf") returned 4
	[0095.526] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67
	[0095.526] lstrlenW (lpString=".1cd") returned 4
	[0095.526] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67
	[0095.526] lstrlenW (lpString=".jpg") returned 4
	[0095.526] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67
	[0095.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67
	[0095.526] lstrlenW (lpString=".doc") returned 4
	[0095.526] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.526] lstrlenW (lpString=".docx") returned 5
	[0095.526] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.526] lstrlenW (lpString=".pdf") returned 4
	[0095.526] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.526] lstrlenW (lpString=".xls") returned 4
	[0095.526] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.526] lstrlenW (lpString=".xlsx") returned 5
	[0095.526] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.526] lstrlenW (lpString=".ppt") returned 4
	[0095.526] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67
	[0095.526] lstrlenW (lpString=".zip") returned 4
	[0095.527] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.527] lstrlenW (lpString=".rar") returned 4
	[0095.527] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.527] lstrlenW (lpString=".bz2") returned 4
	[0095.527] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.527] lstrlenW (lpString=".7z") returned 3
	[0095.527] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67
	[0095.527] lstrlenW (lpString=".dbf") returned 4
	[0095.527] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67
	[0095.527] lstrlenW (lpString=".1cd") returned 4
	[0095.527] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67
	[0095.527] lstrlenW (lpString=".jpg") returned 4
	[0095.527] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.527] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.527] lstrlenW (lpString="JOURNAL.ELM") returned 11
	[0095.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.567] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=47666) returned 1
	[0095.568] CloseHandle (hObject=0x1a8) returned 1
	[0095.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm")) returned 0x20
	[0095.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0095.704] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.704] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.716] GetLastError () returned 0x0
	[0095.716] ReadFile (in: hFile=0x1a4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xba32, lpOverlapped=0x0) returned 1
	[0095.725] WriteFile (in: hFile=0x190, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xba40, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xba40, lpOverlapped=0x0) returned 1
	[0095.726] ReadFile (in: hFile=0x1a4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.726] WriteFile (in: hFile=0x190, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.726] SetEndOfFile (hFile=0x190) returned 1
	[0095.727] CloseHandle (hObject=0x190) returned 1
	[0095.727] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.727] SetEndOfFile (hFile=0x1a4) returned 1
	[0095.728] CloseHandle (hObject=0x1a4) returned 1
	[0095.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.728] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm")) returned 1
	[0095.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75
	[0095.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75
	[0095.728] lstrlenW (lpString=".doc") returned 4
	[0095.728] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.729] lstrlenW (lpString=".docx") returned 5
	[0095.729] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1
	[0095.729] lstrlenW (lpString=".pdf") returned 4
	[0095.729] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.729] lstrlenW (lpString=".xls") returned 4
	[0095.729] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.729] lstrlenW (lpString=".xlsx") returned 5
	[0095.729] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1
	[0095.729] lstrlenW (lpString=".ppt") returned 4
	[0095.729] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75
	[0095.729] lstrlenW (lpString=".zip") returned 4
	[0095.729] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.729] lstrlenW (lpString=".rar") returned 4
	[0095.729] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.729] lstrlenW (lpString=".bz2") returned 4
	[0095.729] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.729] lstrlenW (lpString=".7z") returned 3
	[0095.729] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75
	[0095.729] lstrlenW (lpString=".dbf") returned 4
	[0095.729] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75
	[0095.729] lstrlenW (lpString=".1cd") returned 4
	[0095.729] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75
	[0095.729] lstrlenW (lpString=".jpg") returned 4
	[0095.729] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75
	[0095.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75
	[0095.729] lstrlenW (lpString=".doc") returned 4
	[0095.729] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.729] lstrlenW (lpString=".docx") returned 5
	[0095.730] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1
	[0095.730] lstrlenW (lpString=".pdf") returned 4
	[0095.730] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.730] lstrlenW (lpString=".xls") returned 4
	[0095.730] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.730] lstrlenW (lpString=".xlsx") returned 5
	[0095.730] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1
	[0095.730] lstrlenW (lpString=".ppt") returned 4
	[0095.730] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75
	[0095.730] lstrlenW (lpString=".zip") returned 4
	[0095.730] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.730] lstrlenW (lpString=".rar") returned 4
	[0095.730] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.730] lstrlenW (lpString=".bz2") returned 4
	[0095.730] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.730] lstrlenW (lpString=".7z") returned 3
	[0095.730] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75
	[0095.730] lstrlenW (lpString=".dbf") returned 4
	[0095.730] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75
	[0095.730] lstrlenW (lpString=".1cd") returned 4
	[0095.730] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75
	[0095.730] lstrlenW (lpString=".jpg") returned 4
	[0095.730] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.730] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.730] lstrlenW (lpString="QUAD.INF") returned 8
	[0095.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0095.735] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=600) returned 1
	[0095.735] CloseHandle (hObject=0x1a4) returned 1
	[0095.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf")) returned 0x20
	[0095.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.819] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.820] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0095.825] GetLastError () returned 0x0
	[0095.825] ReadFile (in: hFile=0x190, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x258, lpOverlapped=0x0) returned 1
	[0095.826] WriteFile (in: hFile=0x1a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x260, lpOverlapped=0x0) returned 1
	[0095.827] ReadFile (in: hFile=0x190, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.827] WriteFile (in: hFile=0x1a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0095.827] SetEndOfFile (hFile=0x1a4) returned 1
	[0095.828] CloseHandle (hObject=0x1a4) returned 1
	[0095.828] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.828] SetEndOfFile (hFile=0x190) returned 1
	[0095.829] CloseHandle (hObject=0x190) returned 1
	[0095.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.829] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf")) returned 1
	[0095.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69
	[0095.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69
	[0095.830] lstrlenW (lpString=".doc") returned 4
	[0095.830] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.830] lstrlenW (lpString=".docx") returned 5
	[0095.830] lstrcmpiW (lpString1=".docx", lpString2="D.INF") returned -1
	[0095.830] lstrlenW (lpString=".pdf") returned 4
	[0095.830] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.830] lstrlenW (lpString=".xls") returned 4
	[0095.830] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.830] lstrlenW (lpString=".xlsx") returned 5
	[0095.830] lstrcmpiW (lpString1=".xlsx", lpString2="D.INF") returned -1
	[0095.830] lstrlenW (lpString=".ppt") returned 4
	[0095.830] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69
	[0095.830] lstrlenW (lpString=".zip") returned 4
	[0095.830] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.830] lstrlenW (lpString=".rar") returned 4
	[0095.830] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.830] lstrlenW (lpString=".bz2") returned 4
	[0095.830] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.830] lstrlenW (lpString=".7z") returned 3
	[0095.830] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69
	[0095.830] lstrlenW (lpString=".dbf") returned 4
	[0095.831] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69
	[0095.831] lstrlenW (lpString=".1cd") returned 4
	[0095.831] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69
	[0095.831] lstrlenW (lpString=".jpg") returned 4
	[0095.831] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69
	[0095.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69
	[0095.831] lstrlenW (lpString=".doc") returned 4
	[0095.831] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.831] lstrlenW (lpString=".docx") returned 5
	[0095.831] lstrcmpiW (lpString1=".docx", lpString2="D.INF") returned -1
	[0095.831] lstrlenW (lpString=".pdf") returned 4
	[0095.831] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.831] lstrlenW (lpString=".xls") returned 4
	[0095.831] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.831] lstrlenW (lpString=".xlsx") returned 5
	[0095.831] lstrcmpiW (lpString1=".xlsx", lpString2="D.INF") returned -1
	[0095.831] lstrlenW (lpString=".ppt") returned 4
	[0095.831] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69
	[0095.831] lstrlenW (lpString=".zip") returned 4
	[0095.831] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.831] lstrlenW (lpString=".rar") returned 4
	[0095.831] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.831] lstrlenW (lpString=".bz2") returned 4
	[0095.832] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.832] lstrlenW (lpString=".7z") returned 3
	[0095.832] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69
	[0095.832] lstrlenW (lpString=".dbf") returned 4
	[0095.832] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69
	[0095.832] lstrlenW (lpString=".1cd") returned 4
	[0095.832] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69
	[0095.832] lstrlenW (lpString=".jpg") returned 4
	[0095.832] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.832] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.832] lstrlenW (lpString="RIPPLE.ELM") returned 10
	[0095.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.833] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=66016) returned 1
	[0095.833] CloseHandle (hObject=0x190) returned 1
	[0095.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm")) returned 0x20
	[0095.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.834] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.834] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0095.834] GetLastError () returned 0x0
	[0095.834] ReadFile (in: hFile=0x190, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x101e0, lpOverlapped=0x0) returned 1
	[0095.864] WriteFile (in: hFile=0x1a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x101f0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x101f0, lpOverlapped=0x0) returned 1
	[0095.866] ReadFile (in: hFile=0x190, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.867] WriteFile (in: hFile=0x1a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0095.867] SetEndOfFile (hFile=0x1a4) returned 1
	[0095.867] CloseHandle (hObject=0x1a4) returned 1
	[0095.867] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.867] SetEndOfFile (hFile=0x190) returned 1
	[0095.869] CloseHandle (hObject=0x190) returned 1
	[0095.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.869] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm")) returned 1
	[0095.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73
	[0095.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73
	[0095.870] lstrlenW (lpString=".doc") returned 4
	[0095.870] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.870] lstrlenW (lpString=".docx") returned 5
	[0095.870] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.870] lstrlenW (lpString=".pdf") returned 4
	[0095.870] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.870] lstrlenW (lpString=".xls") returned 4
	[0095.870] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.870] lstrlenW (lpString=".xlsx") returned 5
	[0095.870] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.870] lstrlenW (lpString=".ppt") returned 4
	[0095.870] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73
	[0095.870] lstrlenW (lpString=".zip") returned 4
	[0095.870] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.870] lstrlenW (lpString=".rar") returned 4
	[0095.870] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.870] lstrlenW (lpString=".bz2") returned 4
	[0095.870] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.870] lstrlenW (lpString=".7z") returned 3
	[0095.871] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73
	[0095.871] lstrlenW (lpString=".dbf") returned 4
	[0095.871] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73
	[0095.871] lstrlenW (lpString=".1cd") returned 4
	[0095.871] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73
	[0095.871] lstrlenW (lpString=".jpg") returned 4
	[0095.871] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73
	[0095.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73
	[0095.871] lstrlenW (lpString=".doc") returned 4
	[0095.871] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.871] lstrlenW (lpString=".docx") returned 5
	[0095.871] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.871] lstrlenW (lpString=".pdf") returned 4
	[0095.871] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.871] lstrlenW (lpString=".xls") returned 4
	[0095.871] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.871] lstrlenW (lpString=".xlsx") returned 5
	[0095.871] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.871] lstrlenW (lpString=".ppt") returned 4
	[0095.871] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73
	[0095.871] lstrlenW (lpString=".zip") returned 4
	[0095.871] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.872] lstrlenW (lpString=".rar") returned 4
	[0095.872] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.872] lstrlenW (lpString=".bz2") returned 4
	[0095.872] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.872] lstrlenW (lpString=".7z") returned 3
	[0095.872] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73
	[0095.872] lstrlenW (lpString=".dbf") returned 4
	[0095.872] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73
	[0095.872] lstrlenW (lpString=".1cd") returned 4
	[0095.872] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73
	[0095.872] lstrlenW (lpString=".jpg") returned 4
	[0095.872] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.872] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.872] lstrlenW (lpString="RMNSQUE.INF") returned 11
	[0095.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.898] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=613) returned 1
	[0095.898] CloseHandle (hObject=0x1c8) returned 1
	[0095.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf")) returned 0x20
	[0095.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.898] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.899] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.899] GetLastError () returned 0x0
	[0095.899] ReadFile (in: hFile=0x1c8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x265, lpOverlapped=0x0) returned 1
	[0095.900] WriteFile (in: hFile=0x190, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x270, lpOverlapped=0x0) returned 1
	[0095.902] ReadFile (in: hFile=0x1c8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.902] WriteFile (in: hFile=0x190, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.902] SetEndOfFile (hFile=0x190) returned 1
	[0095.902] CloseHandle (hObject=0x190) returned 1
	[0095.902] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.903] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.903] CloseHandle (hObject=0x1c8) returned 1
	[0095.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.904] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf")) returned 1
	[0095.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75
	[0095.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75
	[0095.904] lstrlenW (lpString=".doc") returned 4
	[0095.904] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.904] lstrlenW (lpString=".docx") returned 5
	[0095.904] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.904] lstrlenW (lpString=".pdf") returned 4
	[0095.904] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.904] lstrlenW (lpString=".xls") returned 4
	[0095.905] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.905] lstrlenW (lpString=".xlsx") returned 5
	[0095.905] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.905] lstrlenW (lpString=".ppt") returned 4
	[0095.905] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75
	[0095.905] lstrlenW (lpString=".zip") returned 4
	[0095.905] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.905] lstrlenW (lpString=".rar") returned 4
	[0095.905] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.905] lstrlenW (lpString=".bz2") returned 4
	[0095.905] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.905] lstrlenW (lpString=".7z") returned 3
	[0095.905] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75
	[0095.905] lstrlenW (lpString=".dbf") returned 4
	[0095.905] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75
	[0095.905] lstrlenW (lpString=".1cd") returned 4
	[0095.905] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75
	[0095.905] lstrlenW (lpString=".jpg") returned 4
	[0095.905] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75
	[0095.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75
	[0095.905] lstrlenW (lpString=".doc") returned 4
	[0095.905] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.906] lstrlenW (lpString=".docx") returned 5
	[0095.906] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.906] lstrlenW (lpString=".pdf") returned 4
	[0095.906] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.906] lstrlenW (lpString=".xls") returned 4
	[0095.906] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.906] lstrlenW (lpString=".xlsx") returned 5
	[0095.906] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.906] lstrlenW (lpString=".ppt") returned 4
	[0095.906] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75
	[0095.906] lstrlenW (lpString=".zip") returned 4
	[0095.906] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.906] lstrlenW (lpString=".rar") returned 4
	[0095.906] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.906] lstrlenW (lpString=".bz2") returned 4
	[0095.906] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.906] lstrlenW (lpString=".7z") returned 3
	[0095.906] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75
	[0095.906] lstrlenW (lpString=".dbf") returned 4
	[0095.906] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75
	[0095.906] lstrlenW (lpString=".1cd") returned 4
	[0095.906] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75
	[0095.907] lstrlenW (lpString=".jpg") returned 4
	[0095.907] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.907] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.907] lstrlenW (lpString="SATIN.INF") returned 9
	[0095.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.933] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=456) returned 1
	[0095.933] CloseHandle (hObject=0x190) returned 1
	[0095.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf")) returned 0x20
	[0095.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0096.058] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.058] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0096.069] GetLastError () returned 0x0
	[0096.069] ReadFile (in: hFile=0x160, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x1c8, lpOverlapped=0x0) returned 1
	[0096.070] WriteFile (in: hFile=0x190, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x1d0, lpOverlapped=0x0) returned 1
	[0096.071] ReadFile (in: hFile=0x160, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.071] WriteFile (in: hFile=0x190, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0096.071] SetEndOfFile (hFile=0x190) returned 1
	[0096.072] CloseHandle (hObject=0x190) returned 1
	[0096.072] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.072] SetEndOfFile (hFile=0x160) returned 1
	[0096.073] CloseHandle (hObject=0x160) returned 1
	[0096.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.074] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf")) returned 1
	[0096.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71
	[0096.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71
	[0096.074] lstrlenW (lpString=".doc") returned 4
	[0096.074] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.074] lstrlenW (lpString=".docx") returned 5
	[0096.074] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1
	[0096.074] lstrlenW (lpString=".pdf") returned 4
	[0096.074] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.074] lstrlenW (lpString=".xls") returned 4
	[0096.074] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.074] lstrlenW (lpString=".xlsx") returned 5
	[0096.074] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1
	[0096.074] lstrlenW (lpString=".ppt") returned 4
	[0096.074] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71
	[0096.074] lstrlenW (lpString=".zip") returned 4
	[0096.074] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.074] lstrlenW (lpString=".rar") returned 4
	[0096.075] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.075] lstrlenW (lpString=".bz2") returned 4
	[0096.075] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.075] lstrlenW (lpString=".7z") returned 3
	[0096.075] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71
	[0096.075] lstrlenW (lpString=".dbf") returned 4
	[0096.075] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71
	[0096.075] lstrlenW (lpString=".1cd") returned 4
	[0096.075] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71
	[0096.075] lstrlenW (lpString=".jpg") returned 4
	[0096.075] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71
	[0096.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71
	[0096.075] lstrlenW (lpString=".doc") returned 4
	[0096.075] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.075] lstrlenW (lpString=".docx") returned 5
	[0096.075] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1
	[0096.075] lstrlenW (lpString=".pdf") returned 4
	[0096.075] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.075] lstrlenW (lpString=".xls") returned 4
	[0096.075] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.075] lstrlenW (lpString=".xlsx") returned 5
	[0096.075] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1
	[0096.075] lstrlenW (lpString=".ppt") returned 4
	[0096.076] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71
	[0096.076] lstrlenW (lpString=".zip") returned 4
	[0096.076] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.076] lstrlenW (lpString=".rar") returned 4
	[0096.076] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.076] lstrlenW (lpString=".bz2") returned 4
	[0096.076] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.076] lstrlenW (lpString=".7z") returned 3
	[0096.076] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71
	[0096.076] lstrlenW (lpString=".dbf") returned 4
	[0096.076] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71
	[0096.076] lstrlenW (lpString=".1cd") returned 4
	[0096.076] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71
	[0096.076] lstrlenW (lpString=".jpg") returned 4
	[0096.076] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.076] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0096.076] lstrlenW (lpString="STRTEDGE.ELM") returned 12
	[0096.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0096.077] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=57906) returned 1
	[0096.077] CloseHandle (hObject=0x160) returned 1
	[0096.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm")) returned 0x20
	[0096.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0096.078] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.078] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0096.079] GetLastError () returned 0x0
	[0096.079] ReadFile (in: hFile=0x160, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xe232, lpOverlapped=0x0) returned 1
	[0096.108] WriteFile (in: hFile=0x190, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe240, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe240, lpOverlapped=0x0) returned 1
	[0096.110] ReadFile (in: hFile=0x160, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.110] WriteFile (in: hFile=0x190, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0096.110] SetEndOfFile (hFile=0x190) returned 1
	[0096.110] CloseHandle (hObject=0x190) returned 1
	[0096.111] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.111] SetEndOfFile (hFile=0x160) returned 1
	[0096.112] CloseHandle (hObject=0x160) returned 1
	[0096.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.112] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm")) returned 1
	[0096.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77
	[0096.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77
	[0096.113] lstrlenW (lpString=".doc") returned 4
	[0096.113] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.113] lstrlenW (lpString=".docx") returned 5
	[0096.113] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0096.113] lstrlenW (lpString=".pdf") returned 4
	[0096.113] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.113] lstrlenW (lpString=".xls") returned 4
	[0096.113] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.113] lstrlenW (lpString=".xlsx") returned 5
	[0096.113] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0096.113] lstrlenW (lpString=".ppt") returned 4
	[0096.113] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77
	[0096.113] lstrlenW (lpString=".zip") returned 4
	[0096.113] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.113] lstrlenW (lpString=".rar") returned 4
	[0096.113] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.113] lstrlenW (lpString=".bz2") returned 4
	[0096.113] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.114] lstrlenW (lpString=".7z") returned 3
	[0096.114] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77
	[0096.114] lstrlenW (lpString=".dbf") returned 4
	[0096.114] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77
	[0096.114] lstrlenW (lpString=".1cd") returned 4
	[0096.114] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77
	[0096.114] lstrlenW (lpString=".jpg") returned 4
	[0096.114] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77
	[0096.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77
	[0096.114] lstrlenW (lpString=".doc") returned 4
	[0096.114] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.114] lstrlenW (lpString=".docx") returned 5
	[0096.114] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0096.114] lstrlenW (lpString=".pdf") returned 4
	[0096.114] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.114] lstrlenW (lpString=".xls") returned 4
	[0096.114] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.114] lstrlenW (lpString=".xlsx") returned 5
	[0096.114] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0096.114] lstrlenW (lpString=".ppt") returned 4
	[0096.114] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77
	[0096.115] lstrlenW (lpString=".zip") returned 4
	[0096.115] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.115] lstrlenW (lpString=".rar") returned 4
	[0096.115] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.115] lstrlenW (lpString=".bz2") returned 4
	[0096.115] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.115] lstrlenW (lpString=".7z") returned 3
	[0096.115] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77
	[0096.115] lstrlenW (lpString=".dbf") returned 4
	[0096.115] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77
	[0096.115] lstrlenW (lpString=".1cd") returned 4
	[0096.115] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77
	[0096.115] lstrlenW (lpString=".jpg") returned 4
	[0096.115] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.115] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0096.115] lstrlenW (lpString="STUDIO.INF") returned 10
	[0096.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 58
	os_tid = 0xb98

	[0073.177] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x3760260
	[0073.177] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x3770268
	[0073.178] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6309b0
	[0073.178] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x6c0670
	[0073.178] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6309c8
	[0073.178] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3960020
	[0073.178] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6309e0
	[0073.178] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6309e0, Size=0x20) returned 0x6162d8
	[0073.178] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6309e0
	[0073.178] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6309e0, Size=0x20) returned 0x6162b0
	[0073.178] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0073.178] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0073.178] Wow64DisableWow64FsRedirection (in: OldValue=0x2f1ff58 | out: OldValue=0x2f1ff58*=0x0) returned 1
	[0073.178] lstrlenW (lpString="kernel32.dll") returned 12
	[0073.178] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162d8 | out: hHeap=0x5e0000) returned 1
	[0073.178] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0073.178] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162b0 | out: hHeap=0x5e0000) returned 1
	[0073.179] Sleep (dwMilliseconds=0x64) 
	[0073.724] Sleep (dwMilliseconds=0x64) 
	[0074.273] Sleep (dwMilliseconds=0x64) 
	[0074.733] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0074.733] lstrlenW (lpString="Setup.xml") returned 9
	[0074.733] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0074.733] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1886) returned 1
	[0074.733] CloseHandle (hObject=0x17c) returned 1
	[0074.733] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0074.733] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.734] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0074.734] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.734] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.734] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180
	[0074.734] GetLastError () returned 0x0
	[0074.734] ReadFile (in: hFile=0x17c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x75e, lpOverlapped=0x0) returned 1
	[0074.865] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x760, lpOverlapped=0x0) returned 1
	[0074.867] ReadFile (in: hFile=0x17c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0074.867] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0074.867] SetEndOfFile (hFile=0x180) returned 1
	[0074.867] CloseHandle (hObject=0x180) returned 1
	[0074.868] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.868] SetEndOfFile (hFile=0x17c) returned 1
	[0074.869] CloseHandle (hObject=0x17c) returned 1
	[0074.869] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0074.870] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0074.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0074.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0074.870] lstrlenW (lpString=".doc") returned 4
	[0074.870] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0074.870] lstrlenW (lpString=".docx") returned 5
	[0074.870] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0074.870] lstrlenW (lpString=".pdf") returned 4
	[0074.870] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0074.870] lstrlenW (lpString=".xls") returned 4
	[0074.870] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0074.870] lstrlenW (lpString=".xlsx") returned 5
	[0074.870] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0074.870] lstrlenW (lpString=".ppt") returned 4
	[0074.870] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0074.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0074.870] lstrlenW (lpString=".zip") returned 4
	[0074.870] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0074.871] lstrlenW (lpString=".rar") returned 4
	[0074.871] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0074.871] lstrlenW (lpString=".bz2") returned 4
	[0074.871] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0074.871] lstrlenW (lpString=".7z") returned 3
	[0074.871] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0074.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0074.871] lstrlenW (lpString=".dbf") returned 4
	[0074.871] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0074.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0074.871] lstrlenW (lpString=".1cd") returned 4
	[0074.871] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0074.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0074.871] lstrlenW (lpString=".jpg") returned 4
	[0074.871] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0074.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0074.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0074.871] lstrlenW (lpString=".doc") returned 4
	[0074.871] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0074.871] lstrlenW (lpString=".docx") returned 5
	[0074.871] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0074.871] lstrlenW (lpString=".pdf") returned 4
	[0074.871] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0074.871] lstrlenW (lpString=".xls") returned 4
	[0074.871] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0074.871] lstrlenW (lpString=".xlsx") returned 5
	[0074.872] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0074.872] lstrlenW (lpString=".ppt") returned 4
	[0074.872] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0074.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0074.872] lstrlenW (lpString=".zip") returned 4
	[0074.872] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0074.872] lstrlenW (lpString=".rar") returned 4
	[0074.872] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0074.872] lstrlenW (lpString=".bz2") returned 4
	[0074.872] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0074.872] lstrlenW (lpString=".7z") returned 3
	[0074.872] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0074.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0074.872] lstrlenW (lpString=".dbf") returned 4
	[0074.872] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0074.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0074.872] lstrlenW (lpString=".1cd") returned 4
	[0074.872] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0074.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0074.872] lstrlenW (lpString=".jpg") returned 4
	[0074.872] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0074.872] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0074.872] lstrlenW (lpString="Setup.xml") returned 9
	[0074.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0075.646] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1608) returned 1
	[0075.646] CloseHandle (hObject=0x160) returned 1
	[0075.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0075.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.718] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0075.718] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.718] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.718] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0075.754] GetLastError () returned 0x0
	[0075.754] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x648, lpOverlapped=0x0) returned 1
	[0075.769] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x650, lpOverlapped=0x0) returned 1
	[0075.771] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0075.771] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0075.771] SetEndOfFile (hFile=0x1b0) returned 1
	[0075.778] CloseHandle (hObject=0x1b0) returned 1
	[0075.782] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.782] SetEndOfFile (hFile=0x184) returned 1
	[0075.812] CloseHandle (hObject=0x184) returned 1
	[0075.826] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.840] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0075.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.978] lstrlenW (lpString=".doc") returned 4
	[0075.978] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.978] lstrlenW (lpString=".docx") returned 5
	[0075.978] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0075.978] lstrlenW (lpString=".pdf") returned 4
	[0075.978] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.978] lstrlenW (lpString=".xls") returned 4
	[0075.978] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.978] lstrlenW (lpString=".xlsx") returned 5
	[0075.978] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0075.978] lstrlenW (lpString=".ppt") returned 4
	[0075.978] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.979] lstrlenW (lpString=".zip") returned 4
	[0075.979] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.979] lstrlenW (lpString=".rar") returned 4
	[0075.979] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.979] lstrlenW (lpString=".bz2") returned 4
	[0075.979] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.979] lstrlenW (lpString=".7z") returned 3
	[0075.979] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.979] lstrlenW (lpString=".dbf") returned 4
	[0075.979] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.979] lstrlenW (lpString=".1cd") returned 4
	[0075.979] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.979] lstrlenW (lpString=".jpg") returned 4
	[0075.979] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.979] lstrlenW (lpString=".doc") returned 4
	[0075.979] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.979] lstrlenW (lpString=".docx") returned 5
	[0075.979] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0075.979] lstrlenW (lpString=".pdf") returned 4
	[0075.979] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.979] lstrlenW (lpString=".xls") returned 4
	[0075.979] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.980] lstrlenW (lpString=".xlsx") returned 5
	[0075.980] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0075.980] lstrlenW (lpString=".ppt") returned 4
	[0075.980] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.980] lstrlenW (lpString=".zip") returned 4
	[0075.980] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.980] lstrlenW (lpString=".rar") returned 4
	[0075.980] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.980] lstrlenW (lpString=".bz2") returned 4
	[0075.980] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.980] lstrlenW (lpString=".7z") returned 3
	[0075.980] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.980] lstrlenW (lpString=".dbf") returned 4
	[0075.980] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.980] lstrlenW (lpString=".1cd") returned 4
	[0075.980] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.980] lstrlenW (lpString=".jpg") returned 4
	[0075.980] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.980] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0075.981] lstrlenW (lpString="Setup.xml") returned 9
	[0075.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0075.981] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1852) returned 1
	[0075.981] CloseHandle (hObject=0x160) returned 1
	[0075.981] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0075.981] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0075.982] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.982] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.982] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0075.982] GetLastError () returned 0x0
	[0075.982] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x73c, lpOverlapped=0x0) returned 1
	[0076.065] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x740, lpOverlapped=0x0) returned 1
	[0076.067] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0076.067] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0076.067] SetEndOfFile (hFile=0x1a8) returned 1
	[0076.067] CloseHandle (hObject=0x1a8) returned 1
	[0076.071] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.071] SetEndOfFile (hFile=0x160) returned 1
	[0076.072] CloseHandle (hObject=0x160) returned 1
	[0076.072] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0076.073] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0076.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.073] lstrlenW (lpString=".doc") returned 4
	[0076.073] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0076.073] lstrlenW (lpString=".docx") returned 5
	[0076.073] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0076.073] lstrlenW (lpString=".pdf") returned 4
	[0076.073] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0076.073] lstrlenW (lpString=".xls") returned 4
	[0076.073] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0076.073] lstrlenW (lpString=".xlsx") returned 5
	[0076.073] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0076.073] lstrlenW (lpString=".ppt") returned 4
	[0076.073] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0076.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.073] lstrlenW (lpString=".zip") returned 4
	[0076.073] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0076.073] lstrlenW (lpString=".rar") returned 4
	[0076.073] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0076.073] lstrlenW (lpString=".bz2") returned 4
	[0076.074] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0076.074] lstrlenW (lpString=".7z") returned 3
	[0076.074] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0076.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.074] lstrlenW (lpString=".dbf") returned 4
	[0076.074] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0076.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.074] lstrlenW (lpString=".1cd") returned 4
	[0076.074] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0076.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.074] lstrlenW (lpString=".jpg") returned 4
	[0076.074] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0076.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.074] lstrlenW (lpString=".doc") returned 4
	[0076.074] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0076.074] lstrlenW (lpString=".docx") returned 5
	[0076.074] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0076.074] lstrlenW (lpString=".pdf") returned 4
	[0076.074] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0076.074] lstrlenW (lpString=".xls") returned 4
	[0076.075] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0076.075] lstrlenW (lpString=".xlsx") returned 5
	[0076.075] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0076.075] lstrlenW (lpString=".ppt") returned 4
	[0076.075] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0076.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.075] lstrlenW (lpString=".zip") returned 4
	[0076.075] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0076.075] lstrlenW (lpString=".rar") returned 4
	[0076.075] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0076.075] lstrlenW (lpString=".bz2") returned 4
	[0076.075] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0076.075] lstrlenW (lpString=".7z") returned 3
	[0076.075] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0076.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.075] lstrlenW (lpString=".dbf") returned 4
	[0076.075] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0076.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.075] lstrlenW (lpString=".1cd") returned 4
	[0076.075] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0076.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.075] lstrlenW (lpString=".jpg") returned 4
	[0076.075] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0076.076] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0076.076] lstrlenW (lpString="Setup.xml") returned 9
	[0076.076] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0076.249] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1988) returned 1
	[0076.249] CloseHandle (hObject=0x194) returned 1
	[0076.249] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0076.250] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0076.250] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0076.250] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.250] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.250] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0076.250] GetLastError () returned 0x0
	[0076.251] ReadFile (in: hFile=0x194, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x7c4, lpOverlapped=0x0) returned 1
	[0076.354] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7d0, lpOverlapped=0x0) returned 1
	[0076.355] ReadFile (in: hFile=0x194, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0076.355] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0076.355] SetEndOfFile (hFile=0x1a8) returned 1
	[0076.355] CloseHandle (hObject=0x1a8) returned 1
	[0076.357] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.357] SetEndOfFile (hFile=0x194) returned 1
	[0076.357] CloseHandle (hObject=0x194) returned 1
	[0076.358] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0076.358] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0076.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.358] lstrlenW (lpString=".doc") returned 4
	[0076.358] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0076.358] lstrlenW (lpString=".docx") returned 5
	[0076.358] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0076.358] lstrlenW (lpString=".pdf") returned 4
	[0076.358] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0076.358] lstrlenW (lpString=".xls") returned 4
	[0076.358] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0076.358] lstrlenW (lpString=".xlsx") returned 5
	[0076.358] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0076.358] lstrlenW (lpString=".ppt") returned 4
	[0076.358] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0076.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.359] lstrlenW (lpString=".zip") returned 4
	[0076.359] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0076.359] lstrlenW (lpString=".rar") returned 4
	[0076.359] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0076.359] lstrlenW (lpString=".bz2") returned 4
	[0076.359] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0076.359] lstrlenW (lpString=".7z") returned 3
	[0076.359] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0076.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.359] lstrlenW (lpString=".dbf") returned 4
	[0076.359] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0076.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.359] lstrlenW (lpString=".1cd") returned 4
	[0076.359] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0076.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.359] lstrlenW (lpString=".jpg") returned 4
	[0076.359] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0076.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.359] lstrlenW (lpString=".doc") returned 4
	[0076.359] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0076.359] lstrlenW (lpString=".docx") returned 5
	[0076.359] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0076.359] lstrlenW (lpString=".pdf") returned 4
	[0076.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0076.359] lstrlenW (lpString=".xls") returned 4
	[0076.359] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0076.359] lstrlenW (lpString=".xlsx") returned 5
	[0076.359] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0076.359] lstrlenW (lpString=".ppt") returned 4
	[0076.359] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0076.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.360] lstrlenW (lpString=".zip") returned 4
	[0076.360] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0076.360] lstrlenW (lpString=".rar") returned 4
	[0076.360] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0076.360] lstrlenW (lpString=".bz2") returned 4
	[0076.360] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0076.360] lstrlenW (lpString=".7z") returned 3
	[0076.360] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0076.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.360] lstrlenW (lpString=".dbf") returned 4
	[0076.360] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0076.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.360] lstrlenW (lpString=".1cd") returned 4
	[0076.360] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0076.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.360] lstrlenW (lpString=".jpg") returned 4
	[0076.360] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0076.360] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0076.360] lstrlenW (lpString="Setup.xml") returned 9
	[0076.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0076.361] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1872) returned 1
	[0076.361] CloseHandle (hObject=0x194) returned 1
	[0076.361] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0076.361] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0076.361] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0076.361] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.361] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.361] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0076.361] GetLastError () returned 0x0
	[0076.361] ReadFile (in: hFile=0x194, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x750, lpOverlapped=0x0) returned 1
	[0076.601] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x760, lpOverlapped=0x0) returned 1
	[0076.602] ReadFile (in: hFile=0x194, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0076.603] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0076.603] SetEndOfFile (hFile=0x1a8) returned 1
	[0076.603] CloseHandle (hObject=0x1a8) returned 1
	[0076.604] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.604] SetEndOfFile (hFile=0x194) returned 1
	[0076.605] CloseHandle (hObject=0x194) returned 1
	[0076.605] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0076.605] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0076.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.611] lstrlenW (lpString=".doc") returned 4
	[0076.611] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0076.611] lstrlenW (lpString=".docx") returned 5
	[0076.611] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0076.611] lstrlenW (lpString=".pdf") returned 4
	[0076.611] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0076.611] lstrlenW (lpString=".xls") returned 4
	[0076.611] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0076.611] lstrlenW (lpString=".xlsx") returned 5
	[0076.611] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0076.611] lstrlenW (lpString=".ppt") returned 4
	[0076.611] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0076.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.611] lstrlenW (lpString=".zip") returned 4
	[0076.611] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0076.611] lstrlenW (lpString=".rar") returned 4
	[0076.611] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0076.611] lstrlenW (lpString=".bz2") returned 4
	[0076.611] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0076.611] lstrlenW (lpString=".7z") returned 3
	[0076.611] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0076.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.611] lstrlenW (lpString=".dbf") returned 4
	[0076.611] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0076.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.611] lstrlenW (lpString=".1cd") returned 4
	[0076.612] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0076.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.612] lstrlenW (lpString=".jpg") returned 4
	[0076.612] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0076.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.612] lstrlenW (lpString=".doc") returned 4
	[0076.612] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0076.612] lstrlenW (lpString=".docx") returned 5
	[0076.612] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0076.612] lstrlenW (lpString=".pdf") returned 4
	[0076.612] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0076.612] lstrlenW (lpString=".xls") returned 4
	[0076.612] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0076.612] lstrlenW (lpString=".xlsx") returned 5
	[0076.612] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0076.612] lstrlenW (lpString=".ppt") returned 4
	[0076.612] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0076.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.612] lstrlenW (lpString=".zip") returned 4
	[0076.612] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0076.612] lstrlenW (lpString=".rar") returned 4
	[0076.612] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0076.612] lstrlenW (lpString=".bz2") returned 4
	[0076.612] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0076.612] lstrlenW (lpString=".7z") returned 3
	[0076.612] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0076.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.612] lstrlenW (lpString=".dbf") returned 4
	[0076.612] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0076.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.612] lstrlenW (lpString=".1cd") returned 4
	[0076.613] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0076.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0076.613] lstrlenW (lpString=".jpg") returned 4
	[0076.613] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0076.613] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0076.613] lstrlenW (lpString="Setup.xml") returned 9
	[0076.613] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0078.269] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1452) returned 1
	[0078.269] CloseHandle (hObject=0x194) returned 1
	[0078.269] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0078.695] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0078.697] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0078.832] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.832] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.832] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0078.833] GetLastError () returned 0x0
	[0078.833] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x5ac, lpOverlapped=0x0) returned 1
	[0078.881] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0078.882] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0078.882] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0078.882] SetEndOfFile (hFile=0x19c) returned 1
	[0078.882] CloseHandle (hObject=0x19c) returned 1
	[0078.883] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.883] SetEndOfFile (hFile=0x1a8) returned 1
	[0078.884] CloseHandle (hObject=0x1a8) returned 1
	[0078.884] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0078.885] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0078.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.886] lstrlenW (lpString=".doc") returned 4
	[0078.886] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.886] lstrlenW (lpString=".docx") returned 5
	[0078.886] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0078.886] lstrlenW (lpString=".pdf") returned 4
	[0078.886] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.886] lstrlenW (lpString=".xls") returned 4
	[0078.886] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.886] lstrlenW (lpString=".xlsx") returned 5
	[0078.886] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0078.886] lstrlenW (lpString=".ppt") returned 4
	[0078.886] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.886] lstrlenW (lpString=".zip") returned 4
	[0078.886] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.886] lstrlenW (lpString=".rar") returned 4
	[0078.886] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.886] lstrlenW (lpString=".bz2") returned 4
	[0078.886] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.886] lstrlenW (lpString=".7z") returned 3
	[0078.886] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.886] lstrlenW (lpString=".dbf") returned 4
	[0078.886] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.887] lstrlenW (lpString=".1cd") returned 4
	[0078.887] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.887] lstrlenW (lpString=".jpg") returned 4
	[0078.887] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.887] lstrlenW (lpString=".doc") returned 4
	[0078.887] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.887] lstrlenW (lpString=".docx") returned 5
	[0078.887] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0078.887] lstrlenW (lpString=".pdf") returned 4
	[0078.887] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.887] lstrlenW (lpString=".xls") returned 4
	[0078.887] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.887] lstrlenW (lpString=".xlsx") returned 5
	[0078.887] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0078.887] lstrlenW (lpString=".ppt") returned 4
	[0078.887] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.887] lstrlenW (lpString=".zip") returned 4
	[0078.887] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.887] lstrlenW (lpString=".rar") returned 4
	[0078.887] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.887] lstrlenW (lpString=".bz2") returned 4
	[0078.887] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.887] lstrlenW (lpString=".7z") returned 3
	[0078.887] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.887] lstrlenW (lpString=".dbf") returned 4
	[0078.887] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.888] lstrlenW (lpString=".1cd") returned 4
	[0078.888] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.888] lstrlenW (lpString=".jpg") returned 4
	[0078.888] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.888] lstrcmpiW (lpString1=".chm", lpString2=".adobe") returned 1
	[0078.888] lstrlenW (lpString="pss10r.chm") returned 10
	[0078.888] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0080.460] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=27195) returned 1
	[0080.460] CloseHandle (hObject=0x1b0) returned 1
	[0080.460] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020
	[0081.455] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.456] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.485] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.486] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0081.509] GetLastError () returned 0x0
	[0081.509] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x6a3b, lpOverlapped=0x0) returned 1
	[0081.512] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6a40, lpOverlapped=0x0) returned 1
	[0081.513] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.513] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0081.513] SetEndOfFile (hFile=0x174) returned 1
	[0081.516] CloseHandle (hObject=0x174) returned 1
	[0081.516] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.516] SetEndOfFile (hFile=0x184) returned 1
	[0081.521] CloseHandle (hObject=0x184) returned 1
	[0081.521] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.526] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1
	[0081.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0081.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0081.618] lstrlenW (lpString=".doc") returned 4
	[0081.618] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0081.618] lstrlenW (lpString=".docx") returned 5
	[0081.618] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1
	[0081.618] lstrlenW (lpString=".pdf") returned 4
	[0081.618] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0081.618] lstrlenW (lpString=".xls") returned 4
	[0081.618] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0081.618] lstrlenW (lpString=".xlsx") returned 5
	[0081.618] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1
	[0081.618] lstrlenW (lpString=".ppt") returned 4
	[0081.618] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0081.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0081.618] lstrlenW (lpString=".zip") returned 4
	[0081.618] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0081.618] lstrlenW (lpString=".rar") returned 4
	[0081.618] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0081.618] lstrlenW (lpString=".bz2") returned 4
	[0081.619] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0081.619] lstrlenW (lpString=".7z") returned 3
	[0081.619] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0081.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0081.619] lstrlenW (lpString=".dbf") returned 4
	[0081.619] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0081.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0081.619] lstrlenW (lpString=".1cd") returned 4
	[0081.619] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0081.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0081.619] lstrlenW (lpString=".jpg") returned 4
	[0081.619] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0081.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0081.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0081.619] lstrlenW (lpString=".doc") returned 4
	[0081.619] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0081.619] lstrlenW (lpString=".docx") returned 5
	[0081.619] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1
	[0081.619] lstrlenW (lpString=".pdf") returned 4
	[0081.619] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0081.619] lstrlenW (lpString=".xls") returned 4
	[0081.619] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0081.619] lstrlenW (lpString=".xlsx") returned 5
	[0081.619] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1
	[0081.619] lstrlenW (lpString=".ppt") returned 4
	[0081.619] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0081.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0081.620] lstrlenW (lpString=".zip") returned 4
	[0081.620] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0081.620] lstrlenW (lpString=".rar") returned 4
	[0081.620] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0081.620] lstrlenW (lpString=".bz2") returned 4
	[0081.620] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0081.620] lstrlenW (lpString=".7z") returned 3
	[0081.620] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0081.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0081.620] lstrlenW (lpString=".dbf") returned 4
	[0081.620] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0081.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0081.620] lstrlenW (lpString=".1cd") returned 4
	[0081.620] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0081.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0081.620] lstrlenW (lpString=".jpg") returned 4
	[0081.620] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0081.620] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0081.620] lstrlenW (lpString="ProPlusrWW.xml") returned 14
	[0081.620] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.632] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=16852) returned 1
	[0081.632] CloseHandle (hObject=0x184) returned 1
	[0081.632] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020
	[0081.635] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.635] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0081.637] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.637] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.637] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0081.726] GetLastError () returned 0x0
	[0081.726] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x41d4, lpOverlapped=0x0) returned 1
	[0081.744] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x41e0, lpOverlapped=0x0) returned 1
	[0081.746] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.746] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0081.746] SetEndOfFile (hFile=0x188) returned 1
	[0081.746] CloseHandle (hObject=0x188) returned 1
	[0081.747] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.747] SetEndOfFile (hFile=0x1a8) returned 1
	[0081.748] CloseHandle (hObject=0x1a8) returned 1
	[0081.748] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.748] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1
	[0081.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0081.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0081.749] lstrlenW (lpString=".doc") returned 4
	[0081.749] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.749] lstrlenW (lpString=".docx") returned 5
	[0081.749] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0081.749] lstrlenW (lpString=".pdf") returned 4
	[0081.749] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.749] lstrlenW (lpString=".xls") returned 4
	[0081.749] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.749] lstrlenW (lpString=".xlsx") returned 5
	[0081.749] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0081.749] lstrlenW (lpString=".ppt") returned 4
	[0081.749] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0081.749] lstrlenW (lpString=".zip") returned 4
	[0081.749] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.749] lstrlenW (lpString=".rar") returned 4
	[0081.749] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.749] lstrlenW (lpString=".bz2") returned 4
	[0081.749] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.749] lstrlenW (lpString=".7z") returned 3
	[0081.749] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0081.750] lstrlenW (lpString=".dbf") returned 4
	[0081.750] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0081.750] lstrlenW (lpString=".1cd") returned 4
	[0081.750] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0081.750] lstrlenW (lpString=".jpg") returned 4
	[0081.750] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0081.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0081.750] lstrlenW (lpString=".doc") returned 4
	[0081.750] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.750] lstrlenW (lpString=".docx") returned 5
	[0081.750] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0081.750] lstrlenW (lpString=".pdf") returned 4
	[0081.750] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.750] lstrlenW (lpString=".xls") returned 4
	[0081.750] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.750] lstrlenW (lpString=".xlsx") returned 5
	[0081.750] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0081.750] lstrlenW (lpString=".ppt") returned 4
	[0081.750] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0081.750] lstrlenW (lpString=".zip") returned 4
	[0081.750] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.751] lstrlenW (lpString=".rar") returned 4
	[0081.751] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.751] lstrlenW (lpString=".bz2") returned 4
	[0081.751] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.751] lstrlenW (lpString=".7z") returned 3
	[0081.751] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0081.751] lstrlenW (lpString=".dbf") returned 4
	[0081.751] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0081.751] lstrlenW (lpString=".1cd") returned 4
	[0081.751] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0081.751] lstrlenW (lpString=".jpg") returned 4
	[0081.751] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.751] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0081.751] lstrlenW (lpString="Office32WW.xml") returned 14
	[0081.751] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0081.753] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4274) returned 1
	[0081.753] CloseHandle (hObject=0x1a8) returned 1
	[0081.754] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020
	[0081.755] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.756] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0081.757] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.757] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.757] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0081.757] GetLastError () returned 0x0
	[0081.757] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0081.817] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0081.819] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.819] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0081.819] SetEndOfFile (hFile=0x188) returned 1
	[0081.819] CloseHandle (hObject=0x188) returned 1
	[0081.819] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.819] SetEndOfFile (hFile=0x1a8) returned 1
	[0081.820] CloseHandle (hObject=0x1a8) returned 1
	[0081.821] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.821] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1
	[0081.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.839] lstrlenW (lpString=".doc") returned 4
	[0081.839] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.839] lstrlenW (lpString=".docx") returned 5
	[0081.839] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0081.839] lstrlenW (lpString=".pdf") returned 4
	[0081.839] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.839] lstrlenW (lpString=".xls") returned 4
	[0081.840] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.840] lstrlenW (lpString=".xlsx") returned 5
	[0081.840] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0081.840] lstrlenW (lpString=".ppt") returned 4
	[0081.840] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.840] lstrlenW (lpString=".zip") returned 4
	[0081.840] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.840] lstrlenW (lpString=".rar") returned 4
	[0081.840] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.840] lstrlenW (lpString=".bz2") returned 4
	[0081.840] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.840] lstrlenW (lpString=".7z") returned 3
	[0081.840] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.840] lstrlenW (lpString=".dbf") returned 4
	[0081.840] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.840] lstrlenW (lpString=".1cd") returned 4
	[0081.840] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.840] lstrlenW (lpString=".jpg") returned 4
	[0081.840] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.841] lstrlenW (lpString=".doc") returned 4
	[0081.841] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.841] lstrlenW (lpString=".docx") returned 5
	[0081.841] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0081.841] lstrlenW (lpString=".pdf") returned 4
	[0081.841] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.841] lstrlenW (lpString=".xls") returned 4
	[0081.841] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.841] lstrlenW (lpString=".xlsx") returned 5
	[0081.841] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0081.841] lstrlenW (lpString=".ppt") returned 4
	[0081.841] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.841] lstrlenW (lpString=".zip") returned 4
	[0081.841] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.841] lstrlenW (lpString=".rar") returned 4
	[0081.841] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.841] lstrlenW (lpString=".bz2") returned 4
	[0081.841] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.841] lstrlenW (lpString=".7z") returned 3
	[0081.841] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.841] lstrlenW (lpString=".dbf") returned 4
	[0081.841] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.841] lstrlenW (lpString=".1cd") returned 4
	[0081.841] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.842] lstrlenW (lpString=".jpg") returned 4
	[0081.842] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.842] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0081.842] lstrlenW (lpString="Setup.xml") returned 9
	[0081.842] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0081.875] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=16683) returned 1
	[0081.875] CloseHandle (hObject=0x1b0) returned 1
	[0081.875] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0081.894] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.895] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.927] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.927] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.927] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0081.928] GetLastError () returned 0x0
	[0081.928] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x412b, lpOverlapped=0x0) returned 1
	[0081.946] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4130, lpOverlapped=0x0) returned 1
	[0081.947] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.947] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0081.948] SetEndOfFile (hFile=0x1b0) returned 1
	[0081.948] CloseHandle (hObject=0x1b0) returned 1
	[0081.948] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.948] SetEndOfFile (hFile=0x198) returned 1
	[0081.949] CloseHandle (hObject=0x198) returned 1
	[0081.949] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.949] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0081.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.950] lstrlenW (lpString=".doc") returned 4
	[0081.950] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.950] lstrlenW (lpString=".docx") returned 5
	[0081.950] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0081.950] lstrlenW (lpString=".pdf") returned 4
	[0081.950] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.950] lstrlenW (lpString=".xls") returned 4
	[0081.950] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.950] lstrlenW (lpString=".xlsx") returned 5
	[0081.950] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0081.950] lstrlenW (lpString=".ppt") returned 4
	[0081.950] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.951] lstrlenW (lpString=".zip") returned 4
	[0081.951] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.951] lstrlenW (lpString=".rar") returned 4
	[0081.951] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.951] lstrlenW (lpString=".bz2") returned 4
	[0081.951] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.951] lstrlenW (lpString=".7z") returned 3
	[0081.951] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.951] lstrlenW (lpString=".dbf") returned 4
	[0081.951] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.951] lstrlenW (lpString=".1cd") returned 4
	[0081.951] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.951] lstrlenW (lpString=".jpg") returned 4
	[0081.951] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.951] lstrlenW (lpString=".doc") returned 4
	[0081.951] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.951] lstrlenW (lpString=".docx") returned 5
	[0081.951] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0081.951] lstrlenW (lpString=".pdf") returned 4
	[0081.952] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.952] lstrlenW (lpString=".xls") returned 4
	[0081.952] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.952] lstrlenW (lpString=".xlsx") returned 5
	[0081.952] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0081.952] lstrlenW (lpString=".ppt") returned 4
	[0081.952] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.952] lstrlenW (lpString=".zip") returned 4
	[0081.952] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.952] lstrlenW (lpString=".rar") returned 4
	[0081.952] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.952] lstrlenW (lpString=".bz2") returned 4
	[0081.952] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.952] lstrlenW (lpString=".7z") returned 3
	[0081.952] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.952] lstrlenW (lpString=".dbf") returned 4
	[0081.952] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.952] lstrlenW (lpString=".1cd") returned 4
	[0081.952] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.952] lstrlenW (lpString=".jpg") returned 4
	[0081.952] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.953] lstrcmpiW (lpString1=".JPG", lpString2=".adobe") returned 1
	[0081.953] lstrlenW (lpString="MS.JPG") returned 6
	[0081.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.970] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1061) returned 1
	[0081.970] CloseHandle (hObject=0x184) returned 1
	[0081.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20
	[0081.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0081.990] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.990] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0082.112] GetLastError () returned 0x0
	[0082.112] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x425, lpOverlapped=0x0) returned 1
	[0082.117] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x430, lpOverlapped=0x0) returned 1
	[0082.118] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0082.118] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0082.118] SetEndOfFile (hFile=0x198) returned 1
	[0082.172] CloseHandle (hObject=0x198) returned 1
	[0082.172] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.172] SetEndOfFile (hFile=0x174) returned 1
	[0082.189] CloseHandle (hObject=0x174) returned 1
	[0082.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0082.200] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1
	[0082.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0082.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0082.271] lstrlenW (lpString=".doc") returned 4
	[0082.271] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0082.271] lstrlenW (lpString=".docx") returned 5
	[0082.271] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1
	[0082.271] lstrlenW (lpString=".pdf") returned 4
	[0082.271] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0082.271] lstrlenW (lpString=".xls") returned 4
	[0082.271] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0082.271] lstrlenW (lpString=".xlsx") returned 5
	[0082.271] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1
	[0082.271] lstrlenW (lpString=".ppt") returned 4
	[0082.271] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0082.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0082.271] lstrlenW (lpString=".zip") returned 4
	[0082.271] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0082.271] lstrlenW (lpString=".rar") returned 4
	[0082.271] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0082.271] lstrlenW (lpString=".bz2") returned 4
	[0082.271] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0082.271] lstrlenW (lpString=".7z") returned 3
	[0082.271] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0082.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0082.271] lstrlenW (lpString=".dbf") returned 4
	[0082.271] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0082.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0082.271] lstrlenW (lpString=".1cd") returned 4
	[0082.271] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0082.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0082.272] lstrlenW (lpString=".jpg") returned 4
	[0082.272] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0082.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0082.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0082.272] lstrlenW (lpString=".doc") returned 4
	[0082.272] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0082.272] lstrlenW (lpString=".docx") returned 5
	[0082.272] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1
	[0082.272] lstrlenW (lpString=".pdf") returned 4
	[0082.272] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0082.272] lstrlenW (lpString=".xls") returned 4
	[0082.272] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0082.272] lstrlenW (lpString=".xlsx") returned 5
	[0082.272] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1
	[0082.272] lstrlenW (lpString=".ppt") returned 4
	[0082.272] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0082.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0082.272] lstrlenW (lpString=".zip") returned 4
	[0082.272] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0082.272] lstrlenW (lpString=".rar") returned 4
	[0082.272] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0082.272] lstrlenW (lpString=".bz2") returned 4
	[0082.272] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0082.272] lstrlenW (lpString=".7z") returned 3
	[0082.272] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0082.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0082.272] lstrlenW (lpString=".dbf") returned 4
	[0082.272] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0082.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0082.272] lstrlenW (lpString=".1cd") returned 4
	[0082.272] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0082.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0082.273] lstrlenW (lpString=".jpg") returned 4
	[0082.273] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0082.273] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0082.273] lstrlenW (lpString="Alphabet.xml") returned 12
	[0082.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0082.607] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=791686) returned 1
	[0082.607] CloseHandle (hObject=0x1ac) returned 1
	[0082.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20
	[0082.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0082.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0082.812] lstrlenW (lpString=".doc") returned 4
	[0082.812] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.812] lstrlenW (lpString=".docx") returned 5
	[0082.812] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0082.812] lstrlenW (lpString=".pdf") returned 4
	[0082.812] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.812] lstrlenW (lpString=".xls") returned 4
	[0082.812] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.812] lstrlenW (lpString=".xlsx") returned 5
	[0082.812] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0082.812] lstrlenW (lpString=".ppt") returned 4
	[0082.812] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0082.812] lstrlenW (lpString=".zip") returned 4
	[0082.812] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.812] lstrlenW (lpString=".rar") returned 4
	[0082.812] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.812] lstrlenW (lpString=".bz2") returned 4
	[0082.812] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.812] lstrlenW (lpString=".7z") returned 3
	[0082.812] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0082.812] lstrlenW (lpString=".dbf") returned 4
	[0082.813] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0082.813] lstrlenW (lpString=".1cd") returned 4
	[0082.813] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0082.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0082.813] lstrlenW (lpString=".jpg") returned 4
	[0082.813] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0082.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0082.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0082.813] lstrlenW (lpString=".doc") returned 4
	[0082.813] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.813] lstrlenW (lpString=".docx") returned 5
	[0082.813] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0082.813] lstrlenW (lpString=".pdf") returned 4
	[0082.813] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.813] lstrlenW (lpString=".xls") returned 4
	[0082.813] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.813] lstrlenW (lpString=".xlsx") returned 5
	[0082.813] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0082.813] lstrlenW (lpString=".ppt") returned 4
	[0082.813] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0082.813] lstrlenW (lpString=".zip") returned 4
	[0082.813] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.813] lstrlenW (lpString=".rar") returned 4
	[0082.814] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.814] lstrlenW (lpString=".bz2") returned 4
	[0082.814] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.814] lstrlenW (lpString=".7z") returned 3
	[0082.814] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0082.814] lstrlenW (lpString=".dbf") returned 4
	[0082.814] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0082.814] lstrlenW (lpString=".1cd") returned 4
	[0082.814] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0082.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0082.814] lstrlenW (lpString=".jpg") returned 4
	[0082.814] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0082.814] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0082.814] lstrlenW (lpString="keypadbase.xml") returned 14
	[0082.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0082.939] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1118) returned 1
	[0082.939] CloseHandle (hObject=0x174) returned 1
	[0082.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20
	[0082.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0082.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0082.989] lstrlenW (lpString=".doc") returned 4
	[0082.989] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.989] lstrlenW (lpString=".docx") returned 5
	[0082.989] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0082.989] lstrlenW (lpString=".pdf") returned 4
	[0082.989] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.989] lstrlenW (lpString=".xls") returned 4
	[0082.989] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.990] lstrlenW (lpString=".xlsx") returned 5
	[0082.990] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0082.990] lstrlenW (lpString=".ppt") returned 4
	[0082.990] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0082.990] lstrlenW (lpString=".zip") returned 4
	[0082.990] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.990] lstrlenW (lpString=".rar") returned 4
	[0082.990] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.990] lstrlenW (lpString=".bz2") returned 4
	[0082.990] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.990] lstrlenW (lpString=".7z") returned 3
	[0082.990] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0082.990] lstrlenW (lpString=".dbf") returned 4
	[0082.990] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0082.990] lstrlenW (lpString=".1cd") returned 4
	[0082.990] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0082.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0082.990] lstrlenW (lpString=".jpg") returned 4
	[0082.990] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0082.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0082.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0082.990] lstrlenW (lpString=".doc") returned 4
	[0082.990] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.991] lstrlenW (lpString=".docx") returned 5
	[0082.991] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0082.991] lstrlenW (lpString=".pdf") returned 4
	[0082.991] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.991] lstrlenW (lpString=".xls") returned 4
	[0082.991] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.991] lstrlenW (lpString=".xlsx") returned 5
	[0082.991] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0082.991] lstrlenW (lpString=".ppt") returned 4
	[0082.991] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0082.991] lstrlenW (lpString=".zip") returned 4
	[0082.991] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.991] lstrlenW (lpString=".rar") returned 4
	[0082.991] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.991] lstrlenW (lpString=".bz2") returned 4
	[0082.991] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.991] lstrlenW (lpString=".7z") returned 3
	[0082.991] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0082.991] lstrlenW (lpString=".dbf") returned 4
	[0082.991] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0082.991] lstrlenW (lpString=".1cd") returned 4
	[0082.991] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0082.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0082.991] lstrlenW (lpString=".jpg") returned 4
	[0082.992] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0082.992] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0082.992] lstrlenW (lpString="numbase.xml") returned 11
	[0082.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0083.250] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1218) returned 1
	[0083.250] CloseHandle (hObject=0x1a4) returned 1
	[0083.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20
	[0083.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0083.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0083.273] lstrlenW (lpString=".doc") returned 4
	[0083.273] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.273] lstrlenW (lpString=".docx") returned 5
	[0083.273] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0083.273] lstrlenW (lpString=".pdf") returned 4
	[0083.273] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.273] lstrlenW (lpString=".xls") returned 4
	[0083.273] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.273] lstrlenW (lpString=".xlsx") returned 5
	[0083.273] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0083.273] lstrlenW (lpString=".ppt") returned 4
	[0083.273] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0083.273] lstrlenW (lpString=".zip") returned 4
	[0083.273] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.274] lstrlenW (lpString=".rar") returned 4
	[0083.274] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.274] lstrlenW (lpString=".bz2") returned 4
	[0083.274] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.274] lstrlenW (lpString=".7z") returned 3
	[0083.274] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0083.274] lstrlenW (lpString=".dbf") returned 4
	[0083.274] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0083.274] lstrlenW (lpString=".1cd") returned 4
	[0083.274] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0083.274] lstrlenW (lpString=".jpg") returned 4
	[0083.274] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0083.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0083.274] lstrlenW (lpString=".doc") returned 4
	[0083.274] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.274] lstrlenW (lpString=".docx") returned 5
	[0083.274] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0083.274] lstrlenW (lpString=".pdf") returned 4
	[0083.274] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.274] lstrlenW (lpString=".xls") returned 4
	[0083.274] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.275] lstrlenW (lpString=".xlsx") returned 5
	[0083.275] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0083.275] lstrlenW (lpString=".ppt") returned 4
	[0083.275] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0083.275] lstrlenW (lpString=".zip") returned 4
	[0083.275] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.275] lstrlenW (lpString=".rar") returned 4
	[0083.275] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.275] lstrlenW (lpString=".bz2") returned 4
	[0083.275] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.275] lstrlenW (lpString=".7z") returned 3
	[0083.275] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0083.275] lstrlenW (lpString=".dbf") returned 4
	[0083.275] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0083.275] lstrlenW (lpString=".1cd") returned 4
	[0083.275] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0083.275] lstrlenW (lpString=".jpg") returned 4
	[0083.275] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.276] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0083.276] lstrlenW (lpString="osknumpad.xml") returned 13
	[0083.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0083.283] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=219) returned 1
	[0083.283] CloseHandle (hObject=0x1b0) returned 1
	[0083.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20
	[0083.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0083.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0083.296] lstrlenW (lpString=".doc") returned 4
	[0083.296] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.296] lstrlenW (lpString=".docx") returned 5
	[0083.296] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0083.296] lstrlenW (lpString=".pdf") returned 4
	[0083.296] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.296] lstrlenW (lpString=".xls") returned 4
	[0083.296] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.296] lstrlenW (lpString=".xlsx") returned 5
	[0083.296] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0083.296] lstrlenW (lpString=".ppt") returned 4
	[0083.296] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0083.296] lstrlenW (lpString=".zip") returned 4
	[0083.296] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.296] lstrlenW (lpString=".rar") returned 4
	[0083.296] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.296] lstrlenW (lpString=".bz2") returned 4
	[0083.296] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.297] lstrlenW (lpString=".7z") returned 3
	[0083.297] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0083.297] lstrlenW (lpString=".dbf") returned 4
	[0083.297] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0083.297] lstrlenW (lpString=".1cd") returned 4
	[0083.297] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0083.297] lstrlenW (lpString=".jpg") returned 4
	[0083.297] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0083.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0083.297] lstrlenW (lpString=".doc") returned 4
	[0083.297] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.297] lstrlenW (lpString=".docx") returned 5
	[0083.297] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0083.297] lstrlenW (lpString=".pdf") returned 4
	[0083.297] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.297] lstrlenW (lpString=".xls") returned 4
	[0083.297] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.297] lstrlenW (lpString=".xlsx") returned 5
	[0083.297] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0083.297] lstrlenW (lpString=".ppt") returned 4
	[0083.297] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0083.298] lstrlenW (lpString=".zip") returned 4
	[0083.298] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.298] lstrlenW (lpString=".rar") returned 4
	[0083.298] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.298] lstrlenW (lpString=".bz2") returned 4
	[0083.298] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.298] lstrlenW (lpString=".7z") returned 3
	[0083.298] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0083.298] lstrlenW (lpString=".dbf") returned 4
	[0083.298] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0083.298] lstrlenW (lpString=".1cd") returned 4
	[0083.298] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0083.298] lstrlenW (lpString=".jpg") returned 4
	[0083.298] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.298] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0083.298] lstrlenW (lpString="ea-sym.xml") returned 10
	[0083.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0083.425] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=749) returned 1
	[0083.425] CloseHandle (hObject=0x1ac) returned 1
	[0083.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20
	[0083.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83
	[0083.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83
	[0083.794] lstrlenW (lpString=".doc") returned 4
	[0083.794] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.794] lstrlenW (lpString=".docx") returned 5
	[0083.794] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1
	[0083.794] lstrlenW (lpString=".pdf") returned 4
	[0083.794] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.794] lstrlenW (lpString=".xls") returned 4
	[0083.794] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.794] lstrlenW (lpString=".xlsx") returned 5
	[0083.794] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1
	[0083.794] lstrlenW (lpString=".ppt") returned 4
	[0083.794] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83
	[0083.795] lstrlenW (lpString=".zip") returned 4
	[0083.795] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.795] lstrlenW (lpString=".rar") returned 4
	[0083.795] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.795] lstrlenW (lpString=".bz2") returned 4
	[0083.795] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.795] lstrlenW (lpString=".7z") returned 3
	[0083.795] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83
	[0083.795] lstrlenW (lpString=".dbf") returned 4
	[0083.795] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83
	[0083.795] lstrlenW (lpString=".1cd") returned 4
	[0083.795] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83
	[0083.795] lstrlenW (lpString=".jpg") returned 4
	[0083.795] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83
	[0083.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83
	[0083.795] lstrlenW (lpString=".doc") returned 4
	[0083.795] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.795] lstrlenW (lpString=".docx") returned 5
	[0083.795] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1
	[0083.795] lstrlenW (lpString=".pdf") returned 4
	[0083.795] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.795] lstrlenW (lpString=".xls") returned 4
	[0083.796] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.796] lstrlenW (lpString=".xlsx") returned 5
	[0083.796] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1
	[0083.796] lstrlenW (lpString=".ppt") returned 4
	[0083.796] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83
	[0083.796] lstrlenW (lpString=".zip") returned 4
	[0083.796] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.796] lstrlenW (lpString=".rar") returned 4
	[0083.796] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.796] lstrlenW (lpString=".bz2") returned 4
	[0083.796] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.796] lstrlenW (lpString=".7z") returned 3
	[0083.796] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83
	[0083.796] lstrlenW (lpString=".dbf") returned 4
	[0083.796] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83
	[0083.796] lstrlenW (lpString=".1cd") returned 4
	[0083.796] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83
	[0083.796] lstrlenW (lpString=".jpg") returned 4
	[0083.796] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.797] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0083.797] lstrlenW (lpString="webbase.xml") returned 11
	[0083.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.853] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1166) returned 1
	[0083.853] CloseHandle (hObject=0x1a8) returned 1
	[0083.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20
	[0083.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0083.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0083.893] lstrlenW (lpString=".doc") returned 4
	[0083.893] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.893] lstrlenW (lpString=".docx") returned 5
	[0083.893] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0083.893] lstrlenW (lpString=".pdf") returned 4
	[0083.893] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.894] lstrlenW (lpString=".xls") returned 4
	[0083.894] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.894] lstrlenW (lpString=".xlsx") returned 5
	[0083.894] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0083.894] lstrlenW (lpString=".ppt") returned 4
	[0083.894] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0083.894] lstrlenW (lpString=".zip") returned 4
	[0083.894] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.894] lstrlenW (lpString=".rar") returned 4
	[0083.894] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.894] lstrlenW (lpString=".bz2") returned 4
	[0083.894] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.894] lstrlenW (lpString=".7z") returned 3
	[0083.894] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0083.894] lstrlenW (lpString=".dbf") returned 4
	[0083.894] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0083.894] lstrlenW (lpString=".1cd") returned 4
	[0083.894] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0083.894] lstrlenW (lpString=".jpg") returned 4
	[0083.894] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0083.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0083.894] lstrlenW (lpString=".doc") returned 4
	[0083.894] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.895] lstrlenW (lpString=".docx") returned 5
	[0083.895] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0083.895] lstrlenW (lpString=".pdf") returned 4
	[0083.895] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.895] lstrlenW (lpString=".xls") returned 4
	[0083.895] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.895] lstrlenW (lpString=".xlsx") returned 5
	[0083.895] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0083.895] lstrlenW (lpString=".ppt") returned 4
	[0083.895] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0083.895] lstrlenW (lpString=".zip") returned 4
	[0083.895] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.895] lstrlenW (lpString=".rar") returned 4
	[0083.895] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.895] lstrlenW (lpString=".bz2") returned 4
	[0083.895] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.895] lstrlenW (lpString=".7z") returned 3
	[0083.895] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0083.895] lstrlenW (lpString=".dbf") returned 4
	[0083.895] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0083.895] lstrlenW (lpString=".1cd") returned 4
	[0083.895] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0083.896] lstrlenW (lpString=".jpg") returned 4
	[0083.896] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.896] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0083.896] lstrlenW (lpString="ipsjpn.xml") returned 10
	[0083.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0083.936] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2522) returned 1
	[0083.936] CloseHandle (hObject=0x188) returned 1
	[0083.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20
	[0084.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0084.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0084.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0084.060] lstrlenW (lpString=".doc") returned 4
	[0084.061] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0084.061] lstrlenW (lpString=".docx") returned 5
	[0084.061] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0084.061] lstrlenW (lpString=".pdf") returned 4
	[0084.061] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0084.061] lstrlenW (lpString=".xls") returned 4
	[0084.061] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0084.061] lstrlenW (lpString=".xlsx") returned 5
	[0084.061] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0084.061] lstrlenW (lpString=".ppt") returned 4
	[0084.061] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0084.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0084.061] lstrlenW (lpString=".zip") returned 4
	[0084.061] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0084.061] lstrlenW (lpString=".rar") returned 4
	[0084.061] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0084.061] lstrlenW (lpString=".bz2") returned 4
	[0084.061] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0084.061] lstrlenW (lpString=".7z") returned 3
	[0084.061] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0084.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0084.061] lstrlenW (lpString=".dbf") returned 4
	[0084.061] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0084.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0084.061] lstrlenW (lpString=".1cd") returned 4
	[0084.061] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0084.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0084.062] lstrlenW (lpString=".jpg") returned 4
	[0084.062] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0084.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0084.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0084.062] lstrlenW (lpString=".doc") returned 4
	[0084.062] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0084.062] lstrlenW (lpString=".docx") returned 5
	[0084.062] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0084.062] lstrlenW (lpString=".pdf") returned 4
	[0084.062] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0084.062] lstrlenW (lpString=".xls") returned 4
	[0084.062] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0084.062] lstrlenW (lpString=".xlsx") returned 5
	[0084.062] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0084.062] lstrlenW (lpString=".ppt") returned 4
	[0084.062] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0084.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0084.062] lstrlenW (lpString=".zip") returned 4
	[0084.062] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0084.062] lstrlenW (lpString=".rar") returned 4
	[0084.062] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0084.062] lstrlenW (lpString=".bz2") returned 4
	[0084.062] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0084.062] lstrlenW (lpString=".7z") returned 3
	[0084.063] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0084.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0084.063] lstrlenW (lpString=".dbf") returned 4
	[0084.063] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0084.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0084.063] lstrlenW (lpString=".1cd") returned 4
	[0084.063] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0084.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0084.063] lstrlenW (lpString=".jpg") returned 4
	[0084.063] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0084.063] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0084.063] lstrlenW (lpString="ipsplk.xml") returned 10
	[0084.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0084.083] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2600) returned 1
	[0084.083] CloseHandle (hObject=0x160) returned 1
	[0084.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20
	[0084.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0084.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0084.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0084.318] lstrlenW (lpString=".doc") returned 4
	[0084.318] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0084.318] lstrlenW (lpString=".docx") returned 5
	[0084.318] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1
	[0084.318] lstrlenW (lpString=".pdf") returned 4
	[0084.318] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0084.318] lstrlenW (lpString=".xls") returned 4
	[0084.318] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0084.318] lstrlenW (lpString=".xlsx") returned 5
	[0084.318] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1
	[0084.318] lstrlenW (lpString=".ppt") returned 4
	[0084.318] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0084.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0084.318] lstrlenW (lpString=".zip") returned 4
	[0084.318] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0084.318] lstrlenW (lpString=".rar") returned 4
	[0084.318] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0084.319] lstrlenW (lpString=".bz2") returned 4
	[0084.319] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0084.319] lstrlenW (lpString=".7z") returned 3
	[0084.319] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0084.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0084.319] lstrlenW (lpString=".dbf") returned 4
	[0084.319] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0084.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0084.319] lstrlenW (lpString=".1cd") returned 4
	[0084.319] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0084.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0084.319] lstrlenW (lpString=".jpg") returned 4
	[0084.319] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0084.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0084.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0084.319] lstrlenW (lpString=".doc") returned 4
	[0084.319] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0084.319] lstrlenW (lpString=".docx") returned 5
	[0084.319] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1
	[0084.319] lstrlenW (lpString=".pdf") returned 4
	[0084.319] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0084.319] lstrlenW (lpString=".xls") returned 4
	[0084.319] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0084.319] lstrlenW (lpString=".xlsx") returned 5
	[0084.319] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1
	[0084.319] lstrlenW (lpString=".ppt") returned 4
	[0084.320] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0084.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0084.320] lstrlenW (lpString=".zip") returned 4
	[0084.320] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0084.320] lstrlenW (lpString=".rar") returned 4
	[0084.320] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0084.320] lstrlenW (lpString=".bz2") returned 4
	[0084.320] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0084.320] lstrlenW (lpString=".7z") returned 3
	[0084.320] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0084.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0084.320] lstrlenW (lpString=".dbf") returned 4
	[0084.320] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0084.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0084.320] lstrlenW (lpString=".1cd") returned 4
	[0084.320] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0084.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0084.320] lstrlenW (lpString=".jpg") returned 4
	[0084.320] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0084.320] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0084.320] lstrlenW (lpString="ipsrus.xml") returned 10
	[0084.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0084.592] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2542) returned 1
	[0084.592] CloseHandle (hObject=0x1a4) returned 1
	[0084.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20
	[0084.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0084.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0084.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0084.618] lstrlenW (lpString=".doc") returned 4
	[0084.618] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0084.618] lstrlenW (lpString=".docx") returned 5
	[0084.618] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0084.618] lstrlenW (lpString=".pdf") returned 4
	[0084.618] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0084.619] lstrlenW (lpString=".xls") returned 4
	[0084.619] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0084.619] lstrlenW (lpString=".xlsx") returned 5
	[0084.619] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0084.619] lstrlenW (lpString=".ppt") returned 4
	[0084.619] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0084.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0084.619] lstrlenW (lpString=".zip") returned 4
	[0084.619] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0084.619] lstrlenW (lpString=".rar") returned 4
	[0084.619] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0084.619] lstrlenW (lpString=".bz2") returned 4
	[0084.619] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0084.619] lstrlenW (lpString=".7z") returned 3
	[0084.619] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0084.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0084.619] lstrlenW (lpString=".dbf") returned 4
	[0084.619] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0084.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0084.619] lstrlenW (lpString=".1cd") returned 4
	[0084.619] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0084.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0084.619] lstrlenW (lpString=".jpg") returned 4
	[0084.620] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0084.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0084.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0084.620] lstrlenW (lpString=".doc") returned 4
	[0084.620] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0084.620] lstrlenW (lpString=".docx") returned 5
	[0084.620] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0084.620] lstrlenW (lpString=".pdf") returned 4
	[0084.620] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0084.620] lstrlenW (lpString=".xls") returned 4
	[0084.620] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0084.620] lstrlenW (lpString=".xlsx") returned 5
	[0084.620] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0084.620] lstrlenW (lpString=".ppt") returned 4
	[0084.620] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0084.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0084.620] lstrlenW (lpString=".zip") returned 4
	[0084.620] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0084.620] lstrlenW (lpString=".rar") returned 4
	[0084.620] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0084.620] lstrlenW (lpString=".bz2") returned 4
	[0084.620] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0084.620] lstrlenW (lpString=".7z") returned 3
	[0084.620] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0084.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0084.621] lstrlenW (lpString=".dbf") returned 4
	[0084.621] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0084.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0084.621] lstrlenW (lpString=".1cd") returned 4
	[0084.621] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0084.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0084.621] lstrlenW (lpString=".jpg") returned 4
	[0084.621] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0084.621] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0084.621] lstrlenW (lpString="ipssve.xml") returned 10
	[0084.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0084.748] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2520) returned 1
	[0084.748] CloseHandle (hObject=0x160) returned 1
	[0084.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20
	[0084.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0084.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0084.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0084.989] lstrlenW (lpString=".doc") returned 4
	[0084.989] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0084.989] lstrlenW (lpString=".docx") returned 5
	[0084.989] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0084.989] lstrlenW (lpString=".pdf") returned 4
	[0084.989] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0084.989] lstrlenW (lpString=".xls") returned 4
	[0084.989] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0084.989] lstrlenW (lpString=".xlsx") returned 5
	[0084.990] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0084.990] lstrlenW (lpString=".ppt") returned 4
	[0084.990] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0084.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0084.990] lstrlenW (lpString=".zip") returned 4
	[0084.990] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0084.990] lstrlenW (lpString=".rar") returned 4
	[0084.990] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0084.990] lstrlenW (lpString=".bz2") returned 4
	[0084.990] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0084.990] lstrlenW (lpString=".7z") returned 3
	[0084.990] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0084.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0084.990] lstrlenW (lpString=".dbf") returned 4
	[0084.990] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0084.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0084.990] lstrlenW (lpString=".1cd") returned 4
	[0084.990] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0084.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0084.990] lstrlenW (lpString=".jpg") returned 4
	[0084.990] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0084.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0084.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0084.991] lstrlenW (lpString=".doc") returned 4
	[0084.991] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0084.991] lstrlenW (lpString=".docx") returned 5
	[0084.991] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0084.991] lstrlenW (lpString=".pdf") returned 4
	[0084.991] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0084.991] lstrlenW (lpString=".xls") returned 4
	[0084.991] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0084.991] lstrlenW (lpString=".xlsx") returned 5
	[0084.991] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0084.991] lstrlenW (lpString=".ppt") returned 4
	[0084.991] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0084.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0084.991] lstrlenW (lpString=".zip") returned 4
	[0084.991] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0084.991] lstrlenW (lpString=".rar") returned 4
	[0084.991] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0084.991] lstrlenW (lpString=".bz2") returned 4
	[0084.991] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0084.991] lstrlenW (lpString=".7z") returned 3
	[0084.991] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0084.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0084.991] lstrlenW (lpString=".dbf") returned 4
	[0084.991] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0084.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0084.992] lstrlenW (lpString=".1cd") returned 4
	[0084.992] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0084.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0084.992] lstrlenW (lpString=".jpg") returned 4
	[0084.992] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0084.992] lstrcmpiW (lpString1=".CHM", lpString2=".adobe") returned 1
	[0084.992] lstrlenW (lpString="PSS10R.CHM") returned 10
	[0084.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0084.993] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=27195) returned 1
	[0084.993] CloseHandle (hObject=0x194) returned 1
	[0084.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20
	[0084.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0084.994] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.994] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0084.995] GetLastError () returned 0x0
	[0084.995] ReadFile (in: hFile=0x194, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x6a3b, lpOverlapped=0x0) returned 1
	[0085.018] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6a40, lpOverlapped=0x0) returned 1
	[0085.019] ReadFile (in: hFile=0x194, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.019] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0085.020] SetEndOfFile (hFile=0x198) returned 1
	[0085.027] CloseHandle (hObject=0x198) returned 1
	[0085.028] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.028] SetEndOfFile (hFile=0x194) returned 1
	[0085.034] CloseHandle (hObject=0x194) returned 1
	[0085.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.090] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1
	[0085.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0085.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0085.104] lstrlenW (lpString=".doc") returned 4
	[0085.104] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0085.104] lstrlenW (lpString=".docx") returned 5
	[0085.104] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1
	[0085.104] lstrlenW (lpString=".pdf") returned 4
	[0085.104] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0085.104] lstrlenW (lpString=".xls") returned 4
	[0085.104] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0085.105] lstrlenW (lpString=".xlsx") returned 5
	[0085.105] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1
	[0085.105] lstrlenW (lpString=".ppt") returned 4
	[0085.105] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0085.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0085.105] lstrlenW (lpString=".zip") returned 4
	[0085.105] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0085.105] lstrlenW (lpString=".rar") returned 4
	[0085.105] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0085.105] lstrlenW (lpString=".bz2") returned 4
	[0085.105] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0085.105] lstrlenW (lpString=".7z") returned 3
	[0085.105] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0085.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0085.105] lstrlenW (lpString=".dbf") returned 4
	[0085.105] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0085.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0085.105] lstrlenW (lpString=".1cd") returned 4
	[0085.105] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0085.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0085.105] lstrlenW (lpString=".jpg") returned 4
	[0085.105] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0085.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0085.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0085.105] lstrlenW (lpString=".doc") returned 4
	[0085.106] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0085.106] lstrlenW (lpString=".docx") returned 5
	[0085.106] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1
	[0085.106] lstrlenW (lpString=".pdf") returned 4
	[0085.106] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0085.106] lstrlenW (lpString=".xls") returned 4
	[0085.106] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0085.106] lstrlenW (lpString=".xlsx") returned 5
	[0085.106] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1
	[0085.106] lstrlenW (lpString=".ppt") returned 4
	[0085.106] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0085.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0085.106] lstrlenW (lpString=".zip") returned 4
	[0085.106] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0085.106] lstrlenW (lpString=".rar") returned 4
	[0085.106] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0085.106] lstrlenW (lpString=".bz2") returned 4
	[0085.106] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0085.106] lstrlenW (lpString=".7z") returned 3
	[0085.106] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0085.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0085.106] lstrlenW (lpString=".dbf") returned 4
	[0085.106] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0085.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0085.106] lstrlenW (lpString=".1cd") returned 4
	[0085.106] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0085.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0085.106] lstrlenW (lpString=".jpg") returned 4
	[0085.107] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0085.107] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.107] lstrlenW (lpString="Office32MUI.XML") returned 15
	[0085.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0085.112] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1383) returned 1
	[0085.112] CloseHandle (hObject=0x188) returned 1
	[0085.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20
	[0085.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0085.113] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.113] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0085.128] GetLastError () returned 0x0
	[0085.128] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x567, lpOverlapped=0x0) returned 1
	[0085.135] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x570, lpOverlapped=0x0) returned 1
	[0085.137] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.137] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0085.137] SetEndOfFile (hFile=0x194) returned 1
	[0085.137] CloseHandle (hObject=0x194) returned 1
	[0085.137] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.137] SetEndOfFile (hFile=0x188) returned 1
	[0085.138] CloseHandle (hObject=0x188) returned 1
	[0085.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.139] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1
	[0085.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0085.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0085.142] lstrlenW (lpString=".doc") returned 4
	[0085.142] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.142] lstrlenW (lpString=".docx") returned 5
	[0085.142] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0085.142] lstrlenW (lpString=".pdf") returned 4
	[0085.142] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.142] lstrlenW (lpString=".xls") returned 4
	[0085.142] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.142] lstrlenW (lpString=".xlsx") returned 5
	[0085.142] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0085.142] lstrlenW (lpString=".ppt") returned 4
	[0085.143] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0085.143] lstrlenW (lpString=".zip") returned 4
	[0085.143] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.143] lstrlenW (lpString=".rar") returned 4
	[0085.143] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.143] lstrlenW (lpString=".bz2") returned 4
	[0085.143] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.143] lstrlenW (lpString=".7z") returned 3
	[0085.143] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0085.143] lstrlenW (lpString=".dbf") returned 4
	[0085.143] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0085.143] lstrlenW (lpString=".1cd") returned 4
	[0085.143] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0085.143] lstrlenW (lpString=".jpg") returned 4
	[0085.143] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0085.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0085.143] lstrlenW (lpString=".doc") returned 4
	[0085.143] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.143] lstrlenW (lpString=".docx") returned 5
	[0085.143] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0085.144] lstrlenW (lpString=".pdf") returned 4
	[0085.144] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.144] lstrlenW (lpString=".xls") returned 4
	[0085.144] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.144] lstrlenW (lpString=".xlsx") returned 5
	[0085.144] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0085.144] lstrlenW (lpString=".ppt") returned 4
	[0085.144] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0085.144] lstrlenW (lpString=".zip") returned 4
	[0085.144] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.144] lstrlenW (lpString=".rar") returned 4
	[0085.144] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.144] lstrlenW (lpString=".bz2") returned 4
	[0085.144] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.144] lstrlenW (lpString=".7z") returned 3
	[0085.144] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0085.144] lstrlenW (lpString=".dbf") returned 4
	[0085.144] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0085.144] lstrlenW (lpString=".1cd") returned 4
	[0085.144] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0085.144] lstrlenW (lpString=".jpg") returned 4
	[0085.144] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.145] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.145] lstrlenW (lpString="Office32WW.XML") returned 14
	[0085.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0085.145] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4274) returned 1
	[0085.146] CloseHandle (hObject=0x188) returned 1
	[0085.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20
	[0085.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0085.146] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.146] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0085.147] GetLastError () returned 0x0
	[0085.147] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0085.159] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0085.161] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.161] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0085.161] SetEndOfFile (hFile=0x194) returned 1
	[0085.161] CloseHandle (hObject=0x194) returned 1
	[0085.162] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.162] SetEndOfFile (hFile=0x188) returned 1
	[0085.163] CloseHandle (hObject=0x188) returned 1
	[0085.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.163] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1
	[0085.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0085.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0085.164] lstrlenW (lpString=".doc") returned 4
	[0085.164] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.164] lstrlenW (lpString=".docx") returned 5
	[0085.164] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0085.164] lstrlenW (lpString=".pdf") returned 4
	[0085.164] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.164] lstrlenW (lpString=".xls") returned 4
	[0085.164] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.164] lstrlenW (lpString=".xlsx") returned 5
	[0085.164] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0085.164] lstrlenW (lpString=".ppt") returned 4
	[0085.164] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0085.164] lstrlenW (lpString=".zip") returned 4
	[0085.164] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.164] lstrlenW (lpString=".rar") returned 4
	[0085.164] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.164] lstrlenW (lpString=".bz2") returned 4
	[0085.164] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.164] lstrlenW (lpString=".7z") returned 3
	[0085.165] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0085.165] lstrlenW (lpString=".dbf") returned 4
	[0085.165] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0085.165] lstrlenW (lpString=".1cd") returned 4
	[0085.165] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0085.165] lstrlenW (lpString=".jpg") returned 4
	[0085.165] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0085.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0085.165] lstrlenW (lpString=".doc") returned 4
	[0085.165] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.165] lstrlenW (lpString=".docx") returned 5
	[0085.165] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0085.165] lstrlenW (lpString=".pdf") returned 4
	[0085.165] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.165] lstrlenW (lpString=".xls") returned 4
	[0085.165] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.165] lstrlenW (lpString=".xlsx") returned 5
	[0085.165] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0085.165] lstrlenW (lpString=".ppt") returned 4
	[0085.165] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0085.166] lstrlenW (lpString=".zip") returned 4
	[0085.166] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.166] lstrlenW (lpString=".rar") returned 4
	[0085.166] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.166] lstrlenW (lpString=".bz2") returned 4
	[0085.166] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.166] lstrlenW (lpString=".7z") returned 3
	[0085.166] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0085.166] lstrlenW (lpString=".dbf") returned 4
	[0085.166] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0085.166] lstrlenW (lpString=".1cd") returned 4
	[0085.166] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0085.166] lstrlenW (lpString=".jpg") returned 4
	[0085.166] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.166] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.166] lstrlenW (lpString="SETUP.XML") returned 9
	[0085.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0085.277] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1988) returned 1
	[0085.277] CloseHandle (hObject=0x184) returned 1
	[0085.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20
	[0085.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0085.278] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.278] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0085.278] GetLastError () returned 0x0
	[0085.278] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x7c4, lpOverlapped=0x0) returned 1
	[0085.290] WriteFile (in: hFile=0x1b4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7d0, lpOverlapped=0x0) returned 1
	[0085.291] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.292] WriteFile (in: hFile=0x1b4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0085.292] SetEndOfFile (hFile=0x1b4) returned 1
	[0085.292] CloseHandle (hObject=0x1b4) returned 1
	[0085.292] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.292] SetEndOfFile (hFile=0x184) returned 1
	[0085.293] CloseHandle (hObject=0x184) returned 1
	[0085.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.294] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1
	[0085.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0085.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0085.294] lstrlenW (lpString=".doc") returned 4
	[0085.294] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.294] lstrlenW (lpString=".docx") returned 5
	[0085.294] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.294] lstrlenW (lpString=".pdf") returned 4
	[0085.294] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.294] lstrlenW (lpString=".xls") returned 4
	[0085.294] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.294] lstrlenW (lpString=".xlsx") returned 5
	[0085.294] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.294] lstrlenW (lpString=".ppt") returned 4
	[0085.294] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0085.294] lstrlenW (lpString=".zip") returned 4
	[0085.295] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.295] lstrlenW (lpString=".rar") returned 4
	[0085.295] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.295] lstrlenW (lpString=".bz2") returned 4
	[0085.295] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.295] lstrlenW (lpString=".7z") returned 3
	[0085.295] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0085.295] lstrlenW (lpString=".dbf") returned 4
	[0085.295] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0085.295] lstrlenW (lpString=".1cd") returned 4
	[0085.295] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0085.295] lstrlenW (lpString=".jpg") returned 4
	[0085.295] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0085.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0085.296] lstrlenW (lpString=".doc") returned 4
	[0085.296] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.296] lstrlenW (lpString=".docx") returned 5
	[0085.296] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.296] lstrlenW (lpString=".pdf") returned 4
	[0085.296] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.296] lstrlenW (lpString=".xls") returned 4
	[0085.296] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.296] lstrlenW (lpString=".xlsx") returned 5
	[0085.296] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.296] lstrlenW (lpString=".ppt") returned 4
	[0085.296] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0085.296] lstrlenW (lpString=".zip") returned 4
	[0085.296] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.296] lstrlenW (lpString=".rar") returned 4
	[0085.296] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.296] lstrlenW (lpString=".bz2") returned 4
	[0085.296] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.296] lstrlenW (lpString=".7z") returned 3
	[0085.296] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0085.296] lstrlenW (lpString=".dbf") returned 4
	[0085.297] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0085.297] lstrlenW (lpString=".1cd") returned 4
	[0085.297] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0085.297] lstrlenW (lpString=".jpg") returned 4
	[0085.297] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.297] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.297] lstrlenW (lpString="SETUP.XML") returned 9
	[0085.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.345] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4207) returned 1
	[0085.345] CloseHandle (hObject=0x1a4) returned 1
	[0085.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20
	[0085.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.346] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.346] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.347] GetLastError () returned 0x0
	[0085.347] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x106f, lpOverlapped=0x0) returned 1
	[0085.360] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1070, lpOverlapped=0x0) returned 1
	[0085.362] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.362] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0085.362] SetEndOfFile (hFile=0x198) returned 1
	[0085.362] CloseHandle (hObject=0x198) returned 1
	[0085.362] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.362] SetEndOfFile (hFile=0x1a4) returned 1
	[0085.363] CloseHandle (hObject=0x1a4) returned 1
	[0085.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.364] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1
	[0085.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0085.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0085.364] lstrlenW (lpString=".doc") returned 4
	[0085.364] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.364] lstrlenW (lpString=".docx") returned 5
	[0085.364] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.364] lstrlenW (lpString=".pdf") returned 4
	[0085.364] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.364] lstrlenW (lpString=".xls") returned 4
	[0085.365] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.365] lstrlenW (lpString=".xlsx") returned 5
	[0085.365] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.365] lstrlenW (lpString=".ppt") returned 4
	[0085.365] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0085.365] lstrlenW (lpString=".zip") returned 4
	[0085.365] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.365] lstrlenW (lpString=".rar") returned 4
	[0085.365] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.365] lstrlenW (lpString=".bz2") returned 4
	[0085.365] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.365] lstrlenW (lpString=".7z") returned 3
	[0085.365] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0085.365] lstrlenW (lpString=".dbf") returned 4
	[0085.365] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0085.365] lstrlenW (lpString=".1cd") returned 4
	[0085.365] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0085.365] lstrlenW (lpString=".jpg") returned 4
	[0085.365] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0085.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0085.365] lstrlenW (lpString=".doc") returned 4
	[0085.366] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.366] lstrlenW (lpString=".docx") returned 5
	[0085.366] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.366] lstrlenW (lpString=".pdf") returned 4
	[0085.366] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.366] lstrlenW (lpString=".xls") returned 4
	[0085.366] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.366] lstrlenW (lpString=".xlsx") returned 5
	[0085.366] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.366] lstrlenW (lpString=".ppt") returned 4
	[0085.366] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0085.366] lstrlenW (lpString=".zip") returned 4
	[0085.366] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.366] lstrlenW (lpString=".rar") returned 4
	[0085.366] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.366] lstrlenW (lpString=".bz2") returned 4
	[0085.366] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.366] lstrlenW (lpString=".7z") returned 3
	[0085.366] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0085.366] lstrlenW (lpString=".dbf") returned 4
	[0085.366] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0085.366] lstrlenW (lpString=".1cd") returned 4
	[0085.366] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0085.366] lstrlenW (lpString=".jpg") returned 4
	[0085.367] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.367] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.367] lstrlenW (lpString="ProjectMUI.XML") returned 14
	[0085.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.367] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1452) returned 1
	[0085.367] CloseHandle (hObject=0x1a4) returned 1
	[0085.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20
	[0085.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.368] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.368] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.371] GetLastError () returned 0x0
	[0085.371] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x5ac, lpOverlapped=0x0) returned 1
	[0085.374] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0085.375] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.375] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0085.375] SetEndOfFile (hFile=0x198) returned 1
	[0085.376] CloseHandle (hObject=0x198) returned 1
	[0085.376] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.376] SetEndOfFile (hFile=0x1a4) returned 1
	[0085.377] CloseHandle (hObject=0x1a4) returned 1
	[0085.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.377] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1
	[0085.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0085.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0085.378] lstrlenW (lpString=".doc") returned 4
	[0085.378] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.378] lstrlenW (lpString=".docx") returned 5
	[0085.378] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0085.378] lstrlenW (lpString=".pdf") returned 4
	[0085.378] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.378] lstrlenW (lpString=".xls") returned 4
	[0085.378] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.378] lstrlenW (lpString=".xlsx") returned 5
	[0085.378] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0085.378] lstrlenW (lpString=".ppt") returned 4
	[0085.378] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0085.378] lstrlenW (lpString=".zip") returned 4
	[0085.378] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.378] lstrlenW (lpString=".rar") returned 4
	[0085.378] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.378] lstrlenW (lpString=".bz2") returned 4
	[0085.378] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.378] lstrlenW (lpString=".7z") returned 3
	[0085.378] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0085.379] lstrlenW (lpString=".dbf") returned 4
	[0085.379] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0085.379] lstrlenW (lpString=".1cd") returned 4
	[0085.379] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0085.379] lstrlenW (lpString=".jpg") returned 4
	[0085.379] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0085.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0085.379] lstrlenW (lpString=".doc") returned 4
	[0085.379] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.379] lstrlenW (lpString=".docx") returned 5
	[0085.379] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0085.379] lstrlenW (lpString=".pdf") returned 4
	[0085.379] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.379] lstrlenW (lpString=".xls") returned 4
	[0085.379] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.379] lstrlenW (lpString=".xlsx") returned 5
	[0085.379] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0085.379] lstrlenW (lpString=".ppt") returned 4
	[0085.379] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0085.379] lstrlenW (lpString=".zip") returned 4
	[0085.379] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.380] lstrlenW (lpString=".rar") returned 4
	[0085.380] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.380] lstrlenW (lpString=".bz2") returned 4
	[0085.380] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.380] lstrlenW (lpString=".7z") returned 3
	[0085.380] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0085.380] lstrlenW (lpString=".dbf") returned 4
	[0085.380] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0085.380] lstrlenW (lpString=".1cd") returned 4
	[0085.380] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0085.380] lstrlenW (lpString=".jpg") returned 4
	[0085.380] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.380] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.380] lstrlenW (lpString="SETUP.XML") returned 9
	[0085.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.381] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1872) returned 1
	[0085.381] CloseHandle (hObject=0x1a4) returned 1
	[0085.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20
	[0085.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.382] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.382] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.382] GetLastError () returned 0x0
	[0085.382] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x750, lpOverlapped=0x0) returned 1
	[0085.425] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x760, lpOverlapped=0x0) returned 1
	[0085.426] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.426] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0085.426] SetEndOfFile (hFile=0x198) returned 1
	[0085.426] CloseHandle (hObject=0x198) returned 1
	[0085.427] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.427] SetEndOfFile (hFile=0x1a4) returned 1
	[0085.428] CloseHandle (hObject=0x1a4) returned 1
	[0085.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.429] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1
	[0085.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0085.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0085.429] lstrlenW (lpString=".doc") returned 4
	[0085.429] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.430] lstrlenW (lpString=".docx") returned 5
	[0085.430] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.430] lstrlenW (lpString=".pdf") returned 4
	[0085.430] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.430] lstrlenW (lpString=".xls") returned 4
	[0085.430] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.430] lstrlenW (lpString=".xlsx") returned 5
	[0085.430] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.430] lstrlenW (lpString=".ppt") returned 4
	[0085.430] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0085.430] lstrlenW (lpString=".zip") returned 4
	[0085.430] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.430] lstrlenW (lpString=".rar") returned 4
	[0085.430] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.430] lstrlenW (lpString=".bz2") returned 4
	[0085.430] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.430] lstrlenW (lpString=".7z") returned 3
	[0085.430] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0085.430] lstrlenW (lpString=".dbf") returned 4
	[0085.430] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0085.430] lstrlenW (lpString=".1cd") returned 4
	[0085.430] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0085.431] lstrlenW (lpString=".jpg") returned 4
	[0085.431] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0085.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0085.431] lstrlenW (lpString=".doc") returned 4
	[0085.431] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.431] lstrlenW (lpString=".docx") returned 5
	[0085.431] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.431] lstrlenW (lpString=".pdf") returned 4
	[0085.431] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.431] lstrlenW (lpString=".xls") returned 4
	[0085.431] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.431] lstrlenW (lpString=".xlsx") returned 5
	[0085.431] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.431] lstrlenW (lpString=".ppt") returned 4
	[0085.431] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0085.431] lstrlenW (lpString=".zip") returned 4
	[0085.431] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.431] lstrlenW (lpString=".rar") returned 4
	[0085.431] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.431] lstrlenW (lpString=".bz2") returned 4
	[0085.432] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.432] lstrlenW (lpString=".7z") returned 3
	[0085.432] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0085.432] lstrlenW (lpString=".dbf") returned 4
	[0085.432] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0085.432] lstrlenW (lpString=".1cd") returned 4
	[0085.432] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0085.432] lstrlenW (lpString=".jpg") returned 4
	[0085.432] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.432] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.432] lstrlenW (lpString="Proof.XML") returned 9
	[0085.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.433] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1347) returned 1
	[0085.433] CloseHandle (hObject=0x1a4) returned 1
	[0085.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20
	[0085.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.434] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.434] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.434] GetLastError () returned 0x0
	[0085.434] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x543, lpOverlapped=0x0) returned 1
	[0085.449] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0085.450] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.450] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0085.450] SetEndOfFile (hFile=0x198) returned 1
	[0085.450] CloseHandle (hObject=0x198) returned 1
	[0085.451] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.451] SetEndOfFile (hFile=0x1a4) returned 1
	[0085.452] CloseHandle (hObject=0x1a4) returned 1
	[0085.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.452] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1
	[0085.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0085.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0085.453] lstrlenW (lpString=".doc") returned 4
	[0085.453] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.453] lstrlenW (lpString=".docx") returned 5
	[0085.453] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0085.453] lstrlenW (lpString=".pdf") returned 4
	[0085.453] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.453] lstrlenW (lpString=".xls") returned 4
	[0085.453] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.453] lstrlenW (lpString=".xlsx") returned 5
	[0085.453] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0085.453] lstrlenW (lpString=".ppt") returned 4
	[0085.453] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0085.453] lstrlenW (lpString=".zip") returned 4
	[0085.453] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.453] lstrlenW (lpString=".rar") returned 4
	[0085.453] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.453] lstrlenW (lpString=".bz2") returned 4
	[0085.453] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.453] lstrlenW (lpString=".7z") returned 3
	[0085.453] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0085.453] lstrlenW (lpString=".dbf") returned 4
	[0085.454] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0085.454] lstrlenW (lpString=".1cd") returned 4
	[0085.454] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0085.454] lstrlenW (lpString=".jpg") returned 4
	[0085.454] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0085.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0085.454] lstrlenW (lpString=".doc") returned 4
	[0085.454] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.454] lstrlenW (lpString=".docx") returned 5
	[0085.454] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0085.454] lstrlenW (lpString=".pdf") returned 4
	[0085.454] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.454] lstrlenW (lpString=".xls") returned 4
	[0085.454] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.454] lstrlenW (lpString=".xlsx") returned 5
	[0085.454] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0085.454] lstrlenW (lpString=".ppt") returned 4
	[0085.454] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0085.454] lstrlenW (lpString=".zip") returned 4
	[0085.454] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.454] lstrlenW (lpString=".rar") returned 4
	[0085.455] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.455] lstrlenW (lpString=".bz2") returned 4
	[0085.455] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.455] lstrlenW (lpString=".7z") returned 3
	[0085.455] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0085.455] lstrlenW (lpString=".dbf") returned 4
	[0085.455] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0085.455] lstrlenW (lpString=".1cd") returned 4
	[0085.455] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0085.455] lstrlenW (lpString=".jpg") returned 4
	[0085.455] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.455] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.455] lstrlenW (lpString="Proof.XML") returned 9
	[0085.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.456] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1458) returned 1
	[0085.456] CloseHandle (hObject=0x1a4) returned 1
	[0085.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20
	[0085.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.457] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.457] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.458] GetLastError () returned 0x0
	[0085.458] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x5b2, lpOverlapped=0x0) returned 1
	[0085.463] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0085.465] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.465] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0085.465] SetEndOfFile (hFile=0x198) returned 1
	[0085.465] CloseHandle (hObject=0x198) returned 1
	[0085.466] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.466] SetEndOfFile (hFile=0x1a4) returned 1
	[0085.467] CloseHandle (hObject=0x1a4) returned 1
	[0085.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.467] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1
	[0085.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0085.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0085.468] lstrlenW (lpString=".doc") returned 4
	[0085.468] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.468] lstrlenW (lpString=".docx") returned 5
	[0085.468] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0085.468] lstrlenW (lpString=".pdf") returned 4
	[0085.468] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.468] lstrlenW (lpString=".xls") returned 4
	[0085.468] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.468] lstrlenW (lpString=".xlsx") returned 5
	[0085.468] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0085.468] lstrlenW (lpString=".ppt") returned 4
	[0085.468] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0085.468] lstrlenW (lpString=".zip") returned 4
	[0085.468] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.468] lstrlenW (lpString=".rar") returned 4
	[0085.468] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.468] lstrlenW (lpString=".bz2") returned 4
	[0085.468] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.468] lstrlenW (lpString=".7z") returned 3
	[0085.468] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0085.468] lstrlenW (lpString=".dbf") returned 4
	[0085.468] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0085.469] lstrlenW (lpString=".1cd") returned 4
	[0085.469] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0085.469] lstrlenW (lpString=".jpg") returned 4
	[0085.469] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0085.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0085.469] lstrlenW (lpString=".doc") returned 4
	[0085.469] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.469] lstrlenW (lpString=".docx") returned 5
	[0085.469] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0085.469] lstrlenW (lpString=".pdf") returned 4
	[0085.469] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.469] lstrlenW (lpString=".xls") returned 4
	[0085.469] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.469] lstrlenW (lpString=".xlsx") returned 5
	[0085.469] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0085.469] lstrlenW (lpString=".ppt") returned 4
	[0085.469] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0085.469] lstrlenW (lpString=".zip") returned 4
	[0085.469] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.469] lstrlenW (lpString=".rar") returned 4
	[0085.469] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.470] lstrlenW (lpString=".bz2") returned 4
	[0085.470] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.470] lstrlenW (lpString=".7z") returned 3
	[0085.470] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0085.470] lstrlenW (lpString=".dbf") returned 4
	[0085.470] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0085.470] lstrlenW (lpString=".1cd") returned 4
	[0085.470] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0085.470] lstrlenW (lpString=".jpg") returned 4
	[0085.470] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.470] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.470] lstrlenW (lpString="Proofing.XML") returned 12
	[0085.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.471] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=811) returned 1
	[0085.471] CloseHandle (hObject=0x1a4) returned 1
	[0085.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20
	[0085.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.472] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.472] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.472] GetLastError () returned 0x0
	[0085.472] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x32b, lpOverlapped=0x0) returned 1
	[0085.483] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x330, lpOverlapped=0x0) returned 1
	[0085.485] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.485] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0085.485] SetEndOfFile (hFile=0x198) returned 1
	[0085.501] CloseHandle (hObject=0x198) returned 1
	[0085.513] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.513] SetEndOfFile (hFile=0x1a4) returned 1
	[0085.572] CloseHandle (hObject=0x1a4) returned 1
	[0085.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.572] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1
	[0085.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0085.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0085.573] lstrlenW (lpString=".doc") returned 4
	[0085.573] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.573] lstrlenW (lpString=".docx") returned 5
	[0085.573] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1
	[0085.573] lstrlenW (lpString=".pdf") returned 4
	[0085.573] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.573] lstrlenW (lpString=".xls") returned 4
	[0085.573] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.573] lstrlenW (lpString=".xlsx") returned 5
	[0085.573] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1
	[0085.573] lstrlenW (lpString=".ppt") returned 4
	[0085.573] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0085.573] lstrlenW (lpString=".zip") returned 4
	[0085.573] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.573] lstrlenW (lpString=".rar") returned 4
	[0085.573] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.573] lstrlenW (lpString=".bz2") returned 4
	[0085.573] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.573] lstrlenW (lpString=".7z") returned 3
	[0085.573] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0085.573] lstrlenW (lpString=".dbf") returned 4
	[0085.573] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0085.573] lstrlenW (lpString=".1cd") returned 4
	[0085.574] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0085.574] lstrlenW (lpString=".jpg") returned 4
	[0085.574] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0085.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0085.574] lstrlenW (lpString=".doc") returned 4
	[0085.574] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.574] lstrlenW (lpString=".docx") returned 5
	[0085.574] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1
	[0085.574] lstrlenW (lpString=".pdf") returned 4
	[0085.574] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.574] lstrlenW (lpString=".xls") returned 4
	[0085.574] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.574] lstrlenW (lpString=".xlsx") returned 5
	[0085.574] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1
	[0085.574] lstrlenW (lpString=".ppt") returned 4
	[0085.574] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0085.574] lstrlenW (lpString=".zip") returned 4
	[0085.574] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.574] lstrlenW (lpString=".rar") returned 4
	[0085.574] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.574] lstrlenW (lpString=".bz2") returned 4
	[0085.575] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.575] lstrlenW (lpString=".7z") returned 3
	[0085.575] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0085.575] lstrlenW (lpString=".dbf") returned 4
	[0085.575] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0085.575] lstrlenW (lpString=".1cd") returned 4
	[0085.575] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0085.575] lstrlenW (lpString=".jpg") returned 4
	[0085.575] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.575] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.575] lstrlenW (lpString="ProPlusrWW.XML") returned 14
	[0085.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.601] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=16852) returned 1
	[0085.601] CloseHandle (hObject=0x1a4) returned 1
	[0085.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20
	[0085.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0085.849] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.849] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0085.924] GetLastError () returned 0x0
	[0085.924] ReadFile (in: hFile=0x1b4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x41d4, lpOverlapped=0x0) returned 1
	[0085.930] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x41e0, lpOverlapped=0x0) returned 1
	[0085.931] ReadFile (in: hFile=0x1b4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.931] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0085.931] SetEndOfFile (hFile=0x188) returned 1
	[0086.016] CloseHandle (hObject=0x188) returned 1
	[0086.018] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.018] SetEndOfFile (hFile=0x1b4) returned 1
	[0086.022] CloseHandle (hObject=0x1b4) returned 1
	[0086.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.022] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1
	[0086.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0086.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0086.022] lstrlenW (lpString=".doc") returned 4
	[0086.022] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.022] lstrlenW (lpString=".docx") returned 5
	[0086.022] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0086.022] lstrlenW (lpString=".pdf") returned 4
	[0086.022] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.022] lstrlenW (lpString=".xls") returned 4
	[0086.023] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.023] lstrlenW (lpString=".xlsx") returned 5
	[0086.023] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0086.023] lstrlenW (lpString=".ppt") returned 4
	[0086.023] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0086.023] lstrlenW (lpString=".zip") returned 4
	[0086.023] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.023] lstrlenW (lpString=".rar") returned 4
	[0086.023] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.023] lstrlenW (lpString=".bz2") returned 4
	[0086.023] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.023] lstrlenW (lpString=".7z") returned 3
	[0086.023] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0086.023] lstrlenW (lpString=".dbf") returned 4
	[0086.023] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0086.023] lstrlenW (lpString=".1cd") returned 4
	[0086.023] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0086.023] lstrlenW (lpString=".jpg") returned 4
	[0086.023] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0086.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0086.023] lstrlenW (lpString=".doc") returned 4
	[0086.023] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.023] lstrlenW (lpString=".docx") returned 5
	[0086.023] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0086.023] lstrlenW (lpString=".pdf") returned 4
	[0086.024] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.024] lstrlenW (lpString=".xls") returned 4
	[0086.024] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.024] lstrlenW (lpString=".xlsx") returned 5
	[0086.024] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0086.024] lstrlenW (lpString=".ppt") returned 4
	[0086.024] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0086.024] lstrlenW (lpString=".zip") returned 4
	[0086.024] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.024] lstrlenW (lpString=".rar") returned 4
	[0086.024] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.024] lstrlenW (lpString=".bz2") returned 4
	[0086.024] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.024] lstrlenW (lpString=".7z") returned 3
	[0086.024] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0086.024] lstrlenW (lpString=".dbf") returned 4
	[0086.024] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0086.024] lstrlenW (lpString=".1cd") returned 4
	[0086.024] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0086.024] lstrlenW (lpString=".jpg") returned 4
	[0086.024] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.024] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0086.024] lstrlenW (lpString="SETUP.XML") returned 9
	[0086.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0086.046] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=20577) returned 1
	[0086.046] CloseHandle (hObject=0x1a4) returned 1
	[0086.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20
	[0086.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.221] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.221] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0086.227] GetLastError () returned 0x0
	[0086.227] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x5061, lpOverlapped=0x0) returned 1
	[0086.232] WriteFile (in: hFile=0x1a4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5070, lpOverlapped=0x0) returned 1
	[0086.233] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.233] WriteFile (in: hFile=0x1a4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0086.234] SetEndOfFile (hFile=0x1a4) returned 1
	[0086.234] CloseHandle (hObject=0x1a4) returned 1
	[0086.234] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.234] SetEndOfFile (hFile=0x174) returned 1
	[0086.235] CloseHandle (hObject=0x174) returned 1
	[0086.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.236] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1
	[0086.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0086.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0086.236] lstrlenW (lpString=".doc") returned 4
	[0086.236] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.236] lstrlenW (lpString=".docx") returned 5
	[0086.236] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0086.236] lstrlenW (lpString=".pdf") returned 4
	[0086.236] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.236] lstrlenW (lpString=".xls") returned 4
	[0086.236] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.236] lstrlenW (lpString=".xlsx") returned 5
	[0086.236] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0086.236] lstrlenW (lpString=".ppt") returned 4
	[0086.236] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0086.236] lstrlenW (lpString=".zip") returned 4
	[0086.236] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.237] lstrlenW (lpString=".rar") returned 4
	[0086.237] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.237] lstrlenW (lpString=".bz2") returned 4
	[0086.237] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.237] lstrlenW (lpString=".7z") returned 3
	[0086.237] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0086.237] lstrlenW (lpString=".dbf") returned 4
	[0086.237] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0086.237] lstrlenW (lpString=".1cd") returned 4
	[0086.237] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0086.237] lstrlenW (lpString=".jpg") returned 4
	[0086.237] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0086.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0086.237] lstrlenW (lpString=".doc") returned 4
	[0086.237] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.237] lstrlenW (lpString=".docx") returned 5
	[0086.237] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0086.237] lstrlenW (lpString=".pdf") returned 4
	[0086.237] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.237] lstrlenW (lpString=".xls") returned 4
	[0086.237] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.237] lstrlenW (lpString=".xlsx") returned 5
	[0086.238] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0086.238] lstrlenW (lpString=".ppt") returned 4
	[0086.238] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0086.238] lstrlenW (lpString=".zip") returned 4
	[0086.238] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.238] lstrlenW (lpString=".rar") returned 4
	[0086.238] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.238] lstrlenW (lpString=".bz2") returned 4
	[0086.238] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.238] lstrlenW (lpString=".7z") returned 3
	[0086.238] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0086.238] lstrlenW (lpString=".dbf") returned 4
	[0086.238] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0086.238] lstrlenW (lpString=".1cd") returned 4
	[0086.238] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0086.238] lstrlenW (lpString=".jpg") returned 4
	[0086.238] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.239] lstrcmpiW (lpString1=".HTM", lpString2=".adobe") returned 1
	[0086.239] lstrlenW (lpString="MCABOUT.HTM") returned 11
	[0086.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.249] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=11463) returned 1
	[0086.249] CloseHandle (hObject=0x194) returned 1
	[0086.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20
	[0086.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0086.295] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.295] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.301] GetLastError () returned 0x0
	[0086.301] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2cc7, lpOverlapped=0x0) returned 1
	[0086.336] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2cd0, lpOverlapped=0x0) returned 1
	[0086.337] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.337] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0086.338] SetEndOfFile (hFile=0x194) returned 1
	[0086.338] CloseHandle (hObject=0x194) returned 1
	[0086.338] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.338] SetEndOfFile (hFile=0x1a4) returned 1
	[0086.339] CloseHandle (hObject=0x1a4) returned 1
	[0086.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.339] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1
	[0086.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0086.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0086.340] lstrlenW (lpString=".doc") returned 4
	[0086.340] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0086.340] lstrlenW (lpString=".docx") returned 5
	[0086.340] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1
	[0086.340] lstrlenW (lpString=".pdf") returned 4
	[0086.340] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0086.340] lstrlenW (lpString=".xls") returned 4
	[0086.340] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0086.340] lstrlenW (lpString=".xlsx") returned 5
	[0086.340] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1
	[0086.340] lstrlenW (lpString=".ppt") returned 4
	[0086.340] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0086.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0086.340] lstrlenW (lpString=".zip") returned 4
	[0086.340] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0086.340] lstrlenW (lpString=".rar") returned 4
	[0086.340] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0086.340] lstrlenW (lpString=".bz2") returned 4
	[0086.340] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0086.341] lstrlenW (lpString=".7z") returned 3
	[0086.341] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0086.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0086.341] lstrlenW (lpString=".dbf") returned 4
	[0086.341] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0086.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0086.341] lstrlenW (lpString=".1cd") returned 4
	[0086.341] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0086.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0086.341] lstrlenW (lpString=".jpg") returned 4
	[0086.341] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0086.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0086.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0086.341] lstrlenW (lpString=".doc") returned 4
	[0086.341] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0086.341] lstrlenW (lpString=".docx") returned 5
	[0086.341] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1
	[0086.341] lstrlenW (lpString=".pdf") returned 4
	[0086.341] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0086.341] lstrlenW (lpString=".xls") returned 4
	[0086.341] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0086.341] lstrlenW (lpString=".xlsx") returned 5
	[0086.341] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1
	[0086.341] lstrlenW (lpString=".ppt") returned 4
	[0086.341] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0086.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0086.342] lstrlenW (lpString=".zip") returned 4
	[0086.342] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0086.342] lstrlenW (lpString=".rar") returned 4
	[0086.342] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0086.342] lstrlenW (lpString=".bz2") returned 4
	[0086.342] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0086.342] lstrlenW (lpString=".7z") returned 3
	[0086.342] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0086.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0086.342] lstrlenW (lpString=".dbf") returned 4
	[0086.342] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0086.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0086.342] lstrlenW (lpString=".1cd") returned 4
	[0086.342] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0086.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0086.342] lstrlenW (lpString=".jpg") returned 4
	[0086.342] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0086.342] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0086.342] lstrlenW (lpString="STOCKS.XML") returned 10
	[0086.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.501] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2687) returned 1
	[0086.501] CloseHandle (hObject=0x19c) returned 1
	[0086.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20
	[0086.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0086.772] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.772] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.991] GetLastError () returned 0x0
	[0086.991] ReadFile (in: hFile=0x1ac, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xa7f, lpOverlapped=0x0) returned 1
	[0087.013] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa80, lpOverlapped=0x0) returned 1
	[0087.014] ReadFile (in: hFile=0x1ac, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.014] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0087.014] SetEndOfFile (hFile=0x194) returned 1
	[0087.017] CloseHandle (hObject=0x194) returned 1
	[0087.023] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.023] SetEndOfFile (hFile=0x1ac) returned 1
	[0087.027] CloseHandle (hObject=0x1ac) returned 1
	[0087.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0087.048] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1
	[0087.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0087.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0087.050] lstrlenW (lpString=".doc") returned 4
	[0087.050] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0087.050] lstrlenW (lpString=".docx") returned 5
	[0087.050] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1
	[0087.051] lstrlenW (lpString=".pdf") returned 4
	[0087.051] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0087.051] lstrlenW (lpString=".xls") returned 4
	[0087.051] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0087.051] lstrlenW (lpString=".xlsx") returned 5
	[0087.051] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1
	[0087.051] lstrlenW (lpString=".ppt") returned 4
	[0087.051] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0087.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0087.051] lstrlenW (lpString=".zip") returned 4
	[0087.051] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0087.051] lstrlenW (lpString=".rar") returned 4
	[0087.051] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0087.051] lstrlenW (lpString=".bz2") returned 4
	[0087.051] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0087.051] lstrlenW (lpString=".7z") returned 3
	[0087.051] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0087.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0087.051] lstrlenW (lpString=".dbf") returned 4
	[0087.051] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0087.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0087.051] lstrlenW (lpString=".1cd") returned 4
	[0087.051] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0087.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0087.051] lstrlenW (lpString=".jpg") returned 4
	[0087.051] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0087.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0087.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0087.052] lstrlenW (lpString=".doc") returned 4
	[0087.052] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0087.052] lstrlenW (lpString=".docx") returned 5
	[0087.052] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1
	[0087.052] lstrlenW (lpString=".pdf") returned 4
	[0087.052] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0087.052] lstrlenW (lpString=".xls") returned 4
	[0087.052] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0087.052] lstrlenW (lpString=".xlsx") returned 5
	[0087.052] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1
	[0087.052] lstrlenW (lpString=".ppt") returned 4
	[0087.052] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0087.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0087.052] lstrlenW (lpString=".zip") returned 4
	[0087.052] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0087.052] lstrlenW (lpString=".rar") returned 4
	[0087.052] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0087.052] lstrlenW (lpString=".bz2") returned 4
	[0087.052] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0087.052] lstrlenW (lpString=".7z") returned 3
	[0087.052] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0087.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0087.052] lstrlenW (lpString=".dbf") returned 4
	[0087.052] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0087.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0087.053] lstrlenW (lpString=".1cd") returned 4
	[0087.053] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0087.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0087.053] lstrlenW (lpString=".jpg") returned 4
	[0087.053] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0087.053] lstrcmpiW (lpString1=".emf", lpString2=".adobe") returned 1
	[0087.053] lstrlenW (lpString="Graph.emf") returned 9
	[0087.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0087.129] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=116724) returned 1
	[0087.129] CloseHandle (hObject=0x188) returned 1
	[0087.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20
	[0087.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0087.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0087.231] lstrlenW (lpString=".doc") returned 4
	[0087.231] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0087.231] lstrlenW (lpString=".docx") returned 5
	[0087.231] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1
	[0087.231] lstrlenW (lpString=".pdf") returned 4
	[0087.231] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0087.231] lstrlenW (lpString=".xls") returned 4
	[0087.231] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0087.231] lstrlenW (lpString=".xlsx") returned 5
	[0087.231] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1
	[0087.231] lstrlenW (lpString=".ppt") returned 4
	[0087.231] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0087.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0087.231] lstrlenW (lpString=".zip") returned 4
	[0087.231] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0087.231] lstrlenW (lpString=".rar") returned 4
	[0087.231] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0087.231] lstrlenW (lpString=".bz2") returned 4
	[0087.231] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0087.231] lstrlenW (lpString=".7z") returned 3
	[0087.231] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0087.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0087.231] lstrlenW (lpString=".dbf") returned 4
	[0087.231] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0087.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0087.232] lstrlenW (lpString=".1cd") returned 4
	[0087.232] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0087.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0087.232] lstrlenW (lpString=".jpg") returned 4
	[0087.232] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0087.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0087.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0087.232] lstrlenW (lpString=".doc") returned 4
	[0087.232] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0087.232] lstrlenW (lpString=".docx") returned 5
	[0087.232] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1
	[0087.232] lstrlenW (lpString=".pdf") returned 4
	[0087.232] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0087.232] lstrlenW (lpString=".xls") returned 4
	[0087.232] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0087.232] lstrlenW (lpString=".xlsx") returned 5
	[0087.232] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1
	[0087.232] lstrlenW (lpString=".ppt") returned 4
	[0087.232] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0087.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0087.232] lstrlenW (lpString=".zip") returned 4
	[0087.232] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0087.232] lstrlenW (lpString=".rar") returned 4
	[0087.232] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0087.232] lstrlenW (lpString=".bz2") returned 4
	[0087.233] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0087.233] lstrlenW (lpString=".7z") returned 3
	[0087.233] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0087.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0087.233] lstrlenW (lpString=".dbf") returned 4
	[0087.233] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0087.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0087.233] lstrlenW (lpString=".1cd") returned 4
	[0087.233] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0087.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0087.233] lstrlenW (lpString=".jpg") returned 4
	[0087.233] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0087.233] lstrcmpiW (lpString1=".jpg", lpString2=".adobe") returned 1
	[0087.233] lstrlenW (lpString="HandPrints.jpg") returned 14
	[0087.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.263] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4222) returned 1
	[0087.263] CloseHandle (hObject=0x1ac) returned 1
	[0087.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20
	[0087.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0087.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0087.299] lstrlenW (lpString=".doc") returned 4
	[0087.299] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0087.299] lstrlenW (lpString=".docx") returned 5
	[0087.299] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0087.299] lstrlenW (lpString=".pdf") returned 4
	[0087.299] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0087.299] lstrlenW (lpString=".xls") returned 4
	[0087.299] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0087.299] lstrlenW (lpString=".xlsx") returned 5
	[0087.299] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0087.299] lstrlenW (lpString=".ppt") returned 4
	[0087.299] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0087.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0087.299] lstrlenW (lpString=".zip") returned 4
	[0087.299] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0087.299] lstrlenW (lpString=".rar") returned 4
	[0087.299] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0087.299] lstrlenW (lpString=".bz2") returned 4
	[0087.299] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0087.300] lstrlenW (lpString=".7z") returned 3
	[0087.300] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0087.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0087.300] lstrlenW (lpString=".dbf") returned 4
	[0087.300] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0087.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0087.300] lstrlenW (lpString=".1cd") returned 4
	[0087.300] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0087.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0087.300] lstrlenW (lpString=".jpg") returned 4
	[0087.300] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0087.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0087.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0087.300] lstrlenW (lpString=".doc") returned 4
	[0087.300] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0087.300] lstrlenW (lpString=".docx") returned 5
	[0087.300] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0087.300] lstrlenW (lpString=".pdf") returned 4
	[0087.300] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0087.300] lstrlenW (lpString=".xls") returned 4
	[0087.300] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0087.300] lstrlenW (lpString=".xlsx") returned 5
	[0087.300] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0087.300] lstrlenW (lpString=".ppt") returned 4
	[0087.300] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0087.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0087.301] lstrlenW (lpString=".zip") returned 4
	[0087.301] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0087.301] lstrlenW (lpString=".rar") returned 4
	[0087.301] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0087.301] lstrlenW (lpString=".bz2") returned 4
	[0087.301] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0087.301] lstrlenW (lpString=".7z") returned 3
	[0087.301] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0087.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0087.301] lstrlenW (lpString=".dbf") returned 4
	[0087.301] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0087.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0087.301] lstrlenW (lpString=".1cd") returned 4
	[0087.301] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0087.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0087.301] lstrlenW (lpString=".jpg") returned 4
	[0087.301] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0087.301] lstrcmpiW (lpString1=".emf", lpString2=".adobe") returned 1
	[0087.301] lstrlenW (lpString="Music.emf") returned 9
	[0087.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0087.348] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=26036) returned 1
	[0087.348] CloseHandle (hObject=0x1b4) returned 1
	[0087.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf")) returned 0x20
	[0087.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 67
	[0087.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 67
	[0087.390] lstrlenW (lpString=".doc") returned 4
	[0087.390] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0087.391] lstrlenW (lpString=".docx") returned 5
	[0087.391] lstrcmpiW (lpString1=".docx", lpString2="c.emf") returned -1
	[0087.391] lstrlenW (lpString=".pdf") returned 4
	[0087.391] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0087.391] lstrlenW (lpString=".xls") returned 4
	[0087.391] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0087.391] lstrlenW (lpString=".xlsx") returned 5
	[0087.391] lstrcmpiW (lpString1=".xlsx", lpString2="c.emf") returned -1
	[0087.391] lstrlenW (lpString=".ppt") returned 4
	[0087.391] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0087.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 67
	[0087.391] lstrlenW (lpString=".zip") returned 4
	[0087.391] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0087.391] lstrlenW (lpString=".rar") returned 4
	[0087.391] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0087.391] lstrlenW (lpString=".bz2") returned 4
	[0087.391] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0087.391] lstrlenW (lpString=".7z") returned 3
	[0087.391] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0087.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 67
	[0087.391] lstrlenW (lpString=".dbf") returned 4
	[0087.391] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0087.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 67
	[0087.391] lstrlenW (lpString=".1cd") returned 4
	[0087.391] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0087.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 67
	[0087.392] lstrlenW (lpString=".jpg") returned 4
	[0087.392] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0087.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 67
	[0087.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 67
	[0087.392] lstrlenW (lpString=".doc") returned 4
	[0087.392] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0087.392] lstrlenW (lpString=".docx") returned 5
	[0087.392] lstrcmpiW (lpString1=".docx", lpString2="c.emf") returned -1
	[0087.392] lstrlenW (lpString=".pdf") returned 4
	[0087.392] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0087.392] lstrlenW (lpString=".xls") returned 4
	[0087.392] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0087.392] lstrlenW (lpString=".xlsx") returned 5
	[0087.392] lstrcmpiW (lpString1=".xlsx", lpString2="c.emf") returned -1
	[0087.392] lstrlenW (lpString=".ppt") returned 4
	[0087.392] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0087.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 67
	[0087.392] lstrlenW (lpString=".zip") returned 4
	[0087.392] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0087.392] lstrlenW (lpString=".rar") returned 4
	[0087.392] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0087.392] lstrlenW (lpString=".bz2") returned 4
	[0087.392] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0087.392] lstrlenW (lpString=".7z") returned 3
	[0087.392] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0087.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 67
	[0087.392] lstrlenW (lpString=".dbf") returned 4
	[0087.393] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0087.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 67
	[0087.393] lstrlenW (lpString=".1cd") returned 4
	[0087.393] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0087.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 67
	[0087.393] lstrlenW (lpString=".jpg") returned 4
	[0087.393] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0087.393] lstrcmpiW (lpString1=".htm", lpString2=".adobe") returned 1
	[0087.393] lstrlenW (lpString="Peacock.htm") returned 11
	[0087.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.658] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=232) returned 1
	[0087.658] CloseHandle (hObject=0x1ac) returned 1
	[0087.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20
	[0087.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69
	[0087.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69
	[0087.818] lstrlenW (lpString=".doc") returned 4
	[0087.818] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0087.818] lstrlenW (lpString=".docx") returned 5
	[0087.818] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1
	[0087.818] lstrlenW (lpString=".pdf") returned 4
	[0087.818] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0087.818] lstrlenW (lpString=".xls") returned 4
	[0087.818] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0087.818] lstrlenW (lpString=".xlsx") returned 5
	[0087.818] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1
	[0087.818] lstrlenW (lpString=".ppt") returned 4
	[0087.818] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0087.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69
	[0087.818] lstrlenW (lpString=".zip") returned 4
	[0087.818] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0087.818] lstrlenW (lpString=".rar") returned 4
	[0087.818] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0087.818] lstrlenW (lpString=".bz2") returned 4
	[0087.818] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0087.818] lstrlenW (lpString=".7z") returned 3
	[0087.818] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0087.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69
	[0087.818] lstrlenW (lpString=".dbf") returned 4
	[0087.818] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0087.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69
	[0087.819] lstrlenW (lpString=".1cd") returned 4
	[0087.819] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0087.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69
	[0087.819] lstrlenW (lpString=".jpg") returned 4
	[0087.819] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0087.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69
	[0087.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69
	[0087.819] lstrlenW (lpString=".doc") returned 4
	[0087.819] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0087.819] lstrlenW (lpString=".docx") returned 5
	[0087.819] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1
	[0087.819] lstrlenW (lpString=".pdf") returned 4
	[0087.819] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0087.819] lstrlenW (lpString=".xls") returned 4
	[0087.819] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0087.819] lstrlenW (lpString=".xlsx") returned 5
	[0087.819] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1
	[0087.819] lstrlenW (lpString=".ppt") returned 4
	[0087.819] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0087.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69
	[0087.819] lstrlenW (lpString=".zip") returned 4
	[0087.819] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0087.819] lstrlenW (lpString=".rar") returned 4
	[0087.819] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0087.820] lstrlenW (lpString=".bz2") returned 4
	[0087.820] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0087.820] lstrlenW (lpString=".7z") returned 3
	[0087.820] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0087.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69
	[0087.820] lstrlenW (lpString=".dbf") returned 4
	[0087.820] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0087.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69
	[0087.820] lstrlenW (lpString=".1cd") returned 4
	[0087.820] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0087.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69
	[0087.820] lstrlenW (lpString=".jpg") returned 4
	[0087.820] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0087.820] lstrcmpiW (lpString1=".jpg", lpString2=".adobe") returned 1
	[0087.820] lstrlenW (lpString="Psychedelic.jpg") returned 15
	[0087.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0087.877] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=14049) returned 1
	[0087.877] CloseHandle (hObject=0x160) returned 1
	[0087.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg")) returned 0x20
	[0087.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73
	[0087.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73
	[0087.918] lstrlenW (lpString=".doc") returned 4
	[0087.918] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0087.918] lstrlenW (lpString=".docx") returned 5
	[0087.918] lstrcmpiW (lpString1=".docx", lpString2="c.jpg") returned -1
	[0087.918] lstrlenW (lpString=".pdf") returned 4
	[0087.918] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0087.918] lstrlenW (lpString=".xls") returned 4
	[0087.918] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0087.918] lstrlenW (lpString=".xlsx") returned 5
	[0087.918] lstrcmpiW (lpString1=".xlsx", lpString2="c.jpg") returned -1
	[0087.918] lstrlenW (lpString=".ppt") returned 4
	[0087.918] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0087.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73
	[0087.918] lstrlenW (lpString=".zip") returned 4
	[0087.918] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0087.918] lstrlenW (lpString=".rar") returned 4
	[0087.918] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0087.918] lstrlenW (lpString=".bz2") returned 4
	[0087.918] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0087.919] lstrlenW (lpString=".7z") returned 3
	[0087.919] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0087.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73
	[0087.919] lstrlenW (lpString=".dbf") returned 4
	[0087.919] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0087.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73
	[0087.919] lstrlenW (lpString=".1cd") returned 4
	[0087.919] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0087.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73
	[0087.919] lstrlenW (lpString=".jpg") returned 4
	[0087.919] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0087.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73
	[0087.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73
	[0087.919] lstrlenW (lpString=".doc") returned 4
	[0087.919] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0087.919] lstrlenW (lpString=".docx") returned 5
	[0087.919] lstrcmpiW (lpString1=".docx", lpString2="c.jpg") returned -1
	[0087.919] lstrlenW (lpString=".pdf") returned 4
	[0087.919] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0087.919] lstrlenW (lpString=".xls") returned 4
	[0087.919] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0087.919] lstrlenW (lpString=".xlsx") returned 5
	[0087.919] lstrcmpiW (lpString1=".xlsx", lpString2="c.jpg") returned -1
	[0087.919] lstrlenW (lpString=".ppt") returned 4
	[0087.919] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0087.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73
	[0087.920] lstrlenW (lpString=".zip") returned 4
	[0087.920] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0087.920] lstrlenW (lpString=".rar") returned 4
	[0087.920] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0087.920] lstrlenW (lpString=".bz2") returned 4
	[0087.920] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0087.920] lstrlenW (lpString=".7z") returned 3
	[0087.920] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0087.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73
	[0087.920] lstrlenW (lpString=".dbf") returned 4
	[0087.920] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0087.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73
	[0087.920] lstrlenW (lpString=".1cd") returned 4
	[0087.920] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0087.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73
	[0087.920] lstrlenW (lpString=".jpg") returned 4
	[0087.920] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0087.920] lstrcmpiW (lpString1=".emf", lpString2=".adobe") returned 1
	[0087.920] lstrlenW (lpString="Seyes.emf") returned 9
	[0087.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.002] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=37316) returned 1
	[0088.002] CloseHandle (hObject=0x188) returned 1
	[0088.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf")) returned 0x20
	[0088.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67
	[0088.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67
	[0088.117] lstrlenW (lpString=".doc") returned 4
	[0088.117] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0088.117] lstrlenW (lpString=".docx") returned 5
	[0088.118] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1
	[0088.118] lstrlenW (lpString=".pdf") returned 4
	[0088.118] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0088.118] lstrlenW (lpString=".xls") returned 4
	[0088.118] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0088.118] lstrlenW (lpString=".xlsx") returned 5
	[0088.118] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1
	[0088.118] lstrlenW (lpString=".ppt") returned 4
	[0088.118] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0088.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67
	[0088.118] lstrlenW (lpString=".zip") returned 4
	[0088.118] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0088.118] lstrlenW (lpString=".rar") returned 4
	[0088.118] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0088.118] lstrlenW (lpString=".bz2") returned 4
	[0088.118] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0088.118] lstrlenW (lpString=".7z") returned 3
	[0088.118] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0088.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67
	[0088.118] lstrlenW (lpString=".dbf") returned 4
	[0088.118] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0088.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67
	[0088.118] lstrlenW (lpString=".1cd") returned 4
	[0088.118] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0088.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67
	[0088.118] lstrlenW (lpString=".jpg") returned 4
	[0088.118] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0088.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67
	[0088.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67
	[0088.119] lstrlenW (lpString=".doc") returned 4
	[0088.119] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0088.119] lstrlenW (lpString=".docx") returned 5
	[0088.119] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1
	[0088.119] lstrlenW (lpString=".pdf") returned 4
	[0088.119] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0088.119] lstrlenW (lpString=".xls") returned 4
	[0088.119] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0088.119] lstrlenW (lpString=".xlsx") returned 5
	[0088.119] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1
	[0088.119] lstrlenW (lpString=".ppt") returned 4
	[0088.119] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0088.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67
	[0088.119] lstrlenW (lpString=".zip") returned 4
	[0088.119] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0088.119] lstrlenW (lpString=".rar") returned 4
	[0088.119] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0088.119] lstrlenW (lpString=".bz2") returned 4
	[0088.119] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0088.119] lstrlenW (lpString=".7z") returned 3
	[0088.119] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0088.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67
	[0088.119] lstrlenW (lpString=".dbf") returned 4
	[0088.119] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0088.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67
	[0088.120] lstrlenW (lpString=".1cd") returned 4
	[0088.120] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0088.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67
	[0088.120] lstrlenW (lpString=".jpg") returned 4
	[0088.120] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0088.120] lstrcmpiW (lpString1=".jpg", lpString2=".adobe") returned 1
	[0088.120] lstrlenW (lpString="Small_News.jpg") returned 14
	[0088.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.200] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1990) returned 1
	[0088.200] CloseHandle (hObject=0x188) returned 1
	[0088.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg")) returned 0x20
	[0088.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0088.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0088.304] lstrlenW (lpString=".doc") returned 4
	[0088.304] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0088.304] lstrlenW (lpString=".docx") returned 5
	[0088.304] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0088.304] lstrlenW (lpString=".pdf") returned 4
	[0088.305] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0088.305] lstrlenW (lpString=".xls") returned 4
	[0088.305] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0088.305] lstrlenW (lpString=".xlsx") returned 5
	[0088.305] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0088.305] lstrlenW (lpString=".ppt") returned 4
	[0088.305] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0088.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0088.305] lstrlenW (lpString=".zip") returned 4
	[0088.305] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0088.305] lstrlenW (lpString=".rar") returned 4
	[0088.305] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0088.305] lstrlenW (lpString=".bz2") returned 4
	[0088.305] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0088.305] lstrlenW (lpString=".7z") returned 3
	[0088.305] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0088.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0088.305] lstrlenW (lpString=".dbf") returned 4
	[0088.305] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0088.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0088.305] lstrlenW (lpString=".1cd") returned 4
	[0088.305] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0088.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0088.305] lstrlenW (lpString=".jpg") returned 4
	[0088.305] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0088.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0088.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0088.306] lstrlenW (lpString=".doc") returned 4
	[0088.306] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0088.306] lstrlenW (lpString=".docx") returned 5
	[0088.306] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0088.306] lstrlenW (lpString=".pdf") returned 4
	[0088.306] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0088.306] lstrlenW (lpString=".xls") returned 4
	[0088.306] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0088.306] lstrlenW (lpString=".xlsx") returned 5
	[0088.306] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0088.306] lstrlenW (lpString=".ppt") returned 4
	[0088.306] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0088.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0088.306] lstrlenW (lpString=".zip") returned 4
	[0088.306] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0088.306] lstrlenW (lpString=".rar") returned 4
	[0088.306] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0088.306] lstrlenW (lpString=".bz2") returned 4
	[0088.306] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0088.306] lstrlenW (lpString=".7z") returned 3
	[0088.306] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0088.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0088.306] lstrlenW (lpString=".dbf") returned 4
	[0088.306] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0088.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0088.307] lstrlenW (lpString=".1cd") returned 4
	[0088.307] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0088.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0088.307] lstrlenW (lpString=".jpg") returned 4
	[0088.307] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0088.307] lstrcmpiW (lpString1=".jpg", lpString2=".adobe") returned 1
	[0088.307] lstrlenW (lpString="Stars.jpg") returned 9
	[0088.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0088.355] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7505) returned 1
	[0088.355] CloseHandle (hObject=0x178) returned 1
	[0088.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20
	[0088.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0088.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0088.403] lstrlenW (lpString=".doc") returned 4
	[0088.403] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0088.403] lstrlenW (lpString=".docx") returned 5
	[0088.403] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0088.403] lstrlenW (lpString=".pdf") returned 4
	[0088.403] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0088.403] lstrlenW (lpString=".xls") returned 4
	[0088.403] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0088.404] lstrlenW (lpString=".xlsx") returned 5
	[0088.404] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0088.404] lstrlenW (lpString=".ppt") returned 4
	[0088.404] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0088.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0088.404] lstrlenW (lpString=".zip") returned 4
	[0088.404] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0088.404] lstrlenW (lpString=".rar") returned 4
	[0088.404] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0088.404] lstrlenW (lpString=".bz2") returned 4
	[0088.404] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0088.404] lstrlenW (lpString=".7z") returned 3
	[0088.404] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0088.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0088.404] lstrlenW (lpString=".dbf") returned 4
	[0088.404] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0088.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0088.404] lstrlenW (lpString=".1cd") returned 4
	[0088.404] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0088.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0088.404] lstrlenW (lpString=".jpg") returned 4
	[0088.404] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0088.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0088.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0088.404] lstrlenW (lpString=".doc") returned 4
	[0088.405] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0088.405] lstrlenW (lpString=".docx") returned 5
	[0088.405] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0088.405] lstrlenW (lpString=".pdf") returned 4
	[0088.405] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0088.405] lstrlenW (lpString=".xls") returned 4
	[0088.405] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0088.405] lstrlenW (lpString=".xlsx") returned 5
	[0088.405] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0088.405] lstrlenW (lpString=".ppt") returned 4
	[0088.405] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0088.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0088.405] lstrlenW (lpString=".zip") returned 4
	[0088.405] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0088.405] lstrlenW (lpString=".rar") returned 4
	[0088.405] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0088.405] lstrlenW (lpString=".bz2") returned 4
	[0088.405] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0088.405] lstrlenW (lpString=".7z") returned 3
	[0088.405] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0088.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0088.405] lstrlenW (lpString=".dbf") returned 4
	[0088.405] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0088.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0088.405] lstrlenW (lpString=".1cd") returned 4
	[0088.405] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0088.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0088.405] lstrlenW (lpString=".jpg") returned 4
	[0088.406] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0088.406] lstrcmpiW (lpString1=".emf", lpString2=".adobe") returned 1
	[0088.406] lstrlenW (lpString="To_Do_List.emf") returned 14
	[0088.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.432] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=26720) returned 1
	[0088.432] CloseHandle (hObject=0x188) returned 1
	[0088.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf")) returned 0x20
	[0088.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0088.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0088.541] lstrlenW (lpString=".doc") returned 4
	[0088.541] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0088.541] lstrlenW (lpString=".docx") returned 5
	[0088.541] lstrcmpiW (lpString1=".docx", lpString2="t.emf") returned -1
	[0088.541] lstrlenW (lpString=".pdf") returned 4
	[0088.541] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0088.541] lstrlenW (lpString=".xls") returned 4
	[0088.541] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0088.541] lstrlenW (lpString=".xlsx") returned 5
	[0088.541] lstrcmpiW (lpString1=".xlsx", lpString2="t.emf") returned -1
	[0088.541] lstrlenW (lpString=".ppt") returned 4
	[0088.541] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0088.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0088.541] lstrlenW (lpString=".zip") returned 4
	[0088.541] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0088.541] lstrlenW (lpString=".rar") returned 4
	[0088.541] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0088.541] lstrlenW (lpString=".bz2") returned 4
	[0088.541] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0088.541] lstrlenW (lpString=".7z") returned 3
	[0088.541] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0088.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0088.542] lstrlenW (lpString=".dbf") returned 4
	[0088.542] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0088.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0088.542] lstrlenW (lpString=".1cd") returned 4
	[0088.542] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0088.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0088.542] lstrlenW (lpString=".jpg") returned 4
	[0088.542] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0088.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0088.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0088.542] lstrlenW (lpString=".doc") returned 4
	[0088.542] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0088.542] lstrlenW (lpString=".docx") returned 5
	[0088.542] lstrcmpiW (lpString1=".docx", lpString2="t.emf") returned -1
	[0088.542] lstrlenW (lpString=".pdf") returned 4
	[0088.542] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0088.542] lstrlenW (lpString=".xls") returned 4
	[0088.542] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0088.542] lstrlenW (lpString=".xlsx") returned 5
	[0088.542] lstrcmpiW (lpString1=".xlsx", lpString2="t.emf") returned -1
	[0088.542] lstrlenW (lpString=".ppt") returned 4
	[0088.542] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0088.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0088.542] lstrlenW (lpString=".zip") returned 4
	[0088.542] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0088.543] lstrlenW (lpString=".rar") returned 4
	[0088.543] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0088.543] lstrlenW (lpString=".bz2") returned 4
	[0088.543] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0088.543] lstrlenW (lpString=".7z") returned 3
	[0088.543] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0088.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0088.543] lstrlenW (lpString=".dbf") returned 4
	[0088.543] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0088.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0088.543] lstrlenW (lpString=".1cd") returned 4
	[0088.543] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0088.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0088.543] lstrlenW (lpString=".jpg") returned 4
	[0088.543] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0088.543] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.543] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0088.571] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2181) returned 1
	[0088.571] CloseHandle (hObject=0x190) returned 1
	[0088.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20
	[0088.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.636] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.636] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.686] GetLastError () returned 0x0
	[0088.686] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x885, lpOverlapped=0x0) returned 1
	[0088.691] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x890, lpOverlapped=0x0) returned 1
	[0088.692] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.692] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.692] SetEndOfFile (hFile=0x188) returned 1
	[0088.693] CloseHandle (hObject=0x188) returned 1
	[0088.693] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.693] SetEndOfFile (hFile=0x160) returned 1
	[0088.694] CloseHandle (hObject=0x160) returned 1
	[0088.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.694] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1
	[0088.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0088.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0088.695] lstrlenW (lpString=".doc") returned 4
	[0088.695] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.695] lstrlenW (lpString=".docx") returned 5
	[0088.695] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.695] lstrlenW (lpString=".pdf") returned 4
	[0088.695] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.695] lstrlenW (lpString=".xls") returned 4
	[0088.695] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.695] lstrlenW (lpString=".xlsx") returned 5
	[0088.695] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.695] lstrlenW (lpString=".ppt") returned 4
	[0088.695] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0088.695] lstrlenW (lpString=".zip") returned 4
	[0088.695] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.695] lstrlenW (lpString=".rar") returned 4
	[0088.695] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.695] lstrlenW (lpString=".bz2") returned 4
	[0088.695] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.695] lstrlenW (lpString=".7z") returned 3
	[0088.695] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0088.696] lstrlenW (lpString=".dbf") returned 4
	[0088.696] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0088.696] lstrlenW (lpString=".1cd") returned 4
	[0088.696] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0088.696] lstrlenW (lpString=".jpg") returned 4
	[0088.696] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0088.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0088.696] lstrlenW (lpString=".doc") returned 4
	[0088.696] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.696] lstrlenW (lpString=".docx") returned 5
	[0088.696] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.696] lstrlenW (lpString=".pdf") returned 4
	[0088.696] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.696] lstrlenW (lpString=".xls") returned 4
	[0088.696] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.696] lstrlenW (lpString=".xlsx") returned 5
	[0088.696] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.696] lstrlenW (lpString=".ppt") returned 4
	[0088.696] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0088.696] lstrlenW (lpString=".zip") returned 4
	[0088.696] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.696] lstrlenW (lpString=".rar") returned 4
	[0088.697] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.697] lstrlenW (lpString=".bz2") returned 4
	[0088.697] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.697] lstrlenW (lpString=".7z") returned 3
	[0088.697] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0088.697] lstrlenW (lpString=".dbf") returned 4
	[0088.697] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0088.697] lstrlenW (lpString=".1cd") returned 4
	[0088.697] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0088.697] lstrlenW (lpString=".jpg") returned 4
	[0088.697] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.697] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.697] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.698] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=945) returned 1
	[0088.698] CloseHandle (hObject=0x160) returned 1
	[0088.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20
	[0088.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.699] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.699] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.740] GetLastError () returned 0x0
	[0088.740] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x3b1, lpOverlapped=0x0) returned 1
	[0088.747] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3c0, lpOverlapped=0x0) returned 1
	[0088.749] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.749] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.749] SetEndOfFile (hFile=0x188) returned 1
	[0088.749] CloseHandle (hObject=0x188) returned 1
	[0088.749] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.749] SetEndOfFile (hFile=0x160) returned 1
	[0088.750] CloseHandle (hObject=0x160) returned 1
	[0088.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.751] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1
	[0088.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0088.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0088.751] lstrlenW (lpString=".doc") returned 4
	[0088.751] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.751] lstrlenW (lpString=".docx") returned 5
	[0088.751] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.751] lstrlenW (lpString=".pdf") returned 4
	[0088.751] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.751] lstrlenW (lpString=".xls") returned 4
	[0088.751] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.751] lstrlenW (lpString=".xlsx") returned 5
	[0088.751] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.751] lstrlenW (lpString=".ppt") returned 4
	[0088.752] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0088.752] lstrlenW (lpString=".zip") returned 4
	[0088.752] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.752] lstrlenW (lpString=".rar") returned 4
	[0088.752] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.752] lstrlenW (lpString=".bz2") returned 4
	[0088.752] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.752] lstrlenW (lpString=".7z") returned 3
	[0088.752] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0088.752] lstrlenW (lpString=".dbf") returned 4
	[0088.752] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0088.752] lstrlenW (lpString=".1cd") returned 4
	[0088.752] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0088.752] lstrlenW (lpString=".jpg") returned 4
	[0088.752] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0088.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0088.752] lstrlenW (lpString=".doc") returned 4
	[0088.752] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.752] lstrlenW (lpString=".docx") returned 5
	[0088.752] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.753] lstrlenW (lpString=".pdf") returned 4
	[0088.753] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.753] lstrlenW (lpString=".xls") returned 4
	[0088.753] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.753] lstrlenW (lpString=".xlsx") returned 5
	[0088.753] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.753] lstrlenW (lpString=".ppt") returned 4
	[0088.753] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0088.753] lstrlenW (lpString=".zip") returned 4
	[0088.753] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.753] lstrlenW (lpString=".rar") returned 4
	[0088.753] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.753] lstrlenW (lpString=".bz2") returned 4
	[0088.753] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.753] lstrlenW (lpString=".7z") returned 3
	[0088.753] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0088.753] lstrlenW (lpString=".dbf") returned 4
	[0088.753] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0088.753] lstrlenW (lpString=".1cd") returned 4
	[0088.753] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0088.754] lstrlenW (lpString=".jpg") returned 4
	[0088.754] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.754] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.754] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.755] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1363) returned 1
	[0088.755] CloseHandle (hObject=0x160) returned 1
	[0088.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20
	[0088.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.755] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.755] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0088.772] GetLastError () returned 0x0
	[0088.772] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x553, lpOverlapped=0x0) returned 1
	[0088.777] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x560, lpOverlapped=0x0) returned 1
	[0088.778] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.778] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.778] SetEndOfFile (hFile=0x1b0) returned 1
	[0088.778] CloseHandle (hObject=0x1b0) returned 1
	[0088.778] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.778] SetEndOfFile (hFile=0x160) returned 1
	[0088.779] CloseHandle (hObject=0x160) returned 1
	[0088.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.779] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1
	[0088.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0088.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0088.780] lstrlenW (lpString=".doc") returned 4
	[0088.780] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.780] lstrlenW (lpString=".docx") returned 5
	[0088.780] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.780] lstrlenW (lpString=".pdf") returned 4
	[0088.780] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.780] lstrlenW (lpString=".xls") returned 4
	[0088.780] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.780] lstrlenW (lpString=".xlsx") returned 5
	[0088.780] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.780] lstrlenW (lpString=".ppt") returned 4
	[0088.780] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0088.780] lstrlenW (lpString=".zip") returned 4
	[0088.780] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.780] lstrlenW (lpString=".rar") returned 4
	[0088.780] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.780] lstrlenW (lpString=".bz2") returned 4
	[0088.780] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.780] lstrlenW (lpString=".7z") returned 3
	[0088.780] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0088.780] lstrlenW (lpString=".dbf") returned 4
	[0088.780] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0088.781] lstrlenW (lpString=".1cd") returned 4
	[0088.781] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0088.781] lstrlenW (lpString=".jpg") returned 4
	[0088.781] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0088.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0088.781] lstrlenW (lpString=".doc") returned 4
	[0088.781] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.781] lstrlenW (lpString=".docx") returned 5
	[0088.781] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.781] lstrlenW (lpString=".pdf") returned 4
	[0088.781] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.781] lstrlenW (lpString=".xls") returned 4
	[0088.781] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.781] lstrlenW (lpString=".xlsx") returned 5
	[0088.781] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.781] lstrlenW (lpString=".ppt") returned 4
	[0088.781] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0088.781] lstrlenW (lpString=".zip") returned 4
	[0088.781] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.781] lstrlenW (lpString=".rar") returned 4
	[0088.781] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.781] lstrlenW (lpString=".bz2") returned 4
	[0088.781] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.781] lstrlenW (lpString=".7z") returned 3
	[0088.781] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0088.781] lstrlenW (lpString=".dbf") returned 4
	[0088.782] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0088.782] lstrlenW (lpString=".1cd") returned 4
	[0088.782] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0088.782] lstrlenW (lpString=".jpg") returned 4
	[0088.782] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.782] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.782] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.782] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1293) returned 1
	[0088.782] CloseHandle (hObject=0x160) returned 1
	[0088.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20
	[0088.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.783] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.783] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.801] GetLastError () returned 0x0
	[0088.801] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x50d, lpOverlapped=0x0) returned 1
	[0088.807] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x510, lpOverlapped=0x0) returned 1
	[0088.808] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.808] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.808] SetEndOfFile (hFile=0x188) returned 1
	[0088.808] CloseHandle (hObject=0x188) returned 1
	[0088.809] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.809] SetEndOfFile (hFile=0x160) returned 1
	[0088.809] CloseHandle (hObject=0x160) returned 1
	[0088.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.810] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1
	[0088.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0088.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0088.810] lstrlenW (lpString=".doc") returned 4
	[0088.810] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.810] lstrlenW (lpString=".docx") returned 5
	[0088.810] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.810] lstrlenW (lpString=".pdf") returned 4
	[0088.810] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.810] lstrlenW (lpString=".xls") returned 4
	[0088.810] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.810] lstrlenW (lpString=".xlsx") returned 5
	[0088.810] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.810] lstrlenW (lpString=".ppt") returned 4
	[0088.810] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0088.810] lstrlenW (lpString=".zip") returned 4
	[0088.810] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.810] lstrlenW (lpString=".rar") returned 4
	[0088.810] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.810] lstrlenW (lpString=".bz2") returned 4
	[0088.810] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.810] lstrlenW (lpString=".7z") returned 3
	[0088.811] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0088.811] lstrlenW (lpString=".dbf") returned 4
	[0088.811] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0088.811] lstrlenW (lpString=".1cd") returned 4
	[0088.811] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0088.811] lstrlenW (lpString=".jpg") returned 4
	[0088.811] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0088.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0088.811] lstrlenW (lpString=".doc") returned 4
	[0088.811] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.811] lstrlenW (lpString=".docx") returned 5
	[0088.811] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.811] lstrlenW (lpString=".pdf") returned 4
	[0088.811] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.811] lstrlenW (lpString=".xls") returned 4
	[0088.811] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.811] lstrlenW (lpString=".xlsx") returned 5
	[0088.811] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.811] lstrlenW (lpString=".ppt") returned 4
	[0088.811] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0088.811] lstrlenW (lpString=".zip") returned 4
	[0088.811] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.811] lstrlenW (lpString=".rar") returned 4
	[0088.811] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.811] lstrlenW (lpString=".bz2") returned 4
	[0088.811] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.811] lstrlenW (lpString=".7z") returned 3
	[0088.812] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0088.812] lstrlenW (lpString=".dbf") returned 4
	[0088.812] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0088.812] lstrlenW (lpString=".1cd") returned 4
	[0088.812] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0088.812] lstrlenW (lpString=".jpg") returned 4
	[0088.812] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.812] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.812] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.812] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1287) returned 1
	[0088.812] CloseHandle (hObject=0x160) returned 1
	[0088.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20
	[0088.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.813] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.813] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0088.838] GetLastError () returned 0x0
	[0088.838] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x507, lpOverlapped=0x0) returned 1
	[0088.846] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x510, lpOverlapped=0x0) returned 1
	[0088.848] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.848] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.848] SetEndOfFile (hFile=0x1a8) returned 1
	[0088.848] CloseHandle (hObject=0x1a8) returned 1
	[0088.848] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.848] SetEndOfFile (hFile=0x160) returned 1
	[0088.849] CloseHandle (hObject=0x160) returned 1
	[0088.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.850] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1
	[0088.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0088.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0088.850] lstrlenW (lpString=".doc") returned 4
	[0088.850] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.850] lstrlenW (lpString=".docx") returned 5
	[0088.850] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.850] lstrlenW (lpString=".pdf") returned 4
	[0088.851] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.851] lstrlenW (lpString=".xls") returned 4
	[0088.851] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.851] lstrlenW (lpString=".xlsx") returned 5
	[0088.851] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.851] lstrlenW (lpString=".ppt") returned 4
	[0088.851] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0088.851] lstrlenW (lpString=".zip") returned 4
	[0088.851] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.851] lstrlenW (lpString=".rar") returned 4
	[0088.851] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.851] lstrlenW (lpString=".bz2") returned 4
	[0088.851] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.851] lstrlenW (lpString=".7z") returned 3
	[0088.851] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0088.851] lstrlenW (lpString=".dbf") returned 4
	[0088.851] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0088.851] lstrlenW (lpString=".1cd") returned 4
	[0088.851] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0088.851] lstrlenW (lpString=".jpg") returned 4
	[0088.851] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0088.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0088.851] lstrlenW (lpString=".doc") returned 4
	[0088.851] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.852] lstrlenW (lpString=".docx") returned 5
	[0088.852] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.852] lstrlenW (lpString=".pdf") returned 4
	[0088.852] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.852] lstrlenW (lpString=".xls") returned 4
	[0088.852] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.852] lstrlenW (lpString=".xlsx") returned 5
	[0088.852] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.852] lstrlenW (lpString=".ppt") returned 4
	[0088.852] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0088.852] lstrlenW (lpString=".zip") returned 4
	[0088.852] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.852] lstrlenW (lpString=".rar") returned 4
	[0088.852] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.852] lstrlenW (lpString=".bz2") returned 4
	[0088.852] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.852] lstrlenW (lpString=".7z") returned 3
	[0088.852] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0088.852] lstrlenW (lpString=".dbf") returned 4
	[0088.852] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0088.852] lstrlenW (lpString=".1cd") returned 4
	[0088.852] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0088.852] lstrlenW (lpString=".jpg") returned 4
	[0088.853] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.853] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.853] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.853] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3957) returned 1
	[0088.854] CloseHandle (hObject=0x160) returned 1
	[0088.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20
	[0088.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.855] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.855] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0088.888] GetLastError () returned 0x0
	[0088.888] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xf75, lpOverlapped=0x0) returned 1
	[0088.893] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf80, lpOverlapped=0x0) returned 1
	[0088.894] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.895] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.895] SetEndOfFile (hFile=0x184) returned 1
	[0088.895] CloseHandle (hObject=0x184) returned 1
	[0088.895] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.895] SetEndOfFile (hFile=0x160) returned 1
	[0088.896] CloseHandle (hObject=0x160) returned 1
	[0088.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.896] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1
	[0088.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0088.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0088.897] lstrlenW (lpString=".doc") returned 4
	[0088.897] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.897] lstrlenW (lpString=".docx") returned 5
	[0088.897] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.897] lstrlenW (lpString=".pdf") returned 4
	[0088.897] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.897] lstrlenW (lpString=".xls") returned 4
	[0088.897] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.897] lstrlenW (lpString=".xlsx") returned 5
	[0088.897] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.897] lstrlenW (lpString=".ppt") returned 4
	[0088.897] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0088.897] lstrlenW (lpString=".zip") returned 4
	[0088.897] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.897] lstrlenW (lpString=".rar") returned 4
	[0088.897] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.897] lstrlenW (lpString=".bz2") returned 4
	[0088.897] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.897] lstrlenW (lpString=".7z") returned 3
	[0088.897] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0088.897] lstrlenW (lpString=".dbf") returned 4
	[0088.897] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0088.897] lstrlenW (lpString=".1cd") returned 4
	[0088.897] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0088.898] lstrlenW (lpString=".jpg") returned 4
	[0088.898] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0088.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0088.898] lstrlenW (lpString=".doc") returned 4
	[0088.898] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0088.898] lstrlenW (lpString=".docx") returned 5
	[0088.898] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0088.898] lstrlenW (lpString=".pdf") returned 4
	[0088.898] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0088.898] lstrlenW (lpString=".xls") returned 4
	[0088.898] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0088.898] lstrlenW (lpString=".xlsx") returned 5
	[0088.898] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0088.898] lstrlenW (lpString=".ppt") returned 4
	[0088.898] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0088.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0088.898] lstrlenW (lpString=".zip") returned 4
	[0088.898] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0088.898] lstrlenW (lpString=".rar") returned 4
	[0088.898] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0088.898] lstrlenW (lpString=".bz2") returned 4
	[0088.898] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0088.898] lstrlenW (lpString=".7z") returned 3
	[0088.898] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0088.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0088.898] lstrlenW (lpString=".dbf") returned 4
	[0088.898] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0088.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0088.899] lstrlenW (lpString=".1cd") returned 4
	[0088.899] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0088.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0088.899] lstrlenW (lpString=".jpg") returned 4
	[0088.899] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0088.899] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0088.899] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0088.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0088.921] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1347) returned 1
	[0088.921] CloseHandle (hObject=0x1b0) returned 1
	[0088.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20
	[0088.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.973] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.974] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0089.078] GetLastError () returned 0x0
	[0089.078] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x543, lpOverlapped=0x0) returned 1
	[0089.102] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0089.103] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.103] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.103] SetEndOfFile (hFile=0x184) returned 1
	[0089.103] CloseHandle (hObject=0x184) returned 1
	[0089.104] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.104] SetEndOfFile (hFile=0x188) returned 1
	[0089.105] CloseHandle (hObject=0x188) returned 1
	[0089.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.105] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1
	[0089.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0089.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0089.105] lstrlenW (lpString=".doc") returned 4
	[0089.105] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.105] lstrlenW (lpString=".docx") returned 5
	[0089.106] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.106] lstrlenW (lpString=".pdf") returned 4
	[0089.106] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.106] lstrlenW (lpString=".xls") returned 4
	[0089.106] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.106] lstrlenW (lpString=".xlsx") returned 5
	[0089.106] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.106] lstrlenW (lpString=".ppt") returned 4
	[0089.106] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0089.106] lstrlenW (lpString=".zip") returned 4
	[0089.106] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.106] lstrlenW (lpString=".rar") returned 4
	[0089.106] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.106] lstrlenW (lpString=".bz2") returned 4
	[0089.106] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.106] lstrlenW (lpString=".7z") returned 3
	[0089.106] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0089.106] lstrlenW (lpString=".dbf") returned 4
	[0089.106] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0089.106] lstrlenW (lpString=".1cd") returned 4
	[0089.106] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0089.106] lstrlenW (lpString=".jpg") returned 4
	[0089.106] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0089.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0089.107] lstrlenW (lpString=".doc") returned 4
	[0089.107] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.107] lstrlenW (lpString=".docx") returned 5
	[0089.107] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.107] lstrlenW (lpString=".pdf") returned 4
	[0089.107] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.107] lstrlenW (lpString=".xls") returned 4
	[0089.107] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.107] lstrlenW (lpString=".xlsx") returned 5
	[0089.107] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.107] lstrlenW (lpString=".ppt") returned 4
	[0089.107] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0089.107] lstrlenW (lpString=".zip") returned 4
	[0089.107] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.107] lstrlenW (lpString=".rar") returned 4
	[0089.107] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.107] lstrlenW (lpString=".bz2") returned 4
	[0089.107] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.107] lstrlenW (lpString=".7z") returned 3
	[0089.107] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0089.107] lstrlenW (lpString=".dbf") returned 4
	[0089.107] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0089.107] lstrlenW (lpString=".1cd") returned 4
	[0089.107] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0089.107] lstrlenW (lpString=".jpg") returned 4
	[0089.108] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.108] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0089.108] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0089.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0089.108] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2552) returned 1
	[0089.108] CloseHandle (hObject=0x188) returned 1
	[0089.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20
	[0089.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0089.109] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.109] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0089.252] GetLastError () returned 0x0
	[0089.252] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x9f8, lpOverlapped=0x0) returned 1
	[0089.348] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa00, lpOverlapped=0x0) returned 1
	[0089.349] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.349] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.349] SetEndOfFile (hFile=0x184) returned 1
	[0089.349] CloseHandle (hObject=0x184) returned 1
	[0089.349] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.349] SetEndOfFile (hFile=0x188) returned 1
	[0089.350] CloseHandle (hObject=0x188) returned 1
	[0089.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.350] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1
	[0089.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0089.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0089.351] lstrlenW (lpString=".doc") returned 4
	[0089.351] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.351] lstrlenW (lpString=".docx") returned 5
	[0089.351] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.351] lstrlenW (lpString=".pdf") returned 4
	[0089.351] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.351] lstrlenW (lpString=".xls") returned 4
	[0089.351] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.351] lstrlenW (lpString=".xlsx") returned 5
	[0089.351] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.351] lstrlenW (lpString=".ppt") returned 4
	[0089.351] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0089.351] lstrlenW (lpString=".zip") returned 4
	[0089.351] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.351] lstrlenW (lpString=".rar") returned 4
	[0089.351] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.351] lstrlenW (lpString=".bz2") returned 4
	[0089.351] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.351] lstrlenW (lpString=".7z") returned 3
	[0089.351] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0089.351] lstrlenW (lpString=".dbf") returned 4
	[0089.351] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0089.351] lstrlenW (lpString=".1cd") returned 4
	[0089.352] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0089.352] lstrlenW (lpString=".jpg") returned 4
	[0089.352] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0089.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0089.352] lstrlenW (lpString=".doc") returned 4
	[0089.352] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.352] lstrlenW (lpString=".docx") returned 5
	[0089.352] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.352] lstrlenW (lpString=".pdf") returned 4
	[0089.352] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.352] lstrlenW (lpString=".xls") returned 4
	[0089.352] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.352] lstrlenW (lpString=".xlsx") returned 5
	[0089.352] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.352] lstrlenW (lpString=".ppt") returned 4
	[0089.352] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0089.352] lstrlenW (lpString=".zip") returned 4
	[0089.352] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.352] lstrlenW (lpString=".rar") returned 4
	[0089.352] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.352] lstrlenW (lpString=".bz2") returned 4
	[0089.352] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.352] lstrlenW (lpString=".7z") returned 3
	[0089.352] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0089.352] lstrlenW (lpString=".dbf") returned 4
	[0089.352] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0089.352] lstrlenW (lpString=".1cd") returned 4
	[0089.353] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0089.353] lstrlenW (lpString=".jpg") returned 4
	[0089.353] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.353] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0089.353] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0089.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0089.353] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2476) returned 1
	[0089.353] CloseHandle (hObject=0x188) returned 1
	[0089.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20
	[0089.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0089.354] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.354] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.439] GetLastError () returned 0x0
	[0089.440] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x9ac, lpOverlapped=0x0) returned 1
	[0089.450] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x9b0, lpOverlapped=0x0) returned 1
	[0089.451] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.451] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.451] SetEndOfFile (hFile=0x160) returned 1
	[0089.451] CloseHandle (hObject=0x160) returned 1
	[0089.452] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.452] SetEndOfFile (hFile=0x188) returned 1
	[0089.452] CloseHandle (hObject=0x188) returned 1
	[0089.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.453] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1
	[0089.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0089.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0089.453] lstrlenW (lpString=".doc") returned 4
	[0089.453] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.453] lstrlenW (lpString=".docx") returned 5
	[0089.453] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.453] lstrlenW (lpString=".pdf") returned 4
	[0089.453] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.453] lstrlenW (lpString=".xls") returned 4
	[0089.453] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.453] lstrlenW (lpString=".xlsx") returned 5
	[0089.453] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.453] lstrlenW (lpString=".ppt") returned 4
	[0089.453] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0089.453] lstrlenW (lpString=".zip") returned 4
	[0089.453] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.453] lstrlenW (lpString=".rar") returned 4
	[0089.453] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.453] lstrlenW (lpString=".bz2") returned 4
	[0089.453] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.453] lstrlenW (lpString=".7z") returned 3
	[0089.454] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0089.454] lstrlenW (lpString=".dbf") returned 4
	[0089.454] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0089.454] lstrlenW (lpString=".1cd") returned 4
	[0089.454] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0089.454] lstrlenW (lpString=".jpg") returned 4
	[0089.454] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0089.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0089.454] lstrlenW (lpString=".doc") returned 4
	[0089.454] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.454] lstrlenW (lpString=".docx") returned 5
	[0089.454] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.454] lstrlenW (lpString=".pdf") returned 4
	[0089.454] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.454] lstrlenW (lpString=".xls") returned 4
	[0089.454] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.454] lstrlenW (lpString=".xlsx") returned 5
	[0089.454] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.454] lstrlenW (lpString=".ppt") returned 4
	[0089.454] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0089.454] lstrlenW (lpString=".zip") returned 4
	[0089.454] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.454] lstrlenW (lpString=".rar") returned 4
	[0089.454] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.454] lstrlenW (lpString=".bz2") returned 4
	[0089.454] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.454] lstrlenW (lpString=".7z") returned 3
	[0089.455] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0089.455] lstrlenW (lpString=".dbf") returned 4
	[0089.455] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0089.455] lstrlenW (lpString=".1cd") returned 4
	[0089.455] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0089.455] lstrlenW (lpString=".jpg") returned 4
	[0089.455] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.455] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0089.455] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0089.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0089.456] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1659) returned 1
	[0089.456] CloseHandle (hObject=0x188) returned 1
	[0089.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20
	[0089.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0089.456] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.456] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.601] GetLastError () returned 0x0
	[0089.601] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x67b, lpOverlapped=0x0) returned 1
	[0089.610] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x680, lpOverlapped=0x0) returned 1
	[0089.612] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.612] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.612] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.612] CloseHandle (hObject=0x1b0) returned 1
	[0089.612] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.612] SetEndOfFile (hFile=0x188) returned 1
	[0089.613] CloseHandle (hObject=0x188) returned 1
	[0089.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.613] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1
	[0089.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0089.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0089.614] lstrlenW (lpString=".doc") returned 4
	[0089.614] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.614] lstrlenW (lpString=".docx") returned 5
	[0089.614] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.614] lstrlenW (lpString=".pdf") returned 4
	[0089.614] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.614] lstrlenW (lpString=".xls") returned 4
	[0089.614] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.614] lstrlenW (lpString=".xlsx") returned 5
	[0089.614] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.614] lstrlenW (lpString=".ppt") returned 4
	[0089.614] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0089.614] lstrlenW (lpString=".zip") returned 4
	[0089.614] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.614] lstrlenW (lpString=".rar") returned 4
	[0089.614] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.614] lstrlenW (lpString=".bz2") returned 4
	[0089.614] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.614] lstrlenW (lpString=".7z") returned 3
	[0089.614] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0089.615] lstrlenW (lpString=".dbf") returned 4
	[0089.615] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0089.615] lstrlenW (lpString=".1cd") returned 4
	[0089.615] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0089.615] lstrlenW (lpString=".jpg") returned 4
	[0089.615] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0089.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0089.615] lstrlenW (lpString=".doc") returned 4
	[0089.615] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.615] lstrlenW (lpString=".docx") returned 5
	[0089.615] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.615] lstrlenW (lpString=".pdf") returned 4
	[0089.615] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.615] lstrlenW (lpString=".xls") returned 4
	[0089.615] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.615] lstrlenW (lpString=".xlsx") returned 5
	[0089.615] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.615] lstrlenW (lpString=".ppt") returned 4
	[0089.615] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0089.615] lstrlenW (lpString=".zip") returned 4
	[0089.615] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.615] lstrlenW (lpString=".rar") returned 4
	[0089.615] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.616] lstrlenW (lpString=".bz2") returned 4
	[0089.616] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.616] lstrlenW (lpString=".7z") returned 3
	[0089.616] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0089.616] lstrlenW (lpString=".dbf") returned 4
	[0089.616] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0089.616] lstrlenW (lpString=".1cd") returned 4
	[0089.616] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0089.616] lstrlenW (lpString=".jpg") returned 4
	[0089.616] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.616] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0089.616] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0089.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0089.617] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1364) returned 1
	[0089.617] CloseHandle (hObject=0x188) returned 1
	[0089.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20
	[0089.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0089.617] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.618] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.883] GetLastError () returned 0x0
	[0089.883] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x554, lpOverlapped=0x0) returned 1
	[0089.911] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x560, lpOverlapped=0x0) returned 1
	[0089.914] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.915] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.915] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.915] CloseHandle (hObject=0x1b0) returned 1
	[0089.915] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.915] SetEndOfFile (hFile=0x188) returned 1
	[0089.916] CloseHandle (hObject=0x188) returned 1
	[0089.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.916] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1
	[0089.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0089.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0089.916] lstrlenW (lpString=".doc") returned 4
	[0089.916] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.916] lstrlenW (lpString=".docx") returned 5
	[0089.916] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.917] lstrlenW (lpString=".pdf") returned 4
	[0089.917] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.917] lstrlenW (lpString=".xls") returned 4
	[0089.917] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.917] lstrlenW (lpString=".xlsx") returned 5
	[0089.917] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.917] lstrlenW (lpString=".ppt") returned 4
	[0089.917] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0089.917] lstrlenW (lpString=".zip") returned 4
	[0089.917] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.917] lstrlenW (lpString=".rar") returned 4
	[0089.917] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.917] lstrlenW (lpString=".bz2") returned 4
	[0089.917] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.917] lstrlenW (lpString=".7z") returned 3
	[0089.917] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0089.917] lstrlenW (lpString=".dbf") returned 4
	[0089.917] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0089.917] lstrlenW (lpString=".1cd") returned 4
	[0089.917] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0089.917] lstrlenW (lpString=".jpg") returned 4
	[0089.917] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0089.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0089.917] lstrlenW (lpString=".doc") returned 4
	[0089.917] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.917] lstrlenW (lpString=".docx") returned 5
	[0089.917] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.917] lstrlenW (lpString=".pdf") returned 4
	[0089.918] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.918] lstrlenW (lpString=".xls") returned 4
	[0089.918] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.918] lstrlenW (lpString=".xlsx") returned 5
	[0089.918] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.918] lstrlenW (lpString=".ppt") returned 4
	[0089.918] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0089.918] lstrlenW (lpString=".zip") returned 4
	[0089.918] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.918] lstrlenW (lpString=".rar") returned 4
	[0089.918] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.918] lstrlenW (lpString=".bz2") returned 4
	[0089.918] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.918] lstrlenW (lpString=".7z") returned 3
	[0089.918] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0089.918] lstrlenW (lpString=".dbf") returned 4
	[0089.918] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0089.918] lstrlenW (lpString=".1cd") returned 4
	[0089.918] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0089.918] lstrlenW (lpString=".jpg") returned 4
	[0089.918] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.918] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0089.918] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0089.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0089.919] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1593) returned 1
	[0089.919] CloseHandle (hObject=0x188) returned 1
	[0089.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20
	[0089.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0089.920] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.920] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0089.978] GetLastError () returned 0x0
	[0089.978] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x639, lpOverlapped=0x0) returned 1
	[0089.984] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x640, lpOverlapped=0x0) returned 1
	[0089.985] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.985] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.985] SetEndOfFile (hFile=0x184) returned 1
	[0089.986] CloseHandle (hObject=0x184) returned 1
	[0089.986] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.986] SetEndOfFile (hFile=0x188) returned 1
	[0089.987] CloseHandle (hObject=0x188) returned 1
	[0089.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.987] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1
	[0089.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0089.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0089.988] lstrlenW (lpString=".doc") returned 4
	[0089.988] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.988] lstrlenW (lpString=".docx") returned 5
	[0089.988] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.988] lstrlenW (lpString=".pdf") returned 4
	[0089.988] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.988] lstrlenW (lpString=".xls") returned 4
	[0089.988] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.988] lstrlenW (lpString=".xlsx") returned 5
	[0089.988] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.988] lstrlenW (lpString=".ppt") returned 4
	[0089.988] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0089.988] lstrlenW (lpString=".zip") returned 4
	[0089.988] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.988] lstrlenW (lpString=".rar") returned 4
	[0089.988] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.988] lstrlenW (lpString=".bz2") returned 4
	[0089.989] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.989] lstrlenW (lpString=".7z") returned 3
	[0089.989] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0089.989] lstrlenW (lpString=".dbf") returned 4
	[0089.989] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0089.989] lstrlenW (lpString=".1cd") returned 4
	[0089.989] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0089.989] lstrlenW (lpString=".jpg") returned 4
	[0089.989] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0089.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0089.989] lstrlenW (lpString=".doc") returned 4
	[0089.989] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0089.989] lstrlenW (lpString=".docx") returned 5
	[0089.989] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0089.989] lstrlenW (lpString=".pdf") returned 4
	[0089.989] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0089.989] lstrlenW (lpString=".xls") returned 4
	[0089.989] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0089.989] lstrlenW (lpString=".xlsx") returned 5
	[0089.989] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0089.989] lstrlenW (lpString=".ppt") returned 4
	[0089.989] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0089.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0089.990] lstrlenW (lpString=".zip") returned 4
	[0089.990] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0089.990] lstrlenW (lpString=".rar") returned 4
	[0089.990] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0089.990] lstrlenW (lpString=".bz2") returned 4
	[0089.990] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0089.990] lstrlenW (lpString=".7z") returned 3
	[0089.990] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0089.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0089.990] lstrlenW (lpString=".dbf") returned 4
	[0089.990] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0089.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0089.990] lstrlenW (lpString=".1cd") returned 4
	[0089.990] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0089.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0089.990] lstrlenW (lpString=".jpg") returned 4
	[0089.990] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0089.990] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0089.990] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0089.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0089.991] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1439) returned 1
	[0089.991] CloseHandle (hObject=0x188) returned 1
	[0089.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20
	[0089.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0089.992] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.992] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.038] GetLastError () returned 0x0
	[0090.038] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x59f, lpOverlapped=0x0) returned 1
	[0090.047] WriteFile (in: hFile=0x1ac, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5a0, lpOverlapped=0x0) returned 1
	[0090.049] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.049] WriteFile (in: hFile=0x1ac, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.049] SetEndOfFile (hFile=0x1ac) returned 1
	[0090.049] CloseHandle (hObject=0x1ac) returned 1
	[0090.049] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.050] SetEndOfFile (hFile=0x188) returned 1
	[0090.051] CloseHandle (hObject=0x188) returned 1
	[0090.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.051] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1
	[0090.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0090.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0090.051] lstrlenW (lpString=".doc") returned 4
	[0090.051] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.051] lstrlenW (lpString=".docx") returned 5
	[0090.051] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.051] lstrlenW (lpString=".pdf") returned 4
	[0090.051] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.052] lstrlenW (lpString=".xls") returned 4
	[0090.052] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.052] lstrlenW (lpString=".xlsx") returned 5
	[0090.052] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.052] lstrlenW (lpString=".ppt") returned 4
	[0090.052] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0090.052] lstrlenW (lpString=".zip") returned 4
	[0090.052] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.052] lstrlenW (lpString=".rar") returned 4
	[0090.052] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.052] lstrlenW (lpString=".bz2") returned 4
	[0090.052] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.052] lstrlenW (lpString=".7z") returned 3
	[0090.052] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0090.052] lstrlenW (lpString=".dbf") returned 4
	[0090.052] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0090.052] lstrlenW (lpString=".1cd") returned 4
	[0090.052] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0090.052] lstrlenW (lpString=".jpg") returned 4
	[0090.052] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0090.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0090.053] lstrlenW (lpString=".doc") returned 4
	[0090.053] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.053] lstrlenW (lpString=".docx") returned 5
	[0090.053] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.053] lstrlenW (lpString=".pdf") returned 4
	[0090.053] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.053] lstrlenW (lpString=".xls") returned 4
	[0090.053] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.053] lstrlenW (lpString=".xlsx") returned 5
	[0090.053] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.053] lstrlenW (lpString=".ppt") returned 4
	[0090.053] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0090.053] lstrlenW (lpString=".zip") returned 4
	[0090.053] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.053] lstrlenW (lpString=".rar") returned 4
	[0090.053] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.053] lstrlenW (lpString=".bz2") returned 4
	[0090.053] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.053] lstrlenW (lpString=".7z") returned 3
	[0090.053] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0090.053] lstrlenW (lpString=".dbf") returned 4
	[0090.053] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0090.053] lstrlenW (lpString=".1cd") returned 4
	[0090.053] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0090.054] lstrlenW (lpString=".jpg") returned 4
	[0090.054] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.054] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0090.054] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0090.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.054] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1423) returned 1
	[0090.054] CloseHandle (hObject=0x188) returned 1
	[0090.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20
	[0090.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.055] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.055] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.073] GetLastError () returned 0x0
	[0090.073] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x58f, lpOverlapped=0x0) returned 1
	[0090.080] WriteFile (in: hFile=0x1ac, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x590, lpOverlapped=0x0) returned 1
	[0090.081] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.081] WriteFile (in: hFile=0x1ac, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.081] SetEndOfFile (hFile=0x1ac) returned 1
	[0090.082] CloseHandle (hObject=0x1ac) returned 1
	[0090.082] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.082] SetEndOfFile (hFile=0x188) returned 1
	[0090.083] CloseHandle (hObject=0x188) returned 1
	[0090.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.083] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1
	[0090.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0090.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0090.084] lstrlenW (lpString=".doc") returned 4
	[0090.084] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.084] lstrlenW (lpString=".docx") returned 5
	[0090.084] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.084] lstrlenW (lpString=".pdf") returned 4
	[0090.084] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.084] lstrlenW (lpString=".xls") returned 4
	[0090.084] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.084] lstrlenW (lpString=".xlsx") returned 5
	[0090.084] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.084] lstrlenW (lpString=".ppt") returned 4
	[0090.084] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0090.084] lstrlenW (lpString=".zip") returned 4
	[0090.084] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.084] lstrlenW (lpString=".rar") returned 4
	[0090.084] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.084] lstrlenW (lpString=".bz2") returned 4
	[0090.084] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.084] lstrlenW (lpString=".7z") returned 3
	[0090.084] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0090.085] lstrlenW (lpString=".dbf") returned 4
	[0090.085] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0090.085] lstrlenW (lpString=".1cd") returned 4
	[0090.085] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0090.085] lstrlenW (lpString=".jpg") returned 4
	[0090.085] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0090.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0090.085] lstrlenW (lpString=".doc") returned 4
	[0090.085] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.085] lstrlenW (lpString=".docx") returned 5
	[0090.085] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.085] lstrlenW (lpString=".pdf") returned 4
	[0090.085] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.085] lstrlenW (lpString=".xls") returned 4
	[0090.085] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.085] lstrlenW (lpString=".xlsx") returned 5
	[0090.085] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.085] lstrlenW (lpString=".ppt") returned 4
	[0090.085] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0090.085] lstrlenW (lpString=".zip") returned 4
	[0090.086] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.086] lstrlenW (lpString=".rar") returned 4
	[0090.086] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.086] lstrlenW (lpString=".bz2") returned 4
	[0090.086] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.086] lstrlenW (lpString=".7z") returned 3
	[0090.086] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0090.086] lstrlenW (lpString=".dbf") returned 4
	[0090.086] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0090.086] lstrlenW (lpString=".1cd") returned 4
	[0090.086] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0090.086] lstrlenW (lpString=".jpg") returned 4
	[0090.086] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.086] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0090.086] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0090.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.087] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3970) returned 1
	[0090.087] CloseHandle (hObject=0x188) returned 1
	[0090.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20
	[0090.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.088] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.088] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0090.108] GetLastError () returned 0x0
	[0090.108] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xf82, lpOverlapped=0x0) returned 1
	[0090.113] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf90, lpOverlapped=0x0) returned 1
	[0090.115] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.115] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.115] SetEndOfFile (hFile=0x1a8) returned 1
	[0090.115] CloseHandle (hObject=0x1a8) returned 1
	[0090.116] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.116] SetEndOfFile (hFile=0x188) returned 1
	[0090.117] CloseHandle (hObject=0x188) returned 1
	[0090.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.117] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1
	[0090.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0090.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0090.118] lstrlenW (lpString=".doc") returned 4
	[0090.118] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.118] lstrlenW (lpString=".docx") returned 5
	[0090.118] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.118] lstrlenW (lpString=".pdf") returned 4
	[0090.118] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.118] lstrlenW (lpString=".xls") returned 4
	[0090.118] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.118] lstrlenW (lpString=".xlsx") returned 5
	[0090.118] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.118] lstrlenW (lpString=".ppt") returned 4
	[0090.118] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0090.118] lstrlenW (lpString=".zip") returned 4
	[0090.118] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.118] lstrlenW (lpString=".rar") returned 4
	[0090.118] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.118] lstrlenW (lpString=".bz2") returned 4
	[0090.118] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.118] lstrlenW (lpString=".7z") returned 3
	[0090.118] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0090.118] lstrlenW (lpString=".dbf") returned 4
	[0090.118] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0090.118] lstrlenW (lpString=".1cd") returned 4
	[0090.119] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0090.119] lstrlenW (lpString=".jpg") returned 4
	[0090.119] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0090.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0090.119] lstrlenW (lpString=".doc") returned 4
	[0090.119] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.119] lstrlenW (lpString=".docx") returned 5
	[0090.119] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.119] lstrlenW (lpString=".pdf") returned 4
	[0090.119] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.119] lstrlenW (lpString=".xls") returned 4
	[0090.119] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.119] lstrlenW (lpString=".xlsx") returned 5
	[0090.119] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.119] lstrlenW (lpString=".ppt") returned 4
	[0090.119] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0090.119] lstrlenW (lpString=".zip") returned 4
	[0090.119] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.119] lstrlenW (lpString=".rar") returned 4
	[0090.119] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.119] lstrlenW (lpString=".bz2") returned 4
	[0090.119] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.120] lstrlenW (lpString=".7z") returned 3
	[0090.120] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0090.120] lstrlenW (lpString=".dbf") returned 4
	[0090.120] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0090.120] lstrlenW (lpString=".1cd") returned 4
	[0090.120] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0090.120] lstrlenW (lpString=".jpg") returned 4
	[0090.120] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.120] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0090.120] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0090.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.121] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2604) returned 1
	[0090.121] CloseHandle (hObject=0x188) returned 1
	[0090.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20
	[0090.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.122] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.122] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0090.153] GetLastError () returned 0x0
	[0090.153] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xa2c, lpOverlapped=0x0) returned 1
	[0090.165] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa30, lpOverlapped=0x0) returned 1
	[0090.166] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.166] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.166] SetEndOfFile (hFile=0x1b0) returned 1
	[0090.167] CloseHandle (hObject=0x1b0) returned 1
	[0090.167] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.167] SetEndOfFile (hFile=0x188) returned 1
	[0090.168] CloseHandle (hObject=0x188) returned 1
	[0090.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.168] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1
	[0090.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0090.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0090.169] lstrlenW (lpString=".doc") returned 4
	[0090.169] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.169] lstrlenW (lpString=".docx") returned 5
	[0090.169] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.169] lstrlenW (lpString=".pdf") returned 4
	[0090.169] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.169] lstrlenW (lpString=".xls") returned 4
	[0090.169] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.169] lstrlenW (lpString=".xlsx") returned 5
	[0090.169] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.169] lstrlenW (lpString=".ppt") returned 4
	[0090.169] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0090.169] lstrlenW (lpString=".zip") returned 4
	[0090.169] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.169] lstrlenW (lpString=".rar") returned 4
	[0090.169] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.169] lstrlenW (lpString=".bz2") returned 4
	[0090.169] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.169] lstrlenW (lpString=".7z") returned 3
	[0090.169] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0090.170] lstrlenW (lpString=".dbf") returned 4
	[0090.170] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0090.170] lstrlenW (lpString=".1cd") returned 4
	[0090.170] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0090.170] lstrlenW (lpString=".jpg") returned 4
	[0090.170] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0090.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0090.170] lstrlenW (lpString=".doc") returned 4
	[0090.170] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.170] lstrlenW (lpString=".docx") returned 5
	[0090.170] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.170] lstrlenW (lpString=".pdf") returned 4
	[0090.170] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.170] lstrlenW (lpString=".xls") returned 4
	[0090.170] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.170] lstrlenW (lpString=".xlsx") returned 5
	[0090.170] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.170] lstrlenW (lpString=".ppt") returned 4
	[0090.170] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0090.170] lstrlenW (lpString=".zip") returned 4
	[0090.170] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.171] lstrlenW (lpString=".rar") returned 4
	[0090.171] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.171] lstrlenW (lpString=".bz2") returned 4
	[0090.171] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.171] lstrlenW (lpString=".7z") returned 3
	[0090.171] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0090.171] lstrlenW (lpString=".dbf") returned 4
	[0090.171] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0090.171] lstrlenW (lpString=".1cd") returned 4
	[0090.171] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0090.171] lstrlenW (lpString=".jpg") returned 4
	[0090.171] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.171] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0090.171] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0090.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.172] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4100) returned 1
	[0090.172] CloseHandle (hObject=0x188) returned 1
	[0090.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20
	[0090.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.172] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.173] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0090.237] GetLastError () returned 0x0
	[0090.237] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1004, lpOverlapped=0x0) returned 1
	[0090.244] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1010, lpOverlapped=0x0) returned 1
	[0090.245] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.245] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.245] SetEndOfFile (hFile=0x1b0) returned 1
	[0090.245] CloseHandle (hObject=0x1b0) returned 1
	[0090.245] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.245] SetEndOfFile (hFile=0x188) returned 1
	[0090.246] CloseHandle (hObject=0x188) returned 1
	[0090.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.247] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1
	[0090.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0090.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0090.247] lstrlenW (lpString=".doc") returned 4
	[0090.247] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.247] lstrlenW (lpString=".docx") returned 5
	[0090.247] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.247] lstrlenW (lpString=".pdf") returned 4
	[0090.247] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.247] lstrlenW (lpString=".xls") returned 4
	[0090.247] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.247] lstrlenW (lpString=".xlsx") returned 5
	[0090.247] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.247] lstrlenW (lpString=".ppt") returned 4
	[0090.247] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0090.247] lstrlenW (lpString=".zip") returned 4
	[0090.247] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.247] lstrlenW (lpString=".rar") returned 4
	[0090.247] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.247] lstrlenW (lpString=".bz2") returned 4
	[0090.247] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.247] lstrlenW (lpString=".7z") returned 3
	[0090.247] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0090.247] lstrlenW (lpString=".dbf") returned 4
	[0090.247] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0090.248] lstrlenW (lpString=".1cd") returned 4
	[0090.248] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0090.248] lstrlenW (lpString=".jpg") returned 4
	[0090.248] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0090.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0090.248] lstrlenW (lpString=".doc") returned 4
	[0090.248] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.248] lstrlenW (lpString=".docx") returned 5
	[0090.248] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.248] lstrlenW (lpString=".pdf") returned 4
	[0090.248] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.248] lstrlenW (lpString=".xls") returned 4
	[0090.248] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.248] lstrlenW (lpString=".xlsx") returned 5
	[0090.248] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.248] lstrlenW (lpString=".ppt") returned 4
	[0090.248] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0090.248] lstrlenW (lpString=".zip") returned 4
	[0090.248] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.248] lstrlenW (lpString=".rar") returned 4
	[0090.248] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.248] lstrlenW (lpString=".bz2") returned 4
	[0090.248] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.248] lstrlenW (lpString=".7z") returned 3
	[0090.248] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0090.248] lstrlenW (lpString=".dbf") returned 4
	[0090.248] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0090.249] lstrlenW (lpString=".1cd") returned 4
	[0090.249] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0090.249] lstrlenW (lpString=".jpg") returned 4
	[0090.249] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.249] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0090.249] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0090.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0090.296] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1009) returned 1
	[0090.296] CloseHandle (hObject=0x194) returned 1
	[0090.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20
	[0090.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.391] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.391] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0090.463] GetLastError () returned 0x0
	[0090.463] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x3f1, lpOverlapped=0x0) returned 1
	[0090.471] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x400, lpOverlapped=0x0) returned 1
	[0090.475] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.476] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.476] SetEndOfFile (hFile=0x1b0) returned 1
	[0090.476] CloseHandle (hObject=0x1b0) returned 1
	[0090.476] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.476] SetEndOfFile (hFile=0x160) returned 1
	[0090.477] CloseHandle (hObject=0x160) returned 1
	[0090.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.478] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1
	[0090.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0090.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0090.478] lstrlenW (lpString=".doc") returned 4
	[0090.478] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.478] lstrlenW (lpString=".docx") returned 5
	[0090.478] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.478] lstrlenW (lpString=".pdf") returned 4
	[0090.478] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.478] lstrlenW (lpString=".xls") returned 4
	[0090.478] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.478] lstrlenW (lpString=".xlsx") returned 5
	[0090.478] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.478] lstrlenW (lpString=".ppt") returned 4
	[0090.478] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0090.478] lstrlenW (lpString=".zip") returned 4
	[0090.478] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.479] lstrlenW (lpString=".rar") returned 4
	[0090.479] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.479] lstrlenW (lpString=".bz2") returned 4
	[0090.479] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.479] lstrlenW (lpString=".7z") returned 3
	[0090.479] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0090.479] lstrlenW (lpString=".dbf") returned 4
	[0090.479] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0090.479] lstrlenW (lpString=".1cd") returned 4
	[0090.479] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0090.479] lstrlenW (lpString=".jpg") returned 4
	[0090.479] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0090.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0090.479] lstrlenW (lpString=".doc") returned 4
	[0090.479] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.479] lstrlenW (lpString=".docx") returned 5
	[0090.479] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.479] lstrlenW (lpString=".pdf") returned 4
	[0090.479] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.479] lstrlenW (lpString=".xls") returned 4
	[0090.479] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.479] lstrlenW (lpString=".xlsx") returned 5
	[0090.480] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.480] lstrlenW (lpString=".ppt") returned 4
	[0090.480] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0090.480] lstrlenW (lpString=".zip") returned 4
	[0090.480] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.480] lstrlenW (lpString=".rar") returned 4
	[0090.480] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.480] lstrlenW (lpString=".bz2") returned 4
	[0090.480] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.480] lstrlenW (lpString=".7z") returned 3
	[0090.480] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0090.480] lstrlenW (lpString=".dbf") returned 4
	[0090.480] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0090.480] lstrlenW (lpString=".1cd") returned 4
	[0090.480] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0090.480] lstrlenW (lpString=".jpg") returned 4
	[0090.480] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.480] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0090.481] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0090.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.481] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4991) returned 1
	[0090.481] CloseHandle (hObject=0x160) returned 1
	[0090.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20
	[0090.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.482] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.482] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0090.504] GetLastError () returned 0x0
	[0090.504] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x137f, lpOverlapped=0x0) returned 1
	[0090.510] WriteFile (in: hFile=0x190, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1380, lpOverlapped=0x0) returned 1
	[0090.511] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.511] WriteFile (in: hFile=0x190, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.511] SetEndOfFile (hFile=0x190) returned 1
	[0090.511] CloseHandle (hObject=0x190) returned 1
	[0090.512] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.512] SetEndOfFile (hFile=0x160) returned 1
	[0090.513] CloseHandle (hObject=0x160) returned 1
	[0090.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.513] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1
	[0090.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0090.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0090.513] lstrlenW (lpString=".doc") returned 4
	[0090.514] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.514] lstrlenW (lpString=".docx") returned 5
	[0090.514] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.514] lstrlenW (lpString=".pdf") returned 4
	[0090.514] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.514] lstrlenW (lpString=".xls") returned 4
	[0090.514] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.514] lstrlenW (lpString=".xlsx") returned 5
	[0090.514] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.514] lstrlenW (lpString=".ppt") returned 4
	[0090.514] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0090.514] lstrlenW (lpString=".zip") returned 4
	[0090.514] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.514] lstrlenW (lpString=".rar") returned 4
	[0090.514] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.514] lstrlenW (lpString=".bz2") returned 4
	[0090.514] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.514] lstrlenW (lpString=".7z") returned 3
	[0090.514] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0090.514] lstrlenW (lpString=".dbf") returned 4
	[0090.514] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0090.514] lstrlenW (lpString=".1cd") returned 4
	[0090.514] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0090.515] lstrlenW (lpString=".jpg") returned 4
	[0090.515] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0090.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0090.515] lstrlenW (lpString=".doc") returned 4
	[0090.515] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.515] lstrlenW (lpString=".docx") returned 5
	[0090.515] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.515] lstrlenW (lpString=".pdf") returned 4
	[0090.515] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.515] lstrlenW (lpString=".xls") returned 4
	[0090.515] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.515] lstrlenW (lpString=".xlsx") returned 5
	[0090.515] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.515] lstrlenW (lpString=".ppt") returned 4
	[0090.515] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0090.515] lstrlenW (lpString=".zip") returned 4
	[0090.515] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.515] lstrlenW (lpString=".rar") returned 4
	[0090.515] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.515] lstrlenW (lpString=".bz2") returned 4
	[0090.515] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.515] lstrlenW (lpString=".7z") returned 3
	[0090.515] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0090.516] lstrlenW (lpString=".dbf") returned 4
	[0090.516] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0090.516] lstrlenW (lpString=".1cd") returned 4
	[0090.516] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0090.516] lstrlenW (lpString=".jpg") returned 4
	[0090.516] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.516] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0090.516] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0090.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.517] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2668) returned 1
	[0090.517] CloseHandle (hObject=0x160) returned 1
	[0090.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20
	[0090.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.518] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.518] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0090.534] GetLastError () returned 0x0
	[0090.534] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xa6c, lpOverlapped=0x0) returned 1
	[0090.539] WriteFile (in: hFile=0x1b4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa70, lpOverlapped=0x0) returned 1
	[0090.541] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.541] WriteFile (in: hFile=0x1b4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.541] SetEndOfFile (hFile=0x1b4) returned 1
	[0090.541] CloseHandle (hObject=0x1b4) returned 1
	[0090.542] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.542] SetEndOfFile (hFile=0x160) returned 1
	[0090.543] CloseHandle (hObject=0x160) returned 1
	[0090.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.543] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1
	[0090.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0090.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0090.543] lstrlenW (lpString=".doc") returned 4
	[0090.543] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.543] lstrlenW (lpString=".docx") returned 5
	[0090.543] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.543] lstrlenW (lpString=".pdf") returned 4
	[0090.544] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.544] lstrlenW (lpString=".xls") returned 4
	[0090.544] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.544] lstrlenW (lpString=".xlsx") returned 5
	[0090.544] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.544] lstrlenW (lpString=".ppt") returned 4
	[0090.544] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0090.544] lstrlenW (lpString=".zip") returned 4
	[0090.544] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.544] lstrlenW (lpString=".rar") returned 4
	[0090.544] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.544] lstrlenW (lpString=".bz2") returned 4
	[0090.544] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.544] lstrlenW (lpString=".7z") returned 3
	[0090.544] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0090.544] lstrlenW (lpString=".dbf") returned 4
	[0090.544] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0090.544] lstrlenW (lpString=".1cd") returned 4
	[0090.544] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0090.544] lstrlenW (lpString=".jpg") returned 4
	[0090.544] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0090.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0090.545] lstrlenW (lpString=".doc") returned 4
	[0090.545] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.545] lstrlenW (lpString=".docx") returned 5
	[0090.545] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.545] lstrlenW (lpString=".pdf") returned 4
	[0090.545] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.545] lstrlenW (lpString=".xls") returned 4
	[0090.545] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.545] lstrlenW (lpString=".xlsx") returned 5
	[0090.545] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.545] lstrlenW (lpString=".ppt") returned 4
	[0090.545] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0090.545] lstrlenW (lpString=".zip") returned 4
	[0090.545] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.545] lstrlenW (lpString=".rar") returned 4
	[0090.545] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.545] lstrlenW (lpString=".bz2") returned 4
	[0090.545] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.545] lstrlenW (lpString=".7z") returned 3
	[0090.545] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0090.545] lstrlenW (lpString=".dbf") returned 4
	[0090.545] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0090.545] lstrlenW (lpString=".1cd") returned 4
	[0090.546] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0090.546] lstrlenW (lpString=".jpg") returned 4
	[0090.546] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.546] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0090.546] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0090.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.579] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1571) returned 1
	[0090.579] CloseHandle (hObject=0x184) returned 1
	[0090.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20
	[0090.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.635] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.635] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.649] GetLastError () returned 0x0
	[0090.649] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x623, lpOverlapped=0x0) returned 1
	[0090.750] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x630, lpOverlapped=0x0) returned 1
	[0090.752] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.753] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.753] SetEndOfFile (hFile=0x184) returned 1
	[0090.754] CloseHandle (hObject=0x184) returned 1
	[0090.755] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.755] SetEndOfFile (hFile=0x188) returned 1
	[0090.756] CloseHandle (hObject=0x188) returned 1
	[0090.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.756] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1
	[0090.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0090.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0090.756] lstrlenW (lpString=".doc") returned 4
	[0090.756] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.756] lstrlenW (lpString=".docx") returned 5
	[0090.756] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.757] lstrlenW (lpString=".pdf") returned 4
	[0090.757] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.757] lstrlenW (lpString=".xls") returned 4
	[0090.757] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.757] lstrlenW (lpString=".xlsx") returned 5
	[0090.757] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.757] lstrlenW (lpString=".ppt") returned 4
	[0090.757] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0090.757] lstrlenW (lpString=".zip") returned 4
	[0090.757] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.757] lstrlenW (lpString=".rar") returned 4
	[0090.757] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.757] lstrlenW (lpString=".bz2") returned 4
	[0090.757] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.757] lstrlenW (lpString=".7z") returned 3
	[0090.757] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0090.757] lstrlenW (lpString=".dbf") returned 4
	[0090.757] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0090.757] lstrlenW (lpString=".1cd") returned 4
	[0090.757] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0090.757] lstrlenW (lpString=".jpg") returned 4
	[0090.757] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0090.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0090.758] lstrlenW (lpString=".doc") returned 4
	[0090.758] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0090.758] lstrlenW (lpString=".docx") returned 5
	[0090.758] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0090.758] lstrlenW (lpString=".pdf") returned 4
	[0090.758] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0090.758] lstrlenW (lpString=".xls") returned 4
	[0090.758] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0090.758] lstrlenW (lpString=".xlsx") returned 5
	[0090.758] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0090.758] lstrlenW (lpString=".ppt") returned 4
	[0090.758] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0090.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0090.758] lstrlenW (lpString=".zip") returned 4
	[0090.758] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0090.758] lstrlenW (lpString=".rar") returned 4
	[0090.758] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0090.758] lstrlenW (lpString=".bz2") returned 4
	[0090.758] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0090.758] lstrlenW (lpString=".7z") returned 3
	[0090.758] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0090.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0090.758] lstrlenW (lpString=".dbf") returned 4
	[0090.758] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0090.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0090.759] lstrlenW (lpString=".1cd") returned 4
	[0090.759] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0090.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0090.759] lstrlenW (lpString=".jpg") returned 4
	[0090.759] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0090.759] lstrcmpiW (lpString1=".CHM", lpString2=".adobe") returned 1
	[0090.759] lstrlenW (lpString="FM20.CHM") returned 8
	[0090.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.761] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=334427) returned 1
	[0090.761] CloseHandle (hObject=0x188) returned 1
	[0090.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20
	[0090.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.765] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.765] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.766] GetLastError () returned 0x0
	[0090.766] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x51a5b, lpOverlapped=0x0) returned 1
	[0090.875] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x51a60, lpOverlapped=0x0) returned 1
	[0090.884] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.884] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0090.884] SetEndOfFile (hFile=0x184) returned 1
	[0090.884] CloseHandle (hObject=0x184) returned 1
	[0090.884] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.884] SetEndOfFile (hFile=0x188) returned 1
	[0090.888] CloseHandle (hObject=0x188) returned 1
	[0090.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.888] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1
	[0090.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0090.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0090.888] lstrlenW (lpString=".doc") returned 4
	[0090.888] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0090.888] lstrlenW (lpString=".docx") returned 5
	[0090.888] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1
	[0090.888] lstrlenW (lpString=".pdf") returned 4
	[0090.888] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0090.889] lstrlenW (lpString=".xls") returned 4
	[0090.889] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0090.889] lstrlenW (lpString=".xlsx") returned 5
	[0090.889] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1
	[0090.889] lstrlenW (lpString=".ppt") returned 4
	[0090.889] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0090.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0090.889] lstrlenW (lpString=".zip") returned 4
	[0090.889] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0090.889] lstrlenW (lpString=".rar") returned 4
	[0090.889] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0090.889] lstrlenW (lpString=".bz2") returned 4
	[0090.889] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0090.889] lstrlenW (lpString=".7z") returned 3
	[0090.889] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0090.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0090.889] lstrlenW (lpString=".dbf") returned 4
	[0090.889] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0090.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0090.889] lstrlenW (lpString=".1cd") returned 4
	[0090.889] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0090.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0090.889] lstrlenW (lpString=".jpg") returned 4
	[0090.889] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0090.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0090.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0090.890] lstrlenW (lpString=".doc") returned 4
	[0090.890] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0090.890] lstrlenW (lpString=".docx") returned 5
	[0090.890] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1
	[0090.890] lstrlenW (lpString=".pdf") returned 4
	[0090.890] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0090.890] lstrlenW (lpString=".xls") returned 4
	[0090.890] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0090.890] lstrlenW (lpString=".xlsx") returned 5
	[0090.890] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1
	[0090.890] lstrlenW (lpString=".ppt") returned 4
	[0090.890] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0090.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0090.890] lstrlenW (lpString=".zip") returned 4
	[0090.890] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0090.890] lstrlenW (lpString=".rar") returned 4
	[0090.890] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0090.890] lstrlenW (lpString=".bz2") returned 4
	[0090.890] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0090.891] lstrlenW (lpString=".7z") returned 3
	[0090.891] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0090.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0090.891] lstrlenW (lpString=".dbf") returned 4
	[0090.891] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0090.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0090.891] lstrlenW (lpString=".1cd") returned 4
	[0090.891] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0090.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0090.891] lstrlenW (lpString=".jpg") returned 4
	[0090.891] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0090.891] lstrcmpiW (lpString1=".CHM", lpString2=".adobe") returned 1
	[0090.891] lstrlenW (lpString="VBHW6.CHM") returned 9
	[0090.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.892] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=58026) returned 1
	[0090.892] CloseHandle (hObject=0x188) returned 1
	[0090.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20
	[0090.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.893] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.893] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.893] GetLastError () returned 0x0
	[0090.893] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xe2aa, lpOverlapped=0x0) returned 1
	[0090.923] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe2b0, lpOverlapped=0x0) returned 1
	[0090.925] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.925] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0090.925] SetEndOfFile (hFile=0x184) returned 1
	[0090.925] CloseHandle (hObject=0x184) returned 1
	[0090.925] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.925] SetEndOfFile (hFile=0x188) returned 1
	[0090.926] CloseHandle (hObject=0x188) returned 1
	[0090.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.927] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1
	[0090.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0090.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0090.927] lstrlenW (lpString=".doc") returned 4
	[0090.927] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0090.927] lstrlenW (lpString=".docx") returned 5
	[0090.927] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0090.927] lstrlenW (lpString=".pdf") returned 4
	[0090.927] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0090.927] lstrlenW (lpString=".xls") returned 4
	[0090.927] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0090.928] lstrlenW (lpString=".xlsx") returned 5
	[0090.928] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0090.928] lstrlenW (lpString=".ppt") returned 4
	[0090.928] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0090.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0090.928] lstrlenW (lpString=".zip") returned 4
	[0090.928] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0090.928] lstrlenW (lpString=".rar") returned 4
	[0090.928] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0090.928] lstrlenW (lpString=".bz2") returned 4
	[0090.928] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0090.928] lstrlenW (lpString=".7z") returned 3
	[0090.928] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0090.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0090.928] lstrlenW (lpString=".dbf") returned 4
	[0090.928] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0090.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0090.928] lstrlenW (lpString=".1cd") returned 4
	[0090.928] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0090.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0090.928] lstrlenW (lpString=".jpg") returned 4
	[0090.928] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0090.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0090.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0090.928] lstrlenW (lpString=".doc") returned 4
	[0090.928] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0090.928] lstrlenW (lpString=".docx") returned 5
	[0090.928] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0090.928] lstrlenW (lpString=".pdf") returned 4
	[0090.928] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0090.929] lstrlenW (lpString=".xls") returned 4
	[0090.929] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0090.929] lstrlenW (lpString=".xlsx") returned 5
	[0090.929] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0090.929] lstrlenW (lpString=".ppt") returned 4
	[0090.929] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0090.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0090.929] lstrlenW (lpString=".zip") returned 4
	[0090.929] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0090.929] lstrlenW (lpString=".rar") returned 4
	[0090.929] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0090.929] lstrlenW (lpString=".bz2") returned 4
	[0090.929] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0090.929] lstrlenW (lpString=".7z") returned 3
	[0090.929] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0090.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0090.929] lstrlenW (lpString=".dbf") returned 4
	[0090.929] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0090.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0090.929] lstrlenW (lpString=".1cd") returned 4
	[0090.929] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0090.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0090.929] lstrlenW (lpString=".jpg") returned 4
	[0090.929] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0090.929] lstrcmpiW (lpString1=".CHM", lpString2=".adobe") returned 1
	[0090.930] lstrlenW (lpString="VBLR6.CHM") returned 9
	[0090.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.930] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=944994) returned 1
	[0090.930] CloseHandle (hObject=0x188) returned 1
	[0090.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20
	[0090.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.931] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.931] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.931] GetLastError () returned 0x0
	[0090.931] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xe6b62, lpOverlapped=0x0) returned 1
	[0091.463] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6b70, lpOverlapped=0x0) returned 1
	[0091.602] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.603] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0091.603] SetEndOfFile (hFile=0x184) returned 1
	[0091.603] CloseHandle (hObject=0x184) returned 1
	[0091.603] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.603] SetEndOfFile (hFile=0x188) returned 1
	[0091.613] CloseHandle (hObject=0x188) returned 1
	[0091.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0091.613] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1
	[0091.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0091.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0091.614] lstrlenW (lpString=".doc") returned 4
	[0091.614] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0091.614] lstrlenW (lpString=".docx") returned 5
	[0091.614] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0091.614] lstrlenW (lpString=".pdf") returned 4
	[0091.614] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0091.614] lstrlenW (lpString=".xls") returned 4
	[0091.614] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0091.614] lstrlenW (lpString=".xlsx") returned 5
	[0091.614] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0091.614] lstrlenW (lpString=".ppt") returned 4
	[0091.614] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0091.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0091.614] lstrlenW (lpString=".zip") returned 4
	[0091.614] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0091.614] lstrlenW (lpString=".rar") returned 4
	[0091.614] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0091.614] lstrlenW (lpString=".bz2") returned 4
	[0091.614] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0091.614] lstrlenW (lpString=".7z") returned 3
	[0091.614] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0091.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0091.614] lstrlenW (lpString=".dbf") returned 4
	[0091.615] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0091.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0091.615] lstrlenW (lpString=".1cd") returned 4
	[0091.615] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0091.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0091.615] lstrlenW (lpString=".jpg") returned 4
	[0091.615] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0091.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0091.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0091.615] lstrlenW (lpString=".doc") returned 4
	[0091.615] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0091.615] lstrlenW (lpString=".docx") returned 5
	[0091.615] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0091.615] lstrlenW (lpString=".pdf") returned 4
	[0091.615] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0091.615] lstrlenW (lpString=".xls") returned 4
	[0091.615] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0091.615] lstrlenW (lpString=".xlsx") returned 5
	[0091.615] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0091.615] lstrlenW (lpString=".ppt") returned 4
	[0091.615] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0091.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0091.615] lstrlenW (lpString=".zip") returned 4
	[0091.615] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0091.615] lstrlenW (lpString=".rar") returned 4
	[0091.616] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0091.616] lstrlenW (lpString=".bz2") returned 4
	[0091.616] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0091.616] lstrlenW (lpString=".7z") returned 3
	[0091.616] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0091.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0091.616] lstrlenW (lpString=".dbf") returned 4
	[0091.616] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0091.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0091.616] lstrlenW (lpString=".1cd") returned 4
	[0091.616] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0091.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0091.616] lstrlenW (lpString=".jpg") returned 4
	[0091.616] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0091.616] lstrcmpiW (lpString1=".inc", lpString2=".adobe") returned 1
	[0091.616] lstrlenW (lpString="adovbs.inc") returned 10
	[0091.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0091.774] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=14951) returned 1
	[0091.774] CloseHandle (hObject=0x1c0) returned 1
	[0091.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20
	[0091.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0091.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0091.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0091.785] lstrlenW (lpString=".doc") returned 4
	[0091.785] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0091.785] lstrlenW (lpString=".docx") returned 5
	[0091.785] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0091.785] lstrlenW (lpString=".pdf") returned 4
	[0091.785] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0091.785] lstrlenW (lpString=".xls") returned 4
	[0091.785] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0091.785] lstrlenW (lpString=".xlsx") returned 5
	[0091.785] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0091.785] lstrlenW (lpString=".ppt") returned 4
	[0091.785] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0091.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0091.785] lstrlenW (lpString=".zip") returned 4
	[0091.785] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0091.785] lstrlenW (lpString=".rar") returned 4
	[0091.785] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0091.786] lstrlenW (lpString=".bz2") returned 4
	[0091.786] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0091.786] lstrlenW (lpString=".7z") returned 3
	[0091.786] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0091.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0091.786] lstrlenW (lpString=".dbf") returned 4
	[0091.786] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0091.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0091.786] lstrlenW (lpString=".1cd") returned 4
	[0091.786] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0091.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0091.786] lstrlenW (lpString=".jpg") returned 4
	[0091.786] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0091.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0091.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0091.786] lstrlenW (lpString=".doc") returned 4
	[0091.786] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0091.786] lstrlenW (lpString=".docx") returned 5
	[0091.786] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0091.786] lstrlenW (lpString=".pdf") returned 4
	[0091.786] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0091.786] lstrlenW (lpString=".xls") returned 4
	[0091.786] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0091.786] lstrlenW (lpString=".xlsx") returned 5
	[0091.786] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0091.787] lstrlenW (lpString=".ppt") returned 4
	[0091.787] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0091.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0091.787] lstrlenW (lpString=".zip") returned 4
	[0091.787] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0091.787] lstrlenW (lpString=".rar") returned 4
	[0091.787] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0091.787] lstrlenW (lpString=".bz2") returned 4
	[0091.787] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0091.787] lstrlenW (lpString=".7z") returned 3
	[0091.787] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0091.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0091.787] lstrlenW (lpString=".dbf") returned 4
	[0091.787] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0091.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0091.787] lstrlenW (lpString=".1cd") returned 4
	[0091.787] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0091.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0091.787] lstrlenW (lpString=".jpg") returned 4
	[0091.787] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0091.787] lstrcmpiW (lpString1=".inc", lpString2=".adobe") returned 1
	[0091.787] lstrlenW (lpString="adcjavas.inc") returned 12
	[0091.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0091.812] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=630) returned 1
	[0091.812] CloseHandle (hObject=0x1c4) returned 1
	[0091.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20
	[0091.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0091.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0091.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0091.852] lstrlenW (lpString=".doc") returned 4
	[0091.852] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0091.852] lstrlenW (lpString=".docx") returned 5
	[0091.852] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0091.852] lstrlenW (lpString=".pdf") returned 4
	[0091.852] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0091.852] lstrlenW (lpString=".xls") returned 4
	[0091.852] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0091.852] lstrlenW (lpString=".xlsx") returned 5
	[0091.852] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0091.853] lstrlenW (lpString=".ppt") returned 4
	[0091.853] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0091.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0091.853] lstrlenW (lpString=".zip") returned 4
	[0091.853] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0091.853] lstrlenW (lpString=".rar") returned 4
	[0091.853] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0091.853] lstrlenW (lpString=".bz2") returned 4
	[0091.853] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0091.853] lstrlenW (lpString=".7z") returned 3
	[0091.853] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0091.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0091.853] lstrlenW (lpString=".dbf") returned 4
	[0091.853] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0091.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0091.853] lstrlenW (lpString=".1cd") returned 4
	[0091.853] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0091.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0091.853] lstrlenW (lpString=".jpg") returned 4
	[0091.853] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0091.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0091.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0091.853] lstrlenW (lpString=".doc") returned 4
	[0091.854] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0091.854] lstrlenW (lpString=".docx") returned 5
	[0091.854] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0091.854] lstrlenW (lpString=".pdf") returned 4
	[0091.854] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0091.854] lstrlenW (lpString=".xls") returned 4
	[0091.854] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0091.854] lstrlenW (lpString=".xlsx") returned 5
	[0091.854] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0091.854] lstrlenW (lpString=".ppt") returned 4
	[0091.854] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0091.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0091.854] lstrlenW (lpString=".zip") returned 4
	[0091.854] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0091.854] lstrlenW (lpString=".rar") returned 4
	[0091.854] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0091.854] lstrlenW (lpString=".bz2") returned 4
	[0091.854] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0091.854] lstrlenW (lpString=".7z") returned 3
	[0091.854] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0091.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0091.854] lstrlenW (lpString=".dbf") returned 4
	[0091.854] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0091.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0091.854] lstrlenW (lpString=".1cd") returned 4
	[0091.854] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0091.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0091.855] lstrlenW (lpString=".jpg") returned 4
	[0091.855] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0091.855] lstrcmpiW (lpString1=".inc", lpString2=".adobe") returned 1
	[0091.855] lstrlenW (lpString="oledbjvs.inc") returned 12
	[0091.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0091.873] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=9804) returned 1
	[0091.873] CloseHandle (hObject=0x1b0) returned 1
	[0091.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20
	[0091.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0091.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0091.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0091.886] lstrlenW (lpString=".doc") returned 4
	[0091.886] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0091.886] lstrlenW (lpString=".docx") returned 5
	[0091.886] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0091.886] lstrlenW (lpString=".pdf") returned 4
	[0091.886] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0091.886] lstrlenW (lpString=".xls") returned 4
	[0091.886] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0091.886] lstrlenW (lpString=".xlsx") returned 5
	[0091.886] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0091.886] lstrlenW (lpString=".ppt") returned 4
	[0091.886] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0091.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0091.886] lstrlenW (lpString=".zip") returned 4
	[0091.886] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0091.886] lstrlenW (lpString=".rar") returned 4
	[0091.886] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0091.886] lstrlenW (lpString=".bz2") returned 4
	[0091.886] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0091.886] lstrlenW (lpString=".7z") returned 3
	[0091.886] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0091.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0091.886] lstrlenW (lpString=".dbf") returned 4
	[0091.886] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0091.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0091.887] lstrlenW (lpString=".1cd") returned 4
	[0091.887] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0091.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0091.887] lstrlenW (lpString=".jpg") returned 4
	[0091.887] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0091.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0091.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0091.887] lstrlenW (lpString=".doc") returned 4
	[0091.887] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0091.887] lstrlenW (lpString=".docx") returned 5
	[0091.887] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0091.887] lstrlenW (lpString=".pdf") returned 4
	[0091.887] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0091.887] lstrlenW (lpString=".xls") returned 4
	[0091.887] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0091.887] lstrlenW (lpString=".xlsx") returned 5
	[0091.887] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0091.887] lstrlenW (lpString=".ppt") returned 4
	[0091.887] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0091.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0091.887] lstrlenW (lpString=".zip") returned 4
	[0091.887] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0091.887] lstrlenW (lpString=".rar") returned 4
	[0091.888] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0091.888] lstrlenW (lpString=".bz2") returned 4
	[0091.888] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0091.888] lstrlenW (lpString=".7z") returned 3
	[0091.888] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0091.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0091.888] lstrlenW (lpString=".dbf") returned 4
	[0091.888] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0091.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0091.888] lstrlenW (lpString=".1cd") returned 4
	[0091.888] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0091.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0091.888] lstrlenW (lpString=".jpg") returned 4
	[0091.888] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0091.888] lstrcmpiW (lpString1=".ini", lpString2=".adobe") returned 1
	[0091.888] lstrlenW (lpString="desktop.ini") returned 11
	[0091.888] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0091.889] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=174) returned 1
	[0091.889] CloseHandle (hObject=0x1c0) returned 1
	[0091.889] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26
	[0091.889] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.889] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0091.889] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.890] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.890] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0091.890] GetLastError () returned 0x0
	[0091.890] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xae, lpOverlapped=0x0) returned 1
	[0091.892] WriteFile (in: hFile=0x1b8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xb0, lpOverlapped=0x0) returned 1
	[0091.894] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.894] WriteFile (in: hFile=0x1b8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0091.894] SetEndOfFile (hFile=0x1b8) returned 1
	[0091.894] CloseHandle (hObject=0x1b8) returned 1
	[0091.894] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.894] SetEndOfFile (hFile=0x1c0) returned 1
	[0091.895] CloseHandle (hObject=0x1c0) returned 1
	[0091.895] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x26) returned 1
	[0091.896] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1
	[0091.896] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0091.896] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0091.896] lstrlenW (lpString=".doc") returned 4
	[0091.896] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0091.896] lstrlenW (lpString=".docx") returned 5
	[0091.896] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0091.896] lstrlenW (lpString=".pdf") returned 4
	[0091.896] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0091.896] lstrlenW (lpString=".xls") returned 4
	[0091.896] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0091.896] lstrlenW (lpString=".xlsx") returned 5
	[0091.896] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0091.897] lstrlenW (lpString=".ppt") returned 4
	[0091.897] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0091.897] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0091.897] lstrlenW (lpString=".zip") returned 4
	[0091.897] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0091.897] lstrlenW (lpString=".rar") returned 4
	[0091.897] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0091.897] lstrlenW (lpString=".bz2") returned 4
	[0091.897] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0091.897] lstrlenW (lpString=".7z") returned 3
	[0091.897] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0091.897] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0091.897] lstrlenW (lpString=".dbf") returned 4
	[0091.897] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0091.897] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0091.897] lstrlenW (lpString=".1cd") returned 4
	[0091.897] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0091.897] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0091.897] lstrlenW (lpString=".jpg") returned 4
	[0091.897] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0091.897] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0091.897] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0091.897] lstrlenW (lpString=".doc") returned 4
	[0091.897] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0091.897] lstrlenW (lpString=".docx") returned 5
	[0091.897] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0091.898] lstrlenW (lpString=".pdf") returned 4
	[0091.898] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0091.898] lstrlenW (lpString=".xls") returned 4
	[0091.898] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0091.898] lstrlenW (lpString=".xlsx") returned 5
	[0091.898] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0091.898] lstrlenW (lpString=".ppt") returned 4
	[0091.898] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0091.898] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0091.898] lstrlenW (lpString=".zip") returned 4
	[0091.898] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0091.898] lstrlenW (lpString=".rar") returned 4
	[0091.898] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0091.898] lstrlenW (lpString=".bz2") returned 4
	[0091.898] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0091.898] lstrlenW (lpString=".7z") returned 3
	[0091.898] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0091.898] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0091.898] lstrlenW (lpString=".dbf") returned 4
	[0091.898] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0091.898] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0091.898] lstrlenW (lpString=".1cd") returned 4
	[0091.898] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0091.898] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0091.898] lstrlenW (lpString=".jpg") returned 4
	[0091.898] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0091.899] lstrcmpiW (lpString1=".png", lpString2=".adobe") returned 1
	[0091.899] lstrlenW (lpString="DissolveAnother.png") returned 19
	[0091.899] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0091.916] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=27935) returned 1
	[0091.916] CloseHandle (hObject=0x1b8) returned 1
	[0091.917] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20
	[0091.953] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.953] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0091.953] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53
	[0091.953] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53
	[0091.953] lstrlenW (lpString=".doc") returned 4
	[0091.953] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0091.953] lstrlenW (lpString=".docx") returned 5
	[0091.953] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1
	[0091.953] lstrlenW (lpString=".pdf") returned 4
	[0091.953] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0091.953] lstrlenW (lpString=".xls") returned 4
	[0091.953] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0091.953] lstrlenW (lpString=".xlsx") returned 5
	[0091.953] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1
	[0091.953] lstrlenW (lpString=".ppt") returned 4
	[0091.953] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0091.953] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53
	[0091.953] lstrlenW (lpString=".zip") returned 4
	[0091.953] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0091.953] lstrlenW (lpString=".rar") returned 4
	[0091.954] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0091.954] lstrlenW (lpString=".bz2") returned 4
	[0091.954] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0091.954] lstrlenW (lpString=".7z") returned 3
	[0091.954] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0091.954] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53
	[0091.954] lstrlenW (lpString=".dbf") returned 4
	[0091.954] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0091.954] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53
	[0091.954] lstrlenW (lpString=".1cd") returned 4
	[0091.954] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0091.954] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53
	[0091.954] lstrlenW (lpString=".jpg") returned 4
	[0091.954] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0091.954] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53
	[0091.954] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53
	[0091.954] lstrlenW (lpString=".doc") returned 4
	[0091.954] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0091.954] lstrlenW (lpString=".docx") returned 5
	[0091.954] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1
	[0091.954] lstrlenW (lpString=".pdf") returned 4
	[0091.954] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0091.954] lstrlenW (lpString=".xls") returned 4
	[0091.954] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0091.954] lstrlenW (lpString=".xlsx") returned 5
	[0091.954] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1
	[0091.955] lstrlenW (lpString=".ppt") returned 4
	[0091.955] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0091.955] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53
	[0091.955] lstrlenW (lpString=".zip") returned 4
	[0091.955] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0091.955] lstrlenW (lpString=".rar") returned 4
	[0091.955] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0091.955] lstrlenW (lpString=".bz2") returned 4
	[0091.955] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0091.955] lstrlenW (lpString=".7z") returned 3
	[0091.955] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0091.955] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53
	[0091.955] lstrlenW (lpString=".dbf") returned 4
	[0091.955] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0091.955] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53
	[0091.955] lstrlenW (lpString=".1cd") returned 4
	[0091.955] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0091.955] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53
	[0091.955] lstrlenW (lpString=".jpg") returned 4
	[0091.955] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0091.955] lstrcmpiW (lpString1=".png", lpString2=".adobe") returned 1
	[0091.955] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34
	[0091.956] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0091.994] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=10123) returned 1
	[0091.994] CloseHandle (hObject=0x1b0) returned 1
	[0091.994] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20
	[0092.005] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.005] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0092.005] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78
	[0092.005] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78
	[0092.005] lstrlenW (lpString=".doc") returned 4
	[0092.005] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0092.005] lstrlenW (lpString=".docx") returned 5
	[0092.005] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1
	[0092.005] lstrlenW (lpString=".pdf") returned 4
	[0092.005] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0092.005] lstrlenW (lpString=".xls") returned 4
	[0092.005] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0092.005] lstrlenW (lpString=".xlsx") returned 5
	[0092.006] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1
	[0092.006] lstrlenW (lpString=".ppt") returned 4
	[0092.006] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0092.006] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78
	[0092.006] lstrlenW (lpString=".zip") returned 4
	[0092.006] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0092.006] lstrlenW (lpString=".rar") returned 4
	[0092.006] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0092.006] lstrlenW (lpString=".bz2") returned 4
	[0092.006] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0092.006] lstrlenW (lpString=".7z") returned 3
	[0092.006] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0092.006] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78
	[0092.006] lstrlenW (lpString=".dbf") returned 4
	[0092.006] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0092.006] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78
	[0092.006] lstrlenW (lpString=".1cd") returned 4
	[0092.006] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0092.006] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78
	[0092.006] lstrlenW (lpString=".jpg") returned 4
	[0092.006] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0092.006] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78
	[0092.006] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78
	[0092.006] lstrlenW (lpString=".doc") returned 4
	[0092.006] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0092.006] lstrlenW (lpString=".docx") returned 5
	[0092.007] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1
	[0092.007] lstrlenW (lpString=".pdf") returned 4
	[0092.007] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0092.007] lstrlenW (lpString=".xls") returned 4
	[0092.007] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0092.007] lstrlenW (lpString=".xlsx") returned 5
	[0092.007] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1
	[0092.007] lstrlenW (lpString=".ppt") returned 4
	[0092.007] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0092.007] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78
	[0092.007] lstrlenW (lpString=".zip") returned 4
	[0092.007] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0092.007] lstrlenW (lpString=".rar") returned 4
	[0092.007] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0092.007] lstrlenW (lpString=".bz2") returned 4
	[0092.007] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0092.007] lstrlenW (lpString=".7z") returned 3
	[0092.007] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0092.007] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78
	[0092.007] lstrlenW (lpString=".dbf") returned 4
	[0092.007] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0092.007] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78
	[0092.007] lstrlenW (lpString=".1cd") returned 4
	[0092.007] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0092.007] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78
	[0092.007] lstrlenW (lpString=".jpg") returned 4
	[0092.007] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0092.008] lstrcmpiW (lpString1=".png", lpString2=".adobe") returned 1
	[0092.008] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31
	[0092.008] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0092.031] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3316) returned 1
	[0092.031] CloseHandle (hObject=0x174) returned 1
	[0092.032] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20
	[0092.046] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.046] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0092.046] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75
	[0092.046] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75
	[0092.046] lstrlenW (lpString=".doc") returned 4
	[0092.046] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0092.046] lstrlenW (lpString=".docx") returned 5
	[0092.046] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1
	[0092.046] lstrlenW (lpString=".pdf") returned 4
	[0092.046] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0092.046] lstrlenW (lpString=".xls") returned 4
	[0092.046] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0092.046] lstrlenW (lpString=".xlsx") returned 5
	[0092.046] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1
	[0092.046] lstrlenW (lpString=".ppt") returned 4
	[0092.046] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0092.046] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75
	[0092.046] lstrlenW (lpString=".zip") returned 4
	[0092.046] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0092.046] lstrlenW (lpString=".rar") returned 4
	[0092.046] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0092.047] lstrlenW (lpString=".bz2") returned 4
	[0092.047] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0092.047] lstrlenW (lpString=".7z") returned 3
	[0092.047] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0092.047] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75
	[0092.047] lstrlenW (lpString=".dbf") returned 4
	[0092.047] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0092.047] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75
	[0092.047] lstrlenW (lpString=".1cd") returned 4
	[0092.047] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0092.047] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75
	[0092.047] lstrlenW (lpString=".jpg") returned 4
	[0092.047] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0092.047] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75
	[0092.047] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75
	[0092.047] lstrlenW (lpString=".doc") returned 4
	[0092.047] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0092.047] lstrlenW (lpString=".docx") returned 5
	[0092.047] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1
	[0092.047] lstrlenW (lpString=".pdf") returned 4
	[0092.047] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0092.047] lstrlenW (lpString=".xls") returned 4
	[0092.047] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0092.047] lstrlenW (lpString=".xlsx") returned 5
	[0092.047] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1
	[0092.047] lstrlenW (lpString=".ppt") returned 4
	[0092.048] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0092.048] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75
	[0092.048] lstrlenW (lpString=".zip") returned 4
	[0092.048] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0092.048] lstrlenW (lpString=".rar") returned 4
	[0092.048] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0092.048] lstrlenW (lpString=".bz2") returned 4
	[0092.048] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0092.048] lstrlenW (lpString=".7z") returned 3
	[0092.048] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0092.048] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75
	[0092.048] lstrlenW (lpString=".dbf") returned 4
	[0092.048] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0092.048] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75
	[0092.048] lstrlenW (lpString=".1cd") returned 4
	[0092.048] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0092.048] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75
	[0092.048] lstrlenW (lpString=".jpg") returned 4
	[0092.048] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0092.048] lstrcmpiW (lpString1=".png", lpString2=".adobe") returned 1
	[0092.048] lstrlenW (lpString="4to3Squareframe_SelectionSubpicture.png") returned 39
	[0092.049] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0092.058] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3304) returned 1
	[0092.058] CloseHandle (hObject=0x1c0) returned 1
	[0092.058] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png")) returned 0x20
	[0092.078] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.092] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0092.109] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83
	[0092.109] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83
	[0092.109] lstrlenW (lpString=".doc") returned 4
	[0092.109] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0092.109] lstrlenW (lpString=".docx") returned 5
	[0092.109] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1
	[0092.109] lstrlenW (lpString=".pdf") returned 4
	[0092.109] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0092.109] lstrlenW (lpString=".xls") returned 4
	[0092.109] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0092.109] lstrlenW (lpString=".xlsx") returned 5
	[0092.109] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1
	[0092.109] lstrlenW (lpString=".ppt") returned 4
	[0092.109] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0092.109] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83
	[0092.109] lstrlenW (lpString=".zip") returned 4
	[0092.109] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0092.109] lstrlenW (lpString=".rar") returned 4
	[0092.109] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0092.109] lstrlenW (lpString=".bz2") returned 4
	[0092.109] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0092.109] lstrlenW (lpString=".7z") returned 3
	[0092.109] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0092.109] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83
	[0092.110] lstrlenW (lpString=".dbf") returned 4
	[0092.110] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0092.110] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83
	[0092.110] lstrlenW (lpString=".1cd") returned 4
	[0092.110] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0092.110] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83
	[0092.110] lstrlenW (lpString=".jpg") returned 4
	[0092.110] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0092.110] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83
	[0092.110] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83
	[0092.110] lstrlenW (lpString=".doc") returned 4
	[0092.110] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0092.110] lstrlenW (lpString=".docx") returned 5
	[0092.110] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1
	[0092.110] lstrlenW (lpString=".pdf") returned 4
	[0092.110] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0092.110] lstrlenW (lpString=".xls") returned 4
	[0092.110] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0092.110] lstrlenW (lpString=".xlsx") returned 5
	[0092.110] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1
	[0092.110] lstrlenW (lpString=".ppt") returned 4
	[0092.110] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0092.110] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83
	[0092.110] lstrlenW (lpString=".zip") returned 4
	[0092.110] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0092.111] lstrlenW (lpString=".rar") returned 4
	[0092.111] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0092.111] lstrlenW (lpString=".bz2") returned 4
	[0092.111] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0092.111] lstrlenW (lpString=".7z") returned 3
	[0092.111] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0092.111] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83
	[0092.111] lstrlenW (lpString=".dbf") returned 4
	[0092.111] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0092.111] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83
	[0092.111] lstrlenW (lpString=".1cd") returned 4
	[0092.111] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0092.111] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83
	[0092.111] lstrlenW (lpString=".jpg") returned 4
	[0092.111] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0092.112] lstrcmpiW (lpString1=".png", lpString2=".adobe") returned 1
	[0092.112] lstrlenW (lpString="babyblue.png") returned 12
	[0092.112] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0092.166] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=12349) returned 1
	[0092.166] CloseHandle (hObject=0x1b0) returned 1
	[0092.166] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20
	[0092.237] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.237] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0092.237] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64
	[0092.237] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64
	[0092.237] lstrlenW (lpString=".doc") returned 4
	[0092.237] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0092.238] lstrlenW (lpString=".docx") returned 5
	[0092.238] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1
	[0092.238] lstrlenW (lpString=".pdf") returned 4
	[0092.238] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0092.238] lstrlenW (lpString=".xls") returned 4
	[0092.238] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0092.238] lstrlenW (lpString=".xlsx") returned 5
	[0092.238] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1
	[0092.238] lstrlenW (lpString=".ppt") returned 4
	[0092.238] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0092.238] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64
	[0092.238] lstrlenW (lpString=".zip") returned 4
	[0092.238] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0092.238] lstrlenW (lpString=".rar") returned 4
	[0092.238] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0092.238] lstrlenW (lpString=".bz2") returned 4
	[0092.238] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0092.238] lstrlenW (lpString=".7z") returned 3
	[0092.238] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0092.238] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64
	[0092.238] lstrlenW (lpString=".dbf") returned 4
	[0092.238] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0092.238] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64
	[0092.238] lstrlenW (lpString=".1cd") returned 4
	[0092.238] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0092.238] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64
	[0092.238] lstrlenW (lpString=".jpg") returned 4
	[0092.238] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0092.239] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64
	[0092.239] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64
	[0092.239] lstrlenW (lpString=".doc") returned 4
	[0092.239] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0092.239] lstrlenW (lpString=".docx") returned 5
	[0092.239] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1
	[0092.239] lstrlenW (lpString=".pdf") returned 4
	[0092.239] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0092.239] lstrlenW (lpString=".xls") returned 4
	[0092.239] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0092.239] lstrlenW (lpString=".xlsx") returned 5
	[0092.239] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1
	[0092.239] lstrlenW (lpString=".ppt") returned 4
	[0092.239] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0092.239] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64
	[0092.239] lstrlenW (lpString=".zip") returned 4
	[0092.239] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0092.239] lstrlenW (lpString=".rar") returned 4
	[0092.239] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0092.239] lstrlenW (lpString=".bz2") returned 4
	[0092.239] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0092.239] lstrlenW (lpString=".7z") returned 3
	[0092.239] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0092.239] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64
	[0092.239] lstrlenW (lpString=".dbf") returned 4
	[0092.239] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0092.239] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64
	[0092.240] lstrlenW (lpString=".1cd") returned 4
	[0092.240] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0092.240] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64
	[0092.240] lstrlenW (lpString=".jpg") returned 4
	[0092.240] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0092.240] lstrcmpiW (lpString1=".wmv", lpString2=".adobe") returned 1
	[0092.240] lstrlenW (lpString="BabyBoyMainBackground_PAL.wmv") returned 29
	[0092.240] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0092.262] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=325322) returned 1
	[0092.262] CloseHandle (hObject=0x1b8) returned 1
	[0092.262] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv")) returned 0x20
	[0092.271] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.272] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0092.276] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81
	[0092.276] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81
	[0092.276] lstrlenW (lpString=".doc") returned 4
	[0092.276] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0092.277] lstrlenW (lpString=".docx") returned 5
	[0092.277] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1
	[0092.277] lstrlenW (lpString=".pdf") returned 4
	[0092.277] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0092.277] lstrlenW (lpString=".xls") returned 4
	[0092.277] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0092.277] lstrlenW (lpString=".xlsx") returned 5
	[0092.277] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1
	[0092.277] lstrlenW (lpString=".ppt") returned 4
	[0092.277] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0092.277] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81
	[0092.277] lstrlenW (lpString=".zip") returned 4
	[0092.277] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0092.277] lstrlenW (lpString=".rar") returned 4
	[0092.277] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0092.277] lstrlenW (lpString=".bz2") returned 4
	[0092.277] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0092.277] lstrlenW (lpString=".7z") returned 3
	[0092.277] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0092.277] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81
	[0092.277] lstrlenW (lpString=".dbf") returned 4
	[0092.277] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0094.290] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0096.557] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0096.581] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0096.639] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0096.655] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0097.382] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.382] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0097.383] GetLastError () returned 0x0
	[0097.383] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x4360, lpOverlapped=0x0) returned 1
	[0097.395] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4370, lpOverlapped=0x0) returned 1
	[0097.397] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.397] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0097.397] SetEndOfFile (hFile=0x160) returned 1
	[0097.398] CloseHandle (hObject=0x160) returned 1
	[0097.398] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.398] SetEndOfFile (hFile=0x184) returned 1
	[0097.399] CloseHandle (hObject=0x184) returned 1
	[0097.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1
	[0097.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0097.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0097.400] lstrlenW (lpString=".doc") returned 4
	[0097.400] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0097.401] lstrlenW (lpString=".docx") returned 5
	[0097.401] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0097.401] lstrlenW (lpString=".pdf") returned 4
	[0097.401] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0097.401] lstrlenW (lpString=".xls") returned 4
	[0097.401] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0097.401] lstrlenW (lpString=".xlsx") returned 5
	[0097.401] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0097.401] lstrlenW (lpString=".ppt") returned 4
	[0097.401] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0097.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0097.401] lstrlenW (lpString=".zip") returned 4
	[0097.401] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0097.401] lstrlenW (lpString=".rar") returned 4
	[0097.401] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0097.401] lstrlenW (lpString=".bz2") returned 4
	[0097.401] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0097.401] lstrlenW (lpString=".7z") returned 3
	[0097.401] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0097.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0097.401] lstrlenW (lpString=".dbf") returned 4
	[0097.401] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0097.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0097.401] lstrlenW (lpString=".1cd") returned 4
	[0097.401] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0097.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0097.401] lstrlenW (lpString=".jpg") returned 4
	[0097.402] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0097.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0097.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0097.402] lstrlenW (lpString=".doc") returned 4
	[0097.402] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0097.402] lstrlenW (lpString=".docx") returned 5
	[0097.402] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0097.402] lstrlenW (lpString=".pdf") returned 4
	[0097.402] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0097.402] lstrlenW (lpString=".xls") returned 4
	[0097.402] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0097.402] lstrlenW (lpString=".xlsx") returned 5
	[0097.402] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0097.402] lstrlenW (lpString=".ppt") returned 4
	[0097.402] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0097.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0097.402] lstrlenW (lpString=".zip") returned 4
	[0097.402] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0097.402] lstrlenW (lpString=".rar") returned 4
	[0097.402] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0097.402] lstrlenW (lpString=".bz2") returned 4
	[0097.402] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0097.402] lstrlenW (lpString=".7z") returned 3
	[0097.402] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0097.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0097.403] lstrlenW (lpString=".dbf") returned 4
	[0097.403] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0097.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0097.403] lstrlenW (lpString=".1cd") returned 4
	[0097.403] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0097.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0097.403] lstrlenW (lpString=".jpg") returned 4
	[0097.403] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0097.403] lstrcmpiW (lpString1=".xsl", lpString2=".adobe") returned 1
	[0097.403] lstrlenW (lpString="Informix.xsl") returned 12
	[0097.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0097.413] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=30948) returned 1
	[0097.413] CloseHandle (hObject=0x160) returned 1
	[0097.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20
	[0097.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0097.464] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.464] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0097.468] GetLastError () returned 0x0
	[0097.468] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x78e4, lpOverlapped=0x0) returned 1
	[0097.482] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x78f0, lpOverlapped=0x0) returned 1
	[0097.485] ReadFile (in: hFile=0x1a4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.485] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0097.485] SetEndOfFile (hFile=0x1a8) returned 1
	[0097.485] CloseHandle (hObject=0x1a8) returned 1
	[0097.486] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.486] SetEndOfFile (hFile=0x1a4) returned 1
	[0097.487] CloseHandle (hObject=0x1a4) returned 1
	[0097.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1
	[0097.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0097.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0097.488] lstrlenW (lpString=".doc") returned 4
	[0097.488] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0097.488] lstrlenW (lpString=".docx") returned 5
	[0097.488] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1
	[0097.488] lstrlenW (lpString=".pdf") returned 4
	[0097.488] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0097.488] lstrlenW (lpString=".xls") returned 4
	[0097.488] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0097.488] lstrlenW (lpString=".xlsx") returned 5
	[0097.488] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1
	[0097.488] lstrlenW (lpString=".ppt") returned 4
	[0097.488] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0097.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0097.488] lstrlenW (lpString=".zip") returned 4
	[0097.488] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0097.488] lstrlenW (lpString=".rar") returned 4
	[0097.488] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0097.488] lstrlenW (lpString=".bz2") returned 4
	[0097.488] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0097.488] lstrlenW (lpString=".7z") returned 3
	[0097.488] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0097.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0097.488] lstrlenW (lpString=".dbf") returned 4
	[0097.488] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0097.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0097.488] lstrlenW (lpString=".1cd") returned 4
	[0097.488] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0097.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0097.489] lstrlenW (lpString=".jpg") returned 4
	[0097.489] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0097.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0097.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0097.489] lstrlenW (lpString=".doc") returned 4
	[0097.489] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0097.489] lstrlenW (lpString=".docx") returned 5
	[0097.489] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1
	[0097.489] lstrlenW (lpString=".pdf") returned 4
	[0097.489] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0097.489] lstrlenW (lpString=".xls") returned 4
	[0097.489] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0097.489] lstrlenW (lpString=".xlsx") returned 5
	[0097.489] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1
	[0097.489] lstrlenW (lpString=".ppt") returned 4
	[0097.489] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0097.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0097.489] lstrlenW (lpString=".zip") returned 4
	[0097.489] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0097.489] lstrlenW (lpString=".rar") returned 4
	[0097.489] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0097.489] lstrlenW (lpString=".bz2") returned 4
	[0097.489] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0097.489] lstrlenW (lpString=".7z") returned 3
	[0097.489] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0097.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0097.490] lstrlenW (lpString=".dbf") returned 4
	[0097.490] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0097.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0097.490] lstrlenW (lpString=".1cd") returned 4
	[0097.490] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0097.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0097.490] lstrlenW (lpString=".jpg") returned 4
	[0097.490] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0097.490] lstrcmpiW (lpString1=".xsl", lpString2=".adobe") returned 1
	[0097.490] lstrlenW (lpString="sql2000.xsl") returned 11
	[0097.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0097.722] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=34076) returned 1
	[0097.722] CloseHandle (hObject=0x174) returned 1
	[0097.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20
	[0097.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0097.888] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.888] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0097.981] GetLastError () returned 0x0
	[0097.981] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x851c, lpOverlapped=0x0) returned 1
	[0097.985] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x8520, lpOverlapped=0x0) returned 1
	[0097.986] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.986] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0097.986] SetEndOfFile (hFile=0x1cc) returned 1
	[0097.986] CloseHandle (hObject=0x1cc) returned 1
	[0097.987] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.987] SetEndOfFile (hFile=0x198) returned 1
	[0097.988] CloseHandle (hObject=0x198) returned 1
	[0097.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1
	[0097.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0097.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0097.988] lstrlenW (lpString=".doc") returned 4
	[0097.988] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0097.988] lstrlenW (lpString=".docx") returned 5
	[0097.988] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0097.988] lstrlenW (lpString=".pdf") returned 4
	[0097.988] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0097.988] lstrlenW (lpString=".xls") returned 4
	[0097.988] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0097.988] lstrlenW (lpString=".xlsx") returned 5
	[0097.988] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0097.988] lstrlenW (lpString=".ppt") returned 4
	[0097.988] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0097.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0097.988] lstrlenW (lpString=".zip") returned 4
	[0097.988] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0097.988] lstrlenW (lpString=".rar") returned 4
	[0097.988] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0097.989] lstrlenW (lpString=".bz2") returned 4
	[0097.989] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0097.989] lstrlenW (lpString=".7z") returned 3
	[0097.989] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0097.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0097.989] lstrlenW (lpString=".dbf") returned 4
	[0097.989] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0097.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0097.989] lstrlenW (lpString=".1cd") returned 4
	[0097.989] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0097.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0097.989] lstrlenW (lpString=".jpg") returned 4
	[0097.989] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0097.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0097.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0097.989] lstrlenW (lpString=".doc") returned 4
	[0097.989] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0097.989] lstrlenW (lpString=".docx") returned 5
	[0097.989] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0097.989] lstrlenW (lpString=".pdf") returned 4
	[0097.989] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0097.989] lstrlenW (lpString=".xls") returned 4
	[0097.989] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0097.989] lstrlenW (lpString=".xlsx") returned 5
	[0097.989] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0097.989] lstrlenW (lpString=".ppt") returned 4
	[0097.989] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0097.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0097.989] lstrlenW (lpString=".zip") returned 4
	[0097.989] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0097.990] lstrlenW (lpString=".rar") returned 4
	[0097.990] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0097.990] lstrlenW (lpString=".bz2") returned 4
	[0097.990] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0097.990] lstrlenW (lpString=".7z") returned 3
	[0097.990] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0097.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0097.990] lstrlenW (lpString=".dbf") returned 4
	[0097.990] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0097.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0097.990] lstrlenW (lpString=".1cd") returned 4
	[0097.990] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0097.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0097.990] lstrlenW (lpString=".jpg") returned 4
	[0097.990] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0097.990] lstrcmpiW (lpString1=".xsl", lpString2=".adobe") returned 1
	[0097.990] lstrlenW (lpString="sql90.xsl") returned 9
	[0097.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0097.991] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=39515) returned 1
	[0097.991] CloseHandle (hObject=0x198) returned 1
	[0097.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20
	[0097.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0097.991] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.991] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0097.992] GetLastError () returned 0x0
	[0097.992] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x9a5b, lpOverlapped=0x0) returned 1
	[0098.004] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x9a60, lpOverlapped=0x0) returned 1
	[0098.005] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.005] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0098.005] SetEndOfFile (hFile=0x1cc) returned 1
	[0098.006] CloseHandle (hObject=0x1cc) returned 1
	[0098.006] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.006] SetEndOfFile (hFile=0x198) returned 1
	[0098.007] CloseHandle (hObject=0x198) returned 1
	[0098.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1
	[0098.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0098.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0098.008] lstrlenW (lpString=".doc") returned 4
	[0098.008] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0098.008] lstrlenW (lpString=".docx") returned 5
	[0098.008] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0098.008] lstrlenW (lpString=".pdf") returned 4
	[0098.008] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0098.008] lstrlenW (lpString=".xls") returned 4
	[0098.008] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0098.008] lstrlenW (lpString=".xlsx") returned 5
	[0098.008] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0098.008] lstrlenW (lpString=".ppt") returned 4
	[0098.008] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0098.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0098.008] lstrlenW (lpString=".zip") returned 4
	[0098.008] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0098.008] lstrlenW (lpString=".rar") returned 4
	[0098.008] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0098.008] lstrlenW (lpString=".bz2") returned 4
	[0098.008] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0098.008] lstrlenW (lpString=".7z") returned 3
	[0098.009] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0098.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0098.009] lstrlenW (lpString=".dbf") returned 4
	[0098.009] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0098.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0098.009] lstrlenW (lpString=".1cd") returned 4
	[0098.009] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0098.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0098.009] lstrlenW (lpString=".jpg") returned 4
	[0098.009] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0098.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0098.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0098.009] lstrlenW (lpString=".doc") returned 4
	[0098.009] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0098.009] lstrlenW (lpString=".docx") returned 5
	[0098.009] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0098.009] lstrlenW (lpString=".pdf") returned 4
	[0098.009] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0098.009] lstrlenW (lpString=".xls") returned 4
	[0098.009] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0098.009] lstrlenW (lpString=".xlsx") returned 5
	[0098.009] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0098.009] lstrlenW (lpString=".ppt") returned 4
	[0098.009] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0098.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0098.009] lstrlenW (lpString=".zip") returned 4
	[0098.009] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0098.010] lstrlenW (lpString=".rar") returned 4
	[0098.010] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0098.010] lstrlenW (lpString=".bz2") returned 4
	[0098.010] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0098.010] lstrlenW (lpString=".7z") returned 3
	[0098.010] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0098.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0098.010] lstrlenW (lpString=".dbf") returned 4
	[0098.010] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0098.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0098.010] lstrlenW (lpString=".1cd") returned 4
	[0098.010] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0098.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0098.010] lstrlenW (lpString=".jpg") returned 4
	[0098.010] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0098.010] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.010] lstrlenW (lpString="AG00004_.GIF") returned 12
	[0098.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0098.012] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=9024) returned 1
	[0098.012] CloseHandle (hObject=0x174) returned 1
	[0098.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20
	[0098.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0098.016] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.017] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0098.017] GetLastError () returned 0x0
	[0098.017] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2340, lpOverlapped=0x0) returned 1
	[0098.023] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2350, lpOverlapped=0x0) returned 1
	[0098.024] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.024] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.025] SetEndOfFile (hFile=0x198) returned 1
	[0098.025] CloseHandle (hObject=0x198) returned 1
	[0098.025] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.025] SetEndOfFile (hFile=0x174) returned 1
	[0098.026] CloseHandle (hObject=0x174) returned 1
	[0098.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1
	[0098.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0098.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0098.027] lstrlenW (lpString=".doc") returned 4
	[0098.027] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.027] lstrlenW (lpString=".docx") returned 5
	[0098.027] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.027] lstrlenW (lpString=".pdf") returned 4
	[0098.027] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.027] lstrlenW (lpString=".xls") returned 4
	[0098.027] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.027] lstrlenW (lpString=".xlsx") returned 5
	[0098.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.027] lstrlenW (lpString=".ppt") returned 4
	[0098.027] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0098.027] lstrlenW (lpString=".zip") returned 4
	[0098.027] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.027] lstrlenW (lpString=".rar") returned 4
	[0098.027] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.027] lstrlenW (lpString=".bz2") returned 4
	[0098.027] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.027] lstrlenW (lpString=".7z") returned 3
	[0098.027] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0098.027] lstrlenW (lpString=".dbf") returned 4
	[0098.027] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0098.028] lstrlenW (lpString=".1cd") returned 4
	[0098.028] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0098.028] lstrlenW (lpString=".jpg") returned 4
	[0098.028] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0098.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0098.028] lstrlenW (lpString=".doc") returned 4
	[0098.028] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.028] lstrlenW (lpString=".docx") returned 5
	[0098.028] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.028] lstrlenW (lpString=".pdf") returned 4
	[0098.028] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.028] lstrlenW (lpString=".xls") returned 4
	[0098.028] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.028] lstrlenW (lpString=".xlsx") returned 5
	[0098.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.028] lstrlenW (lpString=".ppt") returned 4
	[0098.028] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0098.028] lstrlenW (lpString=".zip") returned 4
	[0098.028] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.028] lstrlenW (lpString=".rar") returned 4
	[0098.028] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.028] lstrlenW (lpString=".bz2") returned 4
	[0098.028] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.029] lstrlenW (lpString=".7z") returned 3
	[0098.029] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0098.029] lstrlenW (lpString=".dbf") returned 4
	[0098.029] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0098.029] lstrlenW (lpString=".1cd") returned 4
	[0098.029] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0098.029] lstrlenW (lpString=".jpg") returned 4
	[0098.029] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.029] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.029] lstrlenW (lpString="AG00011_.GIF") returned 12
	[0098.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0098.030] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7216) returned 1
	[0098.030] CloseHandle (hObject=0x174) returned 1
	[0098.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20
	[0098.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0098.030] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.030] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0098.031] GetLastError () returned 0x0
	[0098.031] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1c30, lpOverlapped=0x0) returned 1
	[0098.041] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1c40, lpOverlapped=0x0) returned 1
	[0098.043] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.043] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.043] SetEndOfFile (hFile=0x198) returned 1
	[0098.043] CloseHandle (hObject=0x198) returned 1
	[0098.043] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.043] SetEndOfFile (hFile=0x174) returned 1
	[0098.044] CloseHandle (hObject=0x174) returned 1
	[0098.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1
	[0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0098.045] lstrlenW (lpString=".doc") returned 4
	[0098.045] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.045] lstrlenW (lpString=".docx") returned 5
	[0098.045] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.045] lstrlenW (lpString=".pdf") returned 4
	[0098.045] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.045] lstrlenW (lpString=".xls") returned 4
	[0098.045] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.045] lstrlenW (lpString=".xlsx") returned 5
	[0098.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.046] lstrlenW (lpString=".ppt") returned 4
	[0098.046] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0098.046] lstrlenW (lpString=".zip") returned 4
	[0098.046] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.046] lstrlenW (lpString=".rar") returned 4
	[0098.046] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.046] lstrlenW (lpString=".bz2") returned 4
	[0098.046] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.046] lstrlenW (lpString=".7z") returned 3
	[0098.046] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0098.046] lstrlenW (lpString=".dbf") returned 4
	[0098.046] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0098.046] lstrlenW (lpString=".1cd") returned 4
	[0098.046] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0098.046] lstrlenW (lpString=".jpg") returned 4
	[0098.046] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0098.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0098.046] lstrlenW (lpString=".doc") returned 4
	[0098.046] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.046] lstrlenW (lpString=".docx") returned 5
	[0098.047] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.047] lstrlenW (lpString=".pdf") returned 4
	[0098.047] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.047] lstrlenW (lpString=".xls") returned 4
	[0098.047] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.047] lstrlenW (lpString=".xlsx") returned 5
	[0098.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.047] lstrlenW (lpString=".ppt") returned 4
	[0098.047] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0098.047] lstrlenW (lpString=".zip") returned 4
	[0098.047] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.047] lstrlenW (lpString=".rar") returned 4
	[0098.047] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.047] lstrlenW (lpString=".bz2") returned 4
	[0098.047] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.047] lstrlenW (lpString=".7z") returned 3
	[0098.047] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0098.047] lstrlenW (lpString=".dbf") returned 4
	[0098.047] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0098.047] lstrlenW (lpString=".1cd") returned 4
	[0098.047] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0098.047] lstrlenW (lpString=".jpg") returned 4
	[0098.047] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.048] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.048] lstrlenW (lpString="AG00037_.GIF") returned 12
	[0098.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.159] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=6684) returned 1
	[0098.159] CloseHandle (hObject=0x19c) returned 1
	[0098.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20
	[0098.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.190] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.190] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.193] GetLastError () returned 0x0
	[0098.193] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1a1c, lpOverlapped=0x0) returned 1
	[0098.202] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1a20, lpOverlapped=0x0) returned 1
	[0098.205] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.206] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.206] SetEndOfFile (hFile=0x160) returned 1
	[0098.206] CloseHandle (hObject=0x160) returned 1
	[0098.206] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.206] SetEndOfFile (hFile=0x19c) returned 1
	[0098.207] CloseHandle (hObject=0x19c) returned 1
	[0098.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1
	[0098.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0098.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0098.211] lstrlenW (lpString=".doc") returned 4
	[0098.211] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.211] lstrlenW (lpString=".docx") returned 5
	[0098.211] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.211] lstrlenW (lpString=".pdf") returned 4
	[0098.211] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.211] lstrlenW (lpString=".xls") returned 4
	[0098.211] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.211] lstrlenW (lpString=".xlsx") returned 5
	[0098.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.211] lstrlenW (lpString=".ppt") returned 4
	[0098.211] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0098.211] lstrlenW (lpString=".zip") returned 4
	[0098.211] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.211] lstrlenW (lpString=".rar") returned 4
	[0098.211] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.212] lstrlenW (lpString=".bz2") returned 4
	[0098.212] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.212] lstrlenW (lpString=".7z") returned 3
	[0098.212] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0098.212] lstrlenW (lpString=".dbf") returned 4
	[0098.212] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0098.212] lstrlenW (lpString=".1cd") returned 4
	[0098.212] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0098.212] lstrlenW (lpString=".jpg") returned 4
	[0098.212] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0098.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0098.212] lstrlenW (lpString=".doc") returned 4
	[0098.212] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.212] lstrlenW (lpString=".docx") returned 5
	[0098.212] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.212] lstrlenW (lpString=".pdf") returned 4
	[0098.212] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.212] lstrlenW (lpString=".xls") returned 4
	[0098.212] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.212] lstrlenW (lpString=".xlsx") returned 5
	[0098.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.212] lstrlenW (lpString=".ppt") returned 4
	[0098.213] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0098.213] lstrlenW (lpString=".zip") returned 4
	[0098.213] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.213] lstrlenW (lpString=".rar") returned 4
	[0098.213] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.213] lstrlenW (lpString=".bz2") returned 4
	[0098.213] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.213] lstrlenW (lpString=".7z") returned 3
	[0098.213] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0098.213] lstrlenW (lpString=".dbf") returned 4
	[0098.213] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0098.213] lstrlenW (lpString=".1cd") returned 4
	[0098.213] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0098.213] lstrlenW (lpString=".jpg") returned 4
	[0098.213] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.213] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.213] lstrlenW (lpString="AG00040_.GIF") returned 12
	[0098.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0098.227] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8097) returned 1
	[0098.228] CloseHandle (hObject=0x174) returned 1
	[0098.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20
	[0098.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0098.352] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.352] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0098.355] GetLastError () returned 0x0
	[0098.355] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1fa1, lpOverlapped=0x0) returned 1
	[0098.367] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1fb0, lpOverlapped=0x0) returned 1
	[0098.368] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.369] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.369] SetEndOfFile (hFile=0x1c0) returned 1
	[0098.369] CloseHandle (hObject=0x1c0) returned 1
	[0098.369] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.369] SetEndOfFile (hFile=0x1cc) returned 1
	[0098.370] CloseHandle (hObject=0x1cc) returned 1
	[0098.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1
	[0098.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0098.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0098.371] lstrlenW (lpString=".doc") returned 4
	[0098.371] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.371] lstrlenW (lpString=".docx") returned 5
	[0098.371] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.371] lstrlenW (lpString=".pdf") returned 4
	[0098.371] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.371] lstrlenW (lpString=".xls") returned 4
	[0098.371] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.371] lstrlenW (lpString=".xlsx") returned 5
	[0098.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.371] lstrlenW (lpString=".ppt") returned 4
	[0098.371] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0098.371] lstrlenW (lpString=".zip") returned 4
	[0098.371] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.371] lstrlenW (lpString=".rar") returned 4
	[0098.371] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.371] lstrlenW (lpString=".bz2") returned 4
	[0098.371] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.371] lstrlenW (lpString=".7z") returned 3
	[0098.371] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0098.371] lstrlenW (lpString=".dbf") returned 4
	[0098.371] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0098.371] lstrlenW (lpString=".1cd") returned 4
	[0098.372] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0098.372] lstrlenW (lpString=".jpg") returned 4
	[0098.372] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0098.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0098.372] lstrlenW (lpString=".doc") returned 4
	[0098.372] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.372] lstrlenW (lpString=".docx") returned 5
	[0098.372] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.372] lstrlenW (lpString=".pdf") returned 4
	[0098.372] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.372] lstrlenW (lpString=".xls") returned 4
	[0098.372] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.372] lstrlenW (lpString=".xlsx") returned 5
	[0098.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.372] lstrlenW (lpString=".ppt") returned 4
	[0098.372] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0098.372] lstrlenW (lpString=".zip") returned 4
	[0098.372] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.372] lstrlenW (lpString=".rar") returned 4
	[0098.372] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.372] lstrlenW (lpString=".bz2") returned 4
	[0098.372] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.372] lstrlenW (lpString=".7z") returned 3
	[0098.372] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0098.373] lstrlenW (lpString=".dbf") returned 4
	[0098.373] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0098.373] lstrlenW (lpString=".1cd") returned 4
	[0098.373] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0098.373] lstrlenW (lpString=".jpg") returned 4
	[0098.373] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.373] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.373] lstrlenW (lpString="AG00057_.GIF") returned 12
	[0098.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0098.374] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=11891) returned 1
	[0098.374] CloseHandle (hObject=0x1cc) returned 1
	[0098.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20
	[0098.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0098.374] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.374] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0098.375] GetLastError () returned 0x0
	[0098.375] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2e73, lpOverlapped=0x0) returned 1
	[0098.418] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2e80, lpOverlapped=0x0) returned 1
	[0098.420] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.420] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.420] SetEndOfFile (hFile=0x1c0) returned 1
	[0098.420] CloseHandle (hObject=0x1c0) returned 1
	[0098.420] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.420] SetEndOfFile (hFile=0x1cc) returned 1
	[0098.421] CloseHandle (hObject=0x1cc) returned 1
	[0098.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1
	[0098.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0098.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0098.430] lstrlenW (lpString=".doc") returned 4
	[0098.430] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.430] lstrlenW (lpString=".docx") returned 5
	[0098.430] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.430] lstrlenW (lpString=".pdf") returned 4
	[0098.430] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.430] lstrlenW (lpString=".xls") returned 4
	[0098.430] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.430] lstrlenW (lpString=".xlsx") returned 5
	[0098.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.430] lstrlenW (lpString=".ppt") returned 4
	[0098.430] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0098.431] lstrlenW (lpString=".zip") returned 4
	[0098.431] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.431] lstrlenW (lpString=".rar") returned 4
	[0098.431] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.431] lstrlenW (lpString=".bz2") returned 4
	[0098.431] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.432] lstrlenW (lpString=".7z") returned 3
	[0098.432] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0098.432] lstrlenW (lpString=".dbf") returned 4
	[0098.432] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0098.432] lstrlenW (lpString=".1cd") returned 4
	[0098.432] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0098.432] lstrlenW (lpString=".jpg") returned 4
	[0098.432] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0098.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0098.432] lstrlenW (lpString=".doc") returned 4
	[0098.432] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.432] lstrlenW (lpString=".docx") returned 5
	[0098.432] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.432] lstrlenW (lpString=".pdf") returned 4
	[0098.432] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.432] lstrlenW (lpString=".xls") returned 4
	[0098.432] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.432] lstrlenW (lpString=".xlsx") returned 5
	[0098.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.432] lstrlenW (lpString=".ppt") returned 4
	[0098.432] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0098.433] lstrlenW (lpString=".zip") returned 4
	[0098.433] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.433] lstrlenW (lpString=".rar") returned 4
	[0098.433] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.433] lstrlenW (lpString=".bz2") returned 4
	[0098.433] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.433] lstrlenW (lpString=".7z") returned 3
	[0098.433] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0098.433] lstrlenW (lpString=".dbf") returned 4
	[0098.433] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0098.433] lstrlenW (lpString=".1cd") returned 4
	[0098.433] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0098.433] lstrlenW (lpString=".jpg") returned 4
	[0098.433] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.434] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.434] lstrlenW (lpString="AG00120_.GIF") returned 12
	[0098.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0098.441] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3484) returned 1
	[0098.441] CloseHandle (hObject=0x1c0) returned 1
	[0098.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20
	[0098.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.463] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.463] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0098.471] GetLastError () returned 0x0
	[0098.471] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xd9c, lpOverlapped=0x0) returned 1
	[0098.485] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xda0, lpOverlapped=0x0) returned 1
	[0098.487] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.487] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.487] SetEndOfFile (hFile=0x198) returned 1
	[0098.487] CloseHandle (hObject=0x198) returned 1
	[0098.487] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.487] SetEndOfFile (hFile=0x190) returned 1
	[0098.488] CloseHandle (hObject=0x190) returned 1
	[0098.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1
	[0098.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0098.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0098.489] lstrlenW (lpString=".doc") returned 4
	[0098.489] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.489] lstrlenW (lpString=".docx") returned 5
	[0098.489] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.489] lstrlenW (lpString=".pdf") returned 4
	[0098.489] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.489] lstrlenW (lpString=".xls") returned 4
	[0098.489] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.489] lstrlenW (lpString=".xlsx") returned 5
	[0098.489] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.489] lstrlenW (lpString=".ppt") returned 4
	[0098.489] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0098.490] lstrlenW (lpString=".zip") returned 4
	[0098.490] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.490] lstrlenW (lpString=".rar") returned 4
	[0098.490] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.490] lstrlenW (lpString=".bz2") returned 4
	[0098.490] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.490] lstrlenW (lpString=".7z") returned 3
	[0098.490] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0098.490] lstrlenW (lpString=".dbf") returned 4
	[0098.490] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0098.490] lstrlenW (lpString=".1cd") returned 4
	[0098.490] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0098.490] lstrlenW (lpString=".jpg") returned 4
	[0098.490] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0098.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0098.490] lstrlenW (lpString=".doc") returned 4
	[0098.490] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.490] lstrlenW (lpString=".docx") returned 5
	[0098.490] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.490] lstrlenW (lpString=".pdf") returned 4
	[0098.490] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.491] lstrlenW (lpString=".xls") returned 4
	[0098.491] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.491] lstrlenW (lpString=".xlsx") returned 5
	[0098.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.491] lstrlenW (lpString=".ppt") returned 4
	[0098.491] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0098.491] lstrlenW (lpString=".zip") returned 4
	[0098.491] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.491] lstrlenW (lpString=".rar") returned 4
	[0098.491] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.491] lstrlenW (lpString=".bz2") returned 4
	[0098.491] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.491] lstrlenW (lpString=".7z") returned 3
	[0098.491] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0098.491] lstrlenW (lpString=".dbf") returned 4
	[0098.491] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0098.491] lstrlenW (lpString=".1cd") returned 4
	[0098.491] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0098.491] lstrlenW (lpString=".jpg") returned 4
	[0098.491] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.492] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.492] lstrlenW (lpString="AG00129_.GIF") returned 12
	[0098.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.492] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=12482) returned 1
	[0098.493] CloseHandle (hObject=0x190) returned 1
	[0098.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20
	[0098.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.493] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.493] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0098.494] GetLastError () returned 0x0
	[0098.494] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x30c2, lpOverlapped=0x0) returned 1
	[0098.511] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x30d0, lpOverlapped=0x0) returned 1
	[0098.512] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.512] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.512] SetEndOfFile (hFile=0x198) returned 1
	[0098.512] CloseHandle (hObject=0x198) returned 1
	[0098.512] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.513] SetEndOfFile (hFile=0x190) returned 1
	[0098.514] CloseHandle (hObject=0x190) returned 1
	[0098.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1
	[0098.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0098.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0098.514] lstrlenW (lpString=".doc") returned 4
	[0098.514] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.514] lstrlenW (lpString=".docx") returned 5
	[0098.514] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.514] lstrlenW (lpString=".pdf") returned 4
	[0098.514] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.514] lstrlenW (lpString=".xls") returned 4
	[0098.515] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.515] lstrlenW (lpString=".xlsx") returned 5
	[0098.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.515] lstrlenW (lpString=".ppt") returned 4
	[0098.515] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0098.515] lstrlenW (lpString=".zip") returned 4
	[0098.515] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.515] lstrlenW (lpString=".rar") returned 4
	[0098.515] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.515] lstrlenW (lpString=".bz2") returned 4
	[0098.515] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.515] lstrlenW (lpString=".7z") returned 3
	[0098.515] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0098.515] lstrlenW (lpString=".dbf") returned 4
	[0098.515] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0098.515] lstrlenW (lpString=".1cd") returned 4
	[0098.515] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0098.515] lstrlenW (lpString=".jpg") returned 4
	[0098.515] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0098.515] lstrlenW (lpString=".doc") returned 4
	[0098.516] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.516] lstrlenW (lpString=".docx") returned 5
	[0098.516] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.516] lstrlenW (lpString=".pdf") returned 4
	[0098.516] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.516] lstrlenW (lpString=".xls") returned 4
	[0098.516] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.516] lstrlenW (lpString=".xlsx") returned 5
	[0098.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.516] lstrlenW (lpString=".ppt") returned 4
	[0098.516] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0098.516] lstrlenW (lpString=".zip") returned 4
	[0098.516] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.516] lstrlenW (lpString=".rar") returned 4
	[0098.516] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.516] lstrlenW (lpString=".bz2") returned 4
	[0098.516] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.516] lstrlenW (lpString=".7z") returned 3
	[0098.516] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0098.516] lstrlenW (lpString=".dbf") returned 4
	[0098.516] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0098.516] lstrlenW (lpString=".1cd") returned 4
	[0098.516] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0098.517] lstrlenW (lpString=".jpg") returned 4
	[0098.517] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.517] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.517] lstrlenW (lpString="AG00135_.GIF") returned 12
	[0098.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0098.610] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2596) returned 1
	[0098.610] CloseHandle (hObject=0x198) returned 1
	[0098.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20
	[0098.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.709] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.709] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0098.721] GetLastError () returned 0x0
	[0098.721] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xa24, lpOverlapped=0x0) returned 1
	[0098.727] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa30, lpOverlapped=0x0) returned 1
	[0098.728] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.728] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.728] SetEndOfFile (hFile=0x1cc) returned 1
	[0098.728] CloseHandle (hObject=0x1cc) returned 1
	[0098.728] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.728] SetEndOfFile (hFile=0x19c) returned 1
	[0098.729] CloseHandle (hObject=0x19c) returned 1
	[0098.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1
	[0098.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0098.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0098.729] lstrlenW (lpString=".doc") returned 4
	[0098.729] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.729] lstrlenW (lpString=".docx") returned 5
	[0098.729] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.729] lstrlenW (lpString=".pdf") returned 4
	[0098.730] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.730] lstrlenW (lpString=".xls") returned 4
	[0098.730] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.730] lstrlenW (lpString=".xlsx") returned 5
	[0098.730] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.730] lstrlenW (lpString=".ppt") returned 4
	[0098.730] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0098.730] lstrlenW (lpString=".zip") returned 4
	[0098.730] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.730] lstrlenW (lpString=".rar") returned 4
	[0098.730] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.730] lstrlenW (lpString=".bz2") returned 4
	[0098.730] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.730] lstrlenW (lpString=".7z") returned 3
	[0098.730] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0098.730] lstrlenW (lpString=".dbf") returned 4
	[0098.730] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0098.730] lstrlenW (lpString=".1cd") returned 4
	[0098.730] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0098.730] lstrlenW (lpString=".jpg") returned 4
	[0098.730] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0098.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0098.731] lstrlenW (lpString=".doc") returned 4
	[0098.731] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.731] lstrlenW (lpString=".docx") returned 5
	[0098.731] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.731] lstrlenW (lpString=".pdf") returned 4
	[0098.731] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.731] lstrlenW (lpString=".xls") returned 4
	[0098.731] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.731] lstrlenW (lpString=".xlsx") returned 5
	[0098.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.731] lstrlenW (lpString=".ppt") returned 4
	[0098.731] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0098.731] lstrlenW (lpString=".zip") returned 4
	[0098.731] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.731] lstrlenW (lpString=".rar") returned 4
	[0098.731] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.731] lstrlenW (lpString=".bz2") returned 4
	[0098.731] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.731] lstrlenW (lpString=".7z") returned 3
	[0098.731] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0098.731] lstrlenW (lpString=".dbf") returned 4
	[0098.731] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0098.731] lstrlenW (lpString=".1cd") returned 4
	[0098.731] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0098.732] lstrlenW (lpString=".jpg") returned 4
	[0098.732] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.732] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.732] lstrlenW (lpString="AG00142_.GIF") returned 12
	[0098.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.732] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=15308) returned 1
	[0098.732] CloseHandle (hObject=0x19c) returned 1
	[0098.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20
	[0098.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.733] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.733] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0098.734] GetLastError () returned 0x0
	[0098.734] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x3bcc, lpOverlapped=0x0) returned 1
	[0098.749] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3bd0, lpOverlapped=0x0) returned 1
	[0098.751] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.751] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.751] SetEndOfFile (hFile=0x1cc) returned 1
	[0098.752] CloseHandle (hObject=0x1cc) returned 1
	[0098.752] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.752] SetEndOfFile (hFile=0x19c) returned 1
	[0098.752] CloseHandle (hObject=0x19c) returned 1
	[0098.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1
	[0098.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0098.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0098.753] lstrlenW (lpString=".doc") returned 4
	[0098.753] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.753] lstrlenW (lpString=".docx") returned 5
	[0098.753] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.753] lstrlenW (lpString=".pdf") returned 4
	[0098.753] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.753] lstrlenW (lpString=".xls") returned 4
	[0098.753] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.753] lstrlenW (lpString=".xlsx") returned 5
	[0098.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.753] lstrlenW (lpString=".ppt") returned 4
	[0098.753] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0098.753] lstrlenW (lpString=".zip") returned 4
	[0098.753] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.753] lstrlenW (lpString=".rar") returned 4
	[0098.753] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.753] lstrlenW (lpString=".bz2") returned 4
	[0098.754] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.754] lstrlenW (lpString=".7z") returned 3
	[0098.754] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0098.754] lstrlenW (lpString=".dbf") returned 4
	[0098.754] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0098.754] lstrlenW (lpString=".1cd") returned 4
	[0098.754] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0098.754] lstrlenW (lpString=".jpg") returned 4
	[0098.754] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0098.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0098.754] lstrlenW (lpString=".doc") returned 4
	[0098.754] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.754] lstrlenW (lpString=".docx") returned 5
	[0098.754] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.754] lstrlenW (lpString=".pdf") returned 4
	[0098.754] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.754] lstrlenW (lpString=".xls") returned 4
	[0098.754] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.754] lstrlenW (lpString=".xlsx") returned 5
	[0098.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.754] lstrlenW (lpString=".ppt") returned 4
	[0098.754] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0098.754] lstrlenW (lpString=".zip") returned 4
	[0098.754] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.754] lstrlenW (lpString=".rar") returned 4
	[0098.754] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.754] lstrlenW (lpString=".bz2") returned 4
	[0098.755] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.755] lstrlenW (lpString=".7z") returned 3
	[0098.755] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0098.755] lstrlenW (lpString=".dbf") returned 4
	[0098.755] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0098.755] lstrlenW (lpString=".1cd") returned 4
	[0098.755] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0098.755] lstrlenW (lpString=".jpg") returned 4
	[0098.755] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.755] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.755] lstrlenW (lpString="AG00157_.GIF") returned 12
	[0098.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.756] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4955) returned 1
	[0098.756] CloseHandle (hObject=0x19c) returned 1
	[0098.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20
	[0098.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.756] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.756] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0098.757] GetLastError () returned 0x0
	[0098.757] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x135b, lpOverlapped=0x0) returned 1
	[0098.782] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1360, lpOverlapped=0x0) returned 1
	[0098.783] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.783] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.783] SetEndOfFile (hFile=0x1cc) returned 1
	[0098.784] CloseHandle (hObject=0x1cc) returned 1
	[0098.784] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.784] SetEndOfFile (hFile=0x19c) returned 1
	[0098.785] CloseHandle (hObject=0x19c) returned 1
	[0098.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1
	[0098.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0098.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0098.785] lstrlenW (lpString=".doc") returned 4
	[0098.785] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.785] lstrlenW (lpString=".docx") returned 5
	[0098.785] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.785] lstrlenW (lpString=".pdf") returned 4
	[0098.785] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.785] lstrlenW (lpString=".xls") returned 4
	[0098.785] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.785] lstrlenW (lpString=".xlsx") returned 5
	[0098.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.786] lstrlenW (lpString=".ppt") returned 4
	[0098.786] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0098.786] lstrlenW (lpString=".zip") returned 4
	[0098.786] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.786] lstrlenW (lpString=".rar") returned 4
	[0098.786] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.786] lstrlenW (lpString=".bz2") returned 4
	[0098.786] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.786] lstrlenW (lpString=".7z") returned 3
	[0098.786] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0098.786] lstrlenW (lpString=".dbf") returned 4
	[0098.786] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0098.786] lstrlenW (lpString=".1cd") returned 4
	[0098.786] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0098.786] lstrlenW (lpString=".jpg") returned 4
	[0098.786] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0098.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0098.786] lstrlenW (lpString=".doc") returned 4
	[0098.786] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.786] lstrlenW (lpString=".docx") returned 5
	[0098.786] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.786] lstrlenW (lpString=".pdf") returned 4
	[0098.786] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.786] lstrlenW (lpString=".xls") returned 4
	[0098.786] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.786] lstrlenW (lpString=".xlsx") returned 5
	[0098.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.787] lstrlenW (lpString=".ppt") returned 4
	[0098.787] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0098.787] lstrlenW (lpString=".zip") returned 4
	[0098.787] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.787] lstrlenW (lpString=".rar") returned 4
	[0098.787] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.787] lstrlenW (lpString=".bz2") returned 4
	[0098.787] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.787] lstrlenW (lpString=".7z") returned 3
	[0098.787] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0098.787] lstrlenW (lpString=".dbf") returned 4
	[0098.787] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0098.787] lstrlenW (lpString=".1cd") returned 4
	[0098.787] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0098.787] lstrlenW (lpString=".jpg") returned 4
	[0098.787] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.787] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.787] lstrlenW (lpString="AG00160_.GIF") returned 12
	[0098.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.788] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1146) returned 1
	[0098.788] CloseHandle (hObject=0x19c) returned 1
	[0098.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20
	[0098.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.788] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.788] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0098.789] GetLastError () returned 0x0
	[0098.789] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x47a, lpOverlapped=0x0) returned 1
	[0098.806] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x480, lpOverlapped=0x0) returned 1
	[0098.807] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.807] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.807] SetEndOfFile (hFile=0x1cc) returned 1
	[0098.807] CloseHandle (hObject=0x1cc) returned 1
	[0098.807] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.807] SetEndOfFile (hFile=0x19c) returned 1
	[0098.808] CloseHandle (hObject=0x19c) returned 1
	[0098.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1
	[0098.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0098.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0098.809] lstrlenW (lpString=".doc") returned 4
	[0098.809] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.809] lstrlenW (lpString=".docx") returned 5
	[0098.809] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.809] lstrlenW (lpString=".pdf") returned 4
	[0098.809] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.809] lstrlenW (lpString=".xls") returned 4
	[0098.809] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.809] lstrlenW (lpString=".xlsx") returned 5
	[0098.809] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.809] lstrlenW (lpString=".ppt") returned 4
	[0098.809] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0098.809] lstrlenW (lpString=".zip") returned 4
	[0098.809] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.809] lstrlenW (lpString=".rar") returned 4
	[0098.809] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.809] lstrlenW (lpString=".bz2") returned 4
	[0098.809] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.809] lstrlenW (lpString=".7z") returned 3
	[0098.809] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0098.809] lstrlenW (lpString=".dbf") returned 4
	[0098.809] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0098.809] lstrlenW (lpString=".1cd") returned 4
	[0098.809] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0098.809] lstrlenW (lpString=".jpg") returned 4
	[0098.809] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0098.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0098.810] lstrlenW (lpString=".doc") returned 4
	[0098.810] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.810] lstrlenW (lpString=".docx") returned 5
	[0098.810] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.810] lstrlenW (lpString=".pdf") returned 4
	[0098.810] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.810] lstrlenW (lpString=".xls") returned 4
	[0098.810] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.810] lstrlenW (lpString=".xlsx") returned 5
	[0098.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.810] lstrlenW (lpString=".ppt") returned 4
	[0098.810] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0098.810] lstrlenW (lpString=".zip") returned 4
	[0098.810] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.810] lstrlenW (lpString=".rar") returned 4
	[0098.810] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.810] lstrlenW (lpString=".bz2") returned 4
	[0098.810] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.810] lstrlenW (lpString=".7z") returned 3
	[0098.810] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0098.810] lstrlenW (lpString=".dbf") returned 4
	[0098.810] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0098.811] lstrlenW (lpString=".1cd") returned 4
	[0098.811] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0098.811] lstrlenW (lpString=".jpg") returned 4
	[0098.811] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.811] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.811] lstrlenW (lpString="AG00163_.GIF") returned 12
	[0098.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.823] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=6984) returned 1
	[0098.823] CloseHandle (hObject=0x190) returned 1
	[0098.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20
	[0098.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0098.857] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.857] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.865] GetLastError () returned 0x0
	[0098.865] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1b48, lpOverlapped=0x0) returned 1
	[0098.869] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1b50, lpOverlapped=0x0) returned 1
	[0098.870] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.870] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.871] SetEndOfFile (hFile=0x1a8) returned 1
	[0098.871] CloseHandle (hObject=0x1a8) returned 1
	[0098.871] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.871] SetEndOfFile (hFile=0x174) returned 1
	[0098.872] CloseHandle (hObject=0x174) returned 1
	[0098.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1
	[0098.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0098.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0098.872] lstrlenW (lpString=".doc") returned 4
	[0098.872] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.872] lstrlenW (lpString=".docx") returned 5
	[0098.872] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.872] lstrlenW (lpString=".pdf") returned 4
	[0098.872] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.872] lstrlenW (lpString=".xls") returned 4
	[0098.872] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.872] lstrlenW (lpString=".xlsx") returned 5
	[0098.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.872] lstrlenW (lpString=".ppt") returned 4
	[0098.873] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0098.873] lstrlenW (lpString=".zip") returned 4
	[0098.873] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.873] lstrlenW (lpString=".rar") returned 4
	[0098.873] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.873] lstrlenW (lpString=".bz2") returned 4
	[0098.873] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.873] lstrlenW (lpString=".7z") returned 3
	[0098.873] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0098.873] lstrlenW (lpString=".dbf") returned 4
	[0098.873] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0098.873] lstrlenW (lpString=".1cd") returned 4
	[0098.873] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0098.873] lstrlenW (lpString=".jpg") returned 4
	[0098.873] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0098.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0098.873] lstrlenW (lpString=".doc") returned 4
	[0098.873] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.873] lstrlenW (lpString=".docx") returned 5
	[0098.873] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.873] lstrlenW (lpString=".pdf") returned 4
	[0098.873] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.873] lstrlenW (lpString=".xls") returned 4
	[0098.873] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.873] lstrlenW (lpString=".xlsx") returned 5
	[0098.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.873] lstrlenW (lpString=".ppt") returned 4
	[0098.873] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0098.874] lstrlenW (lpString=".zip") returned 4
	[0098.874] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.874] lstrlenW (lpString=".rar") returned 4
	[0098.874] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.874] lstrlenW (lpString=".bz2") returned 4
	[0098.874] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.874] lstrlenW (lpString=".7z") returned 3
	[0098.874] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0098.874] lstrlenW (lpString=".dbf") returned 4
	[0098.874] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0098.874] lstrlenW (lpString=".1cd") returned 4
	[0098.874] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0098.874] lstrlenW (lpString=".jpg") returned 4
	[0098.874] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.874] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.874] lstrlenW (lpString="AG00165_.GIF") returned 12
	[0098.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.892] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8582) returned 1
	[0098.892] CloseHandle (hObject=0x19c) returned 1
	[0098.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20
	[0098.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.925] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.925] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.937] GetLastError () returned 0x0
	[0098.937] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2186, lpOverlapped=0x0) returned 1
	[0098.940] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2190, lpOverlapped=0x0) returned 1
	[0098.941] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.941] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.941] SetEndOfFile (hFile=0x19c) returned 1
	[0098.942] CloseHandle (hObject=0x19c) returned 1
	[0098.942] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.942] SetEndOfFile (hFile=0x160) returned 1
	[0098.943] CloseHandle (hObject=0x160) returned 1
	[0098.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1
	[0098.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0098.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0098.943] lstrlenW (lpString=".doc") returned 4
	[0098.943] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.943] lstrlenW (lpString=".docx") returned 5
	[0098.943] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.943] lstrlenW (lpString=".pdf") returned 4
	[0098.943] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.943] lstrlenW (lpString=".xls") returned 4
	[0098.943] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.943] lstrlenW (lpString=".xlsx") returned 5
	[0098.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.943] lstrlenW (lpString=".ppt") returned 4
	[0098.943] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0098.943] lstrlenW (lpString=".zip") returned 4
	[0098.943] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.943] lstrlenW (lpString=".rar") returned 4
	[0098.944] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.944] lstrlenW (lpString=".bz2") returned 4
	[0098.944] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.944] lstrlenW (lpString=".7z") returned 3
	[0098.944] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0098.944] lstrlenW (lpString=".dbf") returned 4
	[0098.944] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0098.944] lstrlenW (lpString=".1cd") returned 4
	[0098.944] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0098.944] lstrlenW (lpString=".jpg") returned 4
	[0098.944] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0098.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0098.944] lstrlenW (lpString=".doc") returned 4
	[0098.944] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.944] lstrlenW (lpString=".docx") returned 5
	[0098.944] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.944] lstrlenW (lpString=".pdf") returned 4
	[0098.944] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.944] lstrlenW (lpString=".xls") returned 4
	[0098.944] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.944] lstrlenW (lpString=".xlsx") returned 5
	[0098.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.944] lstrlenW (lpString=".ppt") returned 4
	[0098.944] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0098.944] lstrlenW (lpString=".zip") returned 4
	[0098.944] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.944] lstrlenW (lpString=".rar") returned 4
	[0098.944] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.945] lstrlenW (lpString=".bz2") returned 4
	[0098.945] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.945] lstrlenW (lpString=".7z") returned 3
	[0098.945] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0098.945] lstrlenW (lpString=".dbf") returned 4
	[0098.945] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0098.945] lstrlenW (lpString=".1cd") returned 4
	[0098.945] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0098.945] lstrlenW (lpString=".jpg") returned 4
	[0098.945] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.945] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.945] lstrlenW (lpString="AG00169_.GIF") returned 12
	[0098.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.946] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5375) returned 1
	[0098.946] CloseHandle (hObject=0x160) returned 1
	[0098.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20
	[0098.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.946] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.946] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.947] GetLastError () returned 0x0
	[0098.947] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x14ff, lpOverlapped=0x0) returned 1
	[0098.957] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1500, lpOverlapped=0x0) returned 1
	[0098.958] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.958] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.958] SetEndOfFile (hFile=0x19c) returned 1
	[0098.959] CloseHandle (hObject=0x19c) returned 1
	[0098.959] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.959] SetEndOfFile (hFile=0x160) returned 1
	[0098.960] CloseHandle (hObject=0x160) returned 1
	[0098.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1
	[0098.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0098.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0098.960] lstrlenW (lpString=".doc") returned 4
	[0098.960] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.960] lstrlenW (lpString=".docx") returned 5
	[0098.960] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.960] lstrlenW (lpString=".pdf") returned 4
	[0098.960] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.960] lstrlenW (lpString=".xls") returned 4
	[0098.961] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.961] lstrlenW (lpString=".xlsx") returned 5
	[0098.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.961] lstrlenW (lpString=".ppt") returned 4
	[0098.961] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0098.961] lstrlenW (lpString=".zip") returned 4
	[0098.961] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.961] lstrlenW (lpString=".rar") returned 4
	[0098.961] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.961] lstrlenW (lpString=".bz2") returned 4
	[0098.961] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.961] lstrlenW (lpString=".7z") returned 3
	[0098.961] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0098.961] lstrlenW (lpString=".dbf") returned 4
	[0098.961] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0098.961] lstrlenW (lpString=".1cd") returned 4
	[0098.961] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0098.961] lstrlenW (lpString=".jpg") returned 4
	[0098.961] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0098.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0098.961] lstrlenW (lpString=".doc") returned 4
	[0098.961] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.961] lstrlenW (lpString=".docx") returned 5
	[0098.961] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.961] lstrlenW (lpString=".pdf") returned 4
	[0098.961] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.962] lstrlenW (lpString=".xls") returned 4
	[0098.962] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.962] lstrlenW (lpString=".xlsx") returned 5
	[0098.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.962] lstrlenW (lpString=".ppt") returned 4
	[0098.962] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0098.962] lstrlenW (lpString=".zip") returned 4
	[0098.962] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.962] lstrlenW (lpString=".rar") returned 4
	[0098.962] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.962] lstrlenW (lpString=".bz2") returned 4
	[0098.962] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.962] lstrlenW (lpString=".7z") returned 3
	[0098.962] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0098.962] lstrlenW (lpString=".dbf") returned 4
	[0098.962] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0098.962] lstrlenW (lpString=".1cd") returned 4
	[0098.962] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0098.962] lstrlenW (lpString=".jpg") returned 4
	[0098.962] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.962] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.962] lstrlenW (lpString="AG00171_.GIF") returned 12
	[0098.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.963] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5016) returned 1
	[0098.963] CloseHandle (hObject=0x160) returned 1
	[0098.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20
	[0098.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.964] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.964] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.964] GetLastError () returned 0x0
	[0098.964] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1398, lpOverlapped=0x0) returned 1
	[0098.974] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x13a0, lpOverlapped=0x0) returned 1
	[0098.975] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.975] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.975] SetEndOfFile (hFile=0x19c) returned 1
	[0098.975] CloseHandle (hObject=0x19c) returned 1
	[0098.976] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.976] SetEndOfFile (hFile=0x160) returned 1
	[0098.976] CloseHandle (hObject=0x160) returned 1
	[0098.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1
	[0098.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0098.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0098.977] lstrlenW (lpString=".doc") returned 4
	[0098.977] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.977] lstrlenW (lpString=".docx") returned 5
	[0098.977] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.977] lstrlenW (lpString=".pdf") returned 4
	[0098.978] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.978] lstrlenW (lpString=".xls") returned 4
	[0098.978] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.978] lstrlenW (lpString=".xlsx") returned 5
	[0098.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.978] lstrlenW (lpString=".ppt") returned 4
	[0098.978] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0098.978] lstrlenW (lpString=".zip") returned 4
	[0098.978] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.978] lstrlenW (lpString=".rar") returned 4
	[0098.978] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.978] lstrlenW (lpString=".bz2") returned 4
	[0098.978] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.978] lstrlenW (lpString=".7z") returned 3
	[0098.978] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0098.978] lstrlenW (lpString=".dbf") returned 4
	[0098.978] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0098.978] lstrlenW (lpString=".1cd") returned 4
	[0098.978] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0098.978] lstrlenW (lpString=".jpg") returned 4
	[0098.978] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0098.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0098.978] lstrlenW (lpString=".doc") returned 4
	[0098.978] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0098.978] lstrlenW (lpString=".docx") returned 5
	[0098.978] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0098.978] lstrlenW (lpString=".pdf") returned 4
	[0098.979] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0098.979] lstrlenW (lpString=".xls") returned 4
	[0098.979] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0098.979] lstrlenW (lpString=".xlsx") returned 5
	[0098.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0098.979] lstrlenW (lpString=".ppt") returned 4
	[0098.979] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0098.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0098.979] lstrlenW (lpString=".zip") returned 4
	[0098.979] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0098.979] lstrlenW (lpString=".rar") returned 4
	[0098.979] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0098.979] lstrlenW (lpString=".bz2") returned 4
	[0098.979] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0098.979] lstrlenW (lpString=".7z") returned 3
	[0098.979] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0098.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0098.979] lstrlenW (lpString=".dbf") returned 4
	[0098.979] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0098.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0098.979] lstrlenW (lpString=".1cd") returned 4
	[0098.979] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0098.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0098.979] lstrlenW (lpString=".jpg") returned 4
	[0098.979] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0098.979] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0098.979] lstrlenW (lpString="AG00174_.GIF") returned 12
	[0098.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0098.991] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3966) returned 1
	[0098.991] CloseHandle (hObject=0x1cc) returned 1
	[0098.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20
	[0098.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0099.009] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.009] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.012] GetLastError () returned 0x0
	[0099.012] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xf7e, lpOverlapped=0x0) returned 1
	[0099.021] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf80, lpOverlapped=0x0) returned 1
	[0099.022] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.022] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.022] SetEndOfFile (hFile=0x160) returned 1
	[0099.022] CloseHandle (hObject=0x160) returned 1
	[0099.022] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.022] SetEndOfFile (hFile=0x1cc) returned 1
	[0099.023] CloseHandle (hObject=0x1cc) returned 1
	[0099.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1
	[0099.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0099.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0099.024] lstrlenW (lpString=".doc") returned 4
	[0099.024] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0099.024] lstrlenW (lpString=".docx") returned 5
	[0099.024] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0099.024] lstrlenW (lpString=".pdf") returned 4
	[0099.024] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0099.024] lstrlenW (lpString=".xls") returned 4
	[0099.024] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0099.024] lstrlenW (lpString=".xlsx") returned 5
	[0099.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0099.024] lstrlenW (lpString=".ppt") returned 4
	[0099.024] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0099.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0099.024] lstrlenW (lpString=".zip") returned 4
	[0099.024] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0099.024] lstrlenW (lpString=".rar") returned 4
	[0099.024] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0099.024] lstrlenW (lpString=".bz2") returned 4
	[0099.024] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0099.024] lstrlenW (lpString=".7z") returned 3
	[0099.024] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0099.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0099.024] lstrlenW (lpString=".dbf") returned 4
	[0099.024] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0099.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0099.024] lstrlenW (lpString=".1cd") returned 4
	[0099.024] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0099.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0099.024] lstrlenW (lpString=".jpg") returned 4
	[0099.024] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0099.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0099.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0099.024] lstrlenW (lpString=".doc") returned 4
	[0099.024] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0099.025] lstrlenW (lpString=".docx") returned 5
	[0099.025] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0099.025] lstrlenW (lpString=".pdf") returned 4
	[0099.025] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0099.025] lstrlenW (lpString=".xls") returned 4
	[0099.025] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0099.025] lstrlenW (lpString=".xlsx") returned 5
	[0099.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0099.025] lstrlenW (lpString=".ppt") returned 4
	[0099.025] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0099.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0099.025] lstrlenW (lpString=".zip") returned 4
	[0099.025] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0099.025] lstrlenW (lpString=".rar") returned 4
	[0099.025] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0099.025] lstrlenW (lpString=".bz2") returned 4
	[0099.025] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0099.025] lstrlenW (lpString=".7z") returned 3
	[0099.025] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0099.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0099.025] lstrlenW (lpString=".dbf") returned 4
	[0099.025] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0099.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0099.025] lstrlenW (lpString=".1cd") returned 4
	[0099.025] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0099.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0099.025] lstrlenW (lpString=".jpg") returned 4
	[0099.025] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0099.025] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0099.026] lstrlenW (lpString="AG00176_.GIF") returned 12
	[0099.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0099.026] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3120) returned 1
	[0099.026] CloseHandle (hObject=0x1cc) returned 1
	[0099.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20
	[0099.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0099.026] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.027] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.027] GetLastError () returned 0x0
	[0099.027] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xc30, lpOverlapped=0x0) returned 1
	[0099.035] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xc40, lpOverlapped=0x0) returned 1
	[0099.036] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.036] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.036] SetEndOfFile (hFile=0x160) returned 1
	[0099.036] CloseHandle (hObject=0x160) returned 1
	[0099.036] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.037] SetEndOfFile (hFile=0x1cc) returned 1
	[0099.037] CloseHandle (hObject=0x1cc) returned 1
	[0099.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1
	[0099.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0099.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0099.039] lstrlenW (lpString=".doc") returned 4
	[0099.039] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0099.039] lstrlenW (lpString=".docx") returned 5
	[0099.039] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0099.039] lstrlenW (lpString=".pdf") returned 4
	[0099.039] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0099.039] lstrlenW (lpString=".xls") returned 4
	[0099.039] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0099.039] lstrlenW (lpString=".xlsx") returned 5
	[0099.039] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0099.039] lstrlenW (lpString=".ppt") returned 4
	[0099.039] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0099.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0099.039] lstrlenW (lpString=".zip") returned 4
	[0099.039] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0099.039] lstrlenW (lpString=".rar") returned 4
	[0099.039] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0099.039] lstrlenW (lpString=".bz2") returned 4
	[0099.039] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0099.039] lstrlenW (lpString=".7z") returned 3
	[0099.039] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0099.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0099.039] lstrlenW (lpString=".dbf") returned 4
	[0099.039] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0099.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0099.039] lstrlenW (lpString=".1cd") returned 4
	[0099.039] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0099.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0099.040] lstrlenW (lpString=".jpg") returned 4
	[0099.040] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0099.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0099.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0099.040] lstrlenW (lpString=".doc") returned 4
	[0099.040] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0099.040] lstrlenW (lpString=".docx") returned 5
	[0099.040] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0099.040] lstrlenW (lpString=".pdf") returned 4
	[0099.040] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0099.040] lstrlenW (lpString=".xls") returned 4
	[0099.040] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0099.040] lstrlenW (lpString=".xlsx") returned 5
	[0099.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0099.040] lstrlenW (lpString=".ppt") returned 4
	[0099.040] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0099.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0099.040] lstrlenW (lpString=".zip") returned 4
	[0099.040] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0099.040] lstrlenW (lpString=".rar") returned 4
	[0099.040] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0099.040] lstrlenW (lpString=".bz2") returned 4
	[0099.040] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0099.040] lstrlenW (lpString=".7z") returned 3
	[0099.040] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0099.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0099.040] lstrlenW (lpString=".dbf") returned 4
	[0099.040] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0099.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0099.040] lstrlenW (lpString=".1cd") returned 4
	[0099.041] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0099.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0099.041] lstrlenW (lpString=".jpg") returned 4
	[0099.041] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0099.041] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.041] lstrlenW (lpString="AN00015_.WMF") returned 12
	[0099.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.045] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4734) returned 1
	[0099.045] CloseHandle (hObject=0x160) returned 1
	[0099.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20
	[0099.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.064] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.064] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.069] GetLastError () returned 0x0
	[0099.069] ReadFile (in: hFile=0x1a0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x127e, lpOverlapped=0x0) returned 1
	[0099.077] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1280, lpOverlapped=0x0) returned 1
	[0099.080] ReadFile (in: hFile=0x1a0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.080] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.080] SetEndOfFile (hFile=0x188) returned 1
	[0099.081] CloseHandle (hObject=0x188) returned 1
	[0099.081] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.081] SetEndOfFile (hFile=0x1a0) returned 1
	[0099.082] CloseHandle (hObject=0x1a0) returned 1
	[0099.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1
	[0099.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0099.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0099.082] lstrlenW (lpString=".doc") returned 4
	[0099.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.082] lstrlenW (lpString=".docx") returned 5
	[0099.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.083] lstrlenW (lpString=".pdf") returned 4
	[0099.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.083] lstrlenW (lpString=".xls") returned 4
	[0099.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.083] lstrlenW (lpString=".xlsx") returned 5
	[0099.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.083] lstrlenW (lpString=".ppt") returned 4
	[0099.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0099.083] lstrlenW (lpString=".zip") returned 4
	[0099.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.083] lstrlenW (lpString=".rar") returned 4
	[0099.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.083] lstrlenW (lpString=".bz2") returned 4
	[0099.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.083] lstrlenW (lpString=".7z") returned 3
	[0099.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0099.083] lstrlenW (lpString=".dbf") returned 4
	[0099.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0099.083] lstrlenW (lpString=".1cd") returned 4
	[0099.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0099.083] lstrlenW (lpString=".jpg") returned 4
	[0099.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0099.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0099.083] lstrlenW (lpString=".doc") returned 4
	[0099.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.083] lstrlenW (lpString=".docx") returned 5
	[0099.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.084] lstrlenW (lpString=".pdf") returned 4
	[0099.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.084] lstrlenW (lpString=".xls") returned 4
	[0099.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.084] lstrlenW (lpString=".xlsx") returned 5
	[0099.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.084] lstrlenW (lpString=".ppt") returned 4
	[0099.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0099.084] lstrlenW (lpString=".zip") returned 4
	[0099.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.084] lstrlenW (lpString=".rar") returned 4
	[0099.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.084] lstrlenW (lpString=".bz2") returned 4
	[0099.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.084] lstrlenW (lpString=".7z") returned 3
	[0099.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0099.084] lstrlenW (lpString=".dbf") returned 4
	[0099.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0099.084] lstrlenW (lpString=".1cd") returned 4
	[0099.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0099.084] lstrlenW (lpString=".jpg") returned 4
	[0099.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.084] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.084] lstrlenW (lpString="AN00853_.WMF") returned 12
	[0099.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.089] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=20578) returned 1
	[0099.089] CloseHandle (hObject=0x178) returned 1
	[0099.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20
	[0099.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0099.100] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.100] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.104] GetLastError () returned 0x0
	[0099.104] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x5062, lpOverlapped=0x0) returned 1
	[0099.113] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5070, lpOverlapped=0x0) returned 1
	[0099.114] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.114] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.114] SetEndOfFile (hFile=0x188) returned 1
	[0099.114] CloseHandle (hObject=0x188) returned 1
	[0099.114] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.114] SetEndOfFile (hFile=0x174) returned 1
	[0099.115] CloseHandle (hObject=0x174) returned 1
	[0099.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1
	[0099.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0099.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0099.120] lstrlenW (lpString=".doc") returned 4
	[0099.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.120] lstrlenW (lpString=".docx") returned 5
	[0099.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.120] lstrlenW (lpString=".pdf") returned 4
	[0099.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.120] lstrlenW (lpString=".xls") returned 4
	[0099.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.120] lstrlenW (lpString=".xlsx") returned 5
	[0099.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.120] lstrlenW (lpString=".ppt") returned 4
	[0099.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0099.120] lstrlenW (lpString=".zip") returned 4
	[0099.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.121] lstrlenW (lpString=".rar") returned 4
	[0099.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.121] lstrlenW (lpString=".bz2") returned 4
	[0099.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.121] lstrlenW (lpString=".7z") returned 3
	[0099.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0099.121] lstrlenW (lpString=".dbf") returned 4
	[0099.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0099.121] lstrlenW (lpString=".1cd") returned 4
	[0099.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0099.121] lstrlenW (lpString=".jpg") returned 4
	[0099.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0099.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0099.121] lstrlenW (lpString=".doc") returned 4
	[0099.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.121] lstrlenW (lpString=".docx") returned 5
	[0099.121] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.121] lstrlenW (lpString=".pdf") returned 4
	[0099.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.121] lstrlenW (lpString=".xls") returned 4
	[0099.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.121] lstrlenW (lpString=".xlsx") returned 5
	[0099.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.122] lstrlenW (lpString=".ppt") returned 4
	[0099.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0099.122] lstrlenW (lpString=".zip") returned 4
	[0099.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.122] lstrlenW (lpString=".rar") returned 4
	[0099.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.122] lstrlenW (lpString=".bz2") returned 4
	[0099.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.122] lstrlenW (lpString=".7z") returned 3
	[0099.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0099.122] lstrlenW (lpString=".dbf") returned 4
	[0099.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0099.122] lstrlenW (lpString=".1cd") returned 4
	[0099.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0099.122] lstrlenW (lpString=".jpg") returned 4
	[0099.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.122] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.122] lstrlenW (lpString="AN00932_.WMF") returned 12
	[0099.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.127] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=14428) returned 1
	[0099.127] CloseHandle (hObject=0x178) returned 1
	[0099.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20
	[0099.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0099.139] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.139] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.141] GetLastError () returned 0x0
	[0099.141] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x385c, lpOverlapped=0x0) returned 1
	[0099.151] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3860, lpOverlapped=0x0) returned 1
	[0099.152] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.152] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.153] SetEndOfFile (hFile=0x178) returned 1
	[0099.153] CloseHandle (hObject=0x178) returned 1
	[0099.153] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.153] SetEndOfFile (hFile=0x174) returned 1
	[0099.154] CloseHandle (hObject=0x174) returned 1
	[0099.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1
	[0099.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0099.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0099.154] lstrlenW (lpString=".doc") returned 4
	[0099.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.154] lstrlenW (lpString=".docx") returned 5
	[0099.154] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.154] lstrlenW (lpString=".pdf") returned 4
	[0099.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.155] lstrlenW (lpString=".xls") returned 4
	[0099.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.155] lstrlenW (lpString=".xlsx") returned 5
	[0099.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.155] lstrlenW (lpString=".ppt") returned 4
	[0099.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0099.155] lstrlenW (lpString=".zip") returned 4
	[0099.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.155] lstrlenW (lpString=".rar") returned 4
	[0099.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.155] lstrlenW (lpString=".bz2") returned 4
	[0099.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.155] lstrlenW (lpString=".7z") returned 3
	[0099.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0099.155] lstrlenW (lpString=".dbf") returned 4
	[0099.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0099.155] lstrlenW (lpString=".1cd") returned 4
	[0099.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0099.155] lstrlenW (lpString=".jpg") returned 4
	[0099.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0099.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0099.155] lstrlenW (lpString=".doc") returned 4
	[0099.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.155] lstrlenW (lpString=".docx") returned 5
	[0099.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.156] lstrlenW (lpString=".pdf") returned 4
	[0099.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.156] lstrlenW (lpString=".xls") returned 4
	[0099.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.156] lstrlenW (lpString=".xlsx") returned 5
	[0099.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.156] lstrlenW (lpString=".ppt") returned 4
	[0099.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0099.156] lstrlenW (lpString=".zip") returned 4
	[0099.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.156] lstrlenW (lpString=".rar") returned 4
	[0099.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.156] lstrlenW (lpString=".bz2") returned 4
	[0099.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.156] lstrlenW (lpString=".7z") returned 3
	[0099.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0099.156] lstrlenW (lpString=".dbf") returned 4
	[0099.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0099.156] lstrlenW (lpString=".1cd") returned 4
	[0099.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0099.156] lstrlenW (lpString=".jpg") returned 4
	[0099.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.156] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.156] lstrlenW (lpString="AN01039_.WMF") returned 12
	[0099.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0099.157] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3344) returned 1
	[0099.157] CloseHandle (hObject=0x174) returned 1
	[0099.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20
	[0099.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0099.157] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.158] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.158] GetLastError () returned 0x0
	[0099.158] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xd10, lpOverlapped=0x0) returned 1
	[0099.170] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xd20, lpOverlapped=0x0) returned 1
	[0099.171] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.171] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.171] SetEndOfFile (hFile=0x178) returned 1
	[0099.171] CloseHandle (hObject=0x178) returned 1
	[0099.171] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.171] SetEndOfFile (hFile=0x174) returned 1
	[0099.172] CloseHandle (hObject=0x174) returned 1
	[0099.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1
	[0099.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0099.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0099.172] lstrlenW (lpString=".doc") returned 4
	[0099.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.172] lstrlenW (lpString=".docx") returned 5
	[0099.172] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.172] lstrlenW (lpString=".pdf") returned 4
	[0099.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.172] lstrlenW (lpString=".xls") returned 4
	[0099.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.173] lstrlenW (lpString=".xlsx") returned 5
	[0099.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.173] lstrlenW (lpString=".ppt") returned 4
	[0099.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0099.173] lstrlenW (lpString=".zip") returned 4
	[0099.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.173] lstrlenW (lpString=".rar") returned 4
	[0099.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.173] lstrlenW (lpString=".bz2") returned 4
	[0099.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.173] lstrlenW (lpString=".7z") returned 3
	[0099.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0099.173] lstrlenW (lpString=".dbf") returned 4
	[0099.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0099.173] lstrlenW (lpString=".1cd") returned 4
	[0099.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0099.173] lstrlenW (lpString=".jpg") returned 4
	[0099.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0099.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0099.173] lstrlenW (lpString=".doc") returned 4
	[0099.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.173] lstrlenW (lpString=".docx") returned 5
	[0099.173] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.173] lstrlenW (lpString=".pdf") returned 4
	[0099.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.173] lstrlenW (lpString=".xls") returned 4
	[0099.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.174] lstrlenW (lpString=".xlsx") returned 5
	[0099.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.174] lstrlenW (lpString=".ppt") returned 4
	[0099.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0099.174] lstrlenW (lpString=".zip") returned 4
	[0099.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.174] lstrlenW (lpString=".rar") returned 4
	[0099.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.174] lstrlenW (lpString=".bz2") returned 4
	[0099.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.174] lstrlenW (lpString=".7z") returned 3
	[0099.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0099.174] lstrlenW (lpString=".dbf") returned 4
	[0099.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0099.174] lstrlenW (lpString=".1cd") returned 4
	[0099.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0099.174] lstrlenW (lpString=".jpg") returned 4
	[0099.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.174] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.174] lstrlenW (lpString="AN01060_.WMF") returned 12
	[0099.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0099.186] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7968) returned 1
	[0099.186] CloseHandle (hObject=0x164) returned 1
	[0099.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20
	[0099.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.200] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.200] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.203] GetLastError () returned 0x0
	[0099.203] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1f20, lpOverlapped=0x0) returned 1
	[0099.208] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1f30, lpOverlapped=0x0) returned 1
	[0099.209] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.209] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.209] SetEndOfFile (hFile=0x184) returned 1
	[0099.209] CloseHandle (hObject=0x184) returned 1
	[0099.209] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.209] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.210] CloseHandle (hObject=0x1c0) returned 1
	[0099.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1
	[0099.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0099.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0099.211] lstrlenW (lpString=".doc") returned 4
	[0099.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.211] lstrlenW (lpString=".docx") returned 5
	[0099.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.211] lstrlenW (lpString=".pdf") returned 4
	[0099.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.211] lstrlenW (lpString=".xls") returned 4
	[0099.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.211] lstrlenW (lpString=".xlsx") returned 5
	[0099.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.211] lstrlenW (lpString=".ppt") returned 4
	[0099.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0099.211] lstrlenW (lpString=".zip") returned 4
	[0099.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.211] lstrlenW (lpString=".rar") returned 4
	[0099.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.211] lstrlenW (lpString=".bz2") returned 4
	[0099.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.211] lstrlenW (lpString=".7z") returned 3
	[0099.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0099.211] lstrlenW (lpString=".dbf") returned 4
	[0099.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0099.211] lstrlenW (lpString=".1cd") returned 4
	[0099.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0099.211] lstrlenW (lpString=".jpg") returned 4
	[0099.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0099.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0099.212] lstrlenW (lpString=".doc") returned 4
	[0099.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.212] lstrlenW (lpString=".docx") returned 5
	[0099.212] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.212] lstrlenW (lpString=".pdf") returned 4
	[0099.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.212] lstrlenW (lpString=".xls") returned 4
	[0099.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.212] lstrlenW (lpString=".xlsx") returned 5
	[0099.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.212] lstrlenW (lpString=".ppt") returned 4
	[0099.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0099.212] lstrlenW (lpString=".zip") returned 4
	[0099.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.212] lstrlenW (lpString=".rar") returned 4
	[0099.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.212] lstrlenW (lpString=".bz2") returned 4
	[0099.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.212] lstrlenW (lpString=".7z") returned 3
	[0099.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0099.212] lstrlenW (lpString=".dbf") returned 4
	[0099.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0099.212] lstrlenW (lpString=".1cd") returned 4
	[0099.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0099.212] lstrlenW (lpString=".jpg") returned 4
	[0099.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.213] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.213] lstrlenW (lpString="AN01173_.WMF") returned 12
	[0099.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0099.223] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=26332) returned 1
	[0099.224] CloseHandle (hObject=0x1cc) returned 1
	[0099.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20
	[0099.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0099.245] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.245] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.251] GetLastError () returned 0x0
	[0099.251] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x66dc, lpOverlapped=0x0) returned 1
	[0099.255] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x66e0, lpOverlapped=0x0) returned 1
	[0099.256] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.256] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.256] SetEndOfFile (hFile=0x178) returned 1
	[0099.256] CloseHandle (hObject=0x178) returned 1
	[0099.257] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.257] SetEndOfFile (hFile=0x164) returned 1
	[0099.257] CloseHandle (hObject=0x164) returned 1
	[0099.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1
	[0099.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0099.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0099.258] lstrlenW (lpString=".doc") returned 4
	[0099.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.258] lstrlenW (lpString=".docx") returned 5
	[0099.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.258] lstrlenW (lpString=".pdf") returned 4
	[0099.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.258] lstrlenW (lpString=".xls") returned 4
	[0099.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.258] lstrlenW (lpString=".xlsx") returned 5
	[0099.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.258] lstrlenW (lpString=".ppt") returned 4
	[0099.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0099.258] lstrlenW (lpString=".zip") returned 4
	[0099.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.258] lstrlenW (lpString=".rar") returned 4
	[0099.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.259] lstrlenW (lpString=".bz2") returned 4
	[0099.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.259] lstrlenW (lpString=".7z") returned 3
	[0099.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0099.259] lstrlenW (lpString=".dbf") returned 4
	[0099.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0099.259] lstrlenW (lpString=".1cd") returned 4
	[0099.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0099.259] lstrlenW (lpString=".jpg") returned 4
	[0099.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0099.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0099.259] lstrlenW (lpString=".doc") returned 4
	[0099.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.259] lstrlenW (lpString=".docx") returned 5
	[0099.259] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.259] lstrlenW (lpString=".pdf") returned 4
	[0099.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.259] lstrlenW (lpString=".xls") returned 4
	[0099.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.259] lstrlenW (lpString=".xlsx") returned 5
	[0099.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.259] lstrlenW (lpString=".ppt") returned 4
	[0099.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0099.259] lstrlenW (lpString=".zip") returned 4
	[0099.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.259] lstrlenW (lpString=".rar") returned 4
	[0099.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.260] lstrlenW (lpString=".bz2") returned 4
	[0099.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.260] lstrlenW (lpString=".7z") returned 3
	[0099.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0099.260] lstrlenW (lpString=".dbf") returned 4
	[0099.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0099.260] lstrlenW (lpString=".1cd") returned 4
	[0099.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0099.260] lstrlenW (lpString=".jpg") returned 4
	[0099.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.260] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.260] lstrlenW (lpString="AN01184_.WMF") returned 12
	[0099.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0099.261] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3746) returned 1
	[0099.261] CloseHandle (hObject=0x164) returned 1
	[0099.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20
	[0099.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0099.261] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.261] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.262] GetLastError () returned 0x0
	[0099.262] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xea2, lpOverlapped=0x0) returned 1
	[0099.276] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xeb0, lpOverlapped=0x0) returned 1
	[0099.277] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.277] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.277] SetEndOfFile (hFile=0x178) returned 1
	[0099.277] CloseHandle (hObject=0x178) returned 1
	[0099.278] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.278] SetEndOfFile (hFile=0x164) returned 1
	[0099.278] CloseHandle (hObject=0x164) returned 1
	[0099.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1
	[0099.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0099.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0099.279] lstrlenW (lpString=".doc") returned 4
	[0099.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.279] lstrlenW (lpString=".docx") returned 5
	[0099.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.279] lstrlenW (lpString=".pdf") returned 4
	[0099.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.279] lstrlenW (lpString=".xls") returned 4
	[0099.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.279] lstrlenW (lpString=".xlsx") returned 5
	[0099.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.279] lstrlenW (lpString=".ppt") returned 4
	[0099.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0099.279] lstrlenW (lpString=".zip") returned 4
	[0099.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.279] lstrlenW (lpString=".rar") returned 4
	[0099.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.279] lstrlenW (lpString=".bz2") returned 4
	[0099.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.280] lstrlenW (lpString=".7z") returned 3
	[0099.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0099.280] lstrlenW (lpString=".dbf") returned 4
	[0099.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0099.280] lstrlenW (lpString=".1cd") returned 4
	[0099.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0099.280] lstrlenW (lpString=".jpg") returned 4
	[0099.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0099.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0099.280] lstrlenW (lpString=".doc") returned 4
	[0099.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.280] lstrlenW (lpString=".docx") returned 5
	[0099.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.280] lstrlenW (lpString=".pdf") returned 4
	[0099.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.280] lstrlenW (lpString=".xls") returned 4
	[0099.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.280] lstrlenW (lpString=".xlsx") returned 5
	[0099.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.280] lstrlenW (lpString=".ppt") returned 4
	[0099.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0099.280] lstrlenW (lpString=".zip") returned 4
	[0099.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.280] lstrlenW (lpString=".rar") returned 4
	[0099.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.281] lstrlenW (lpString=".bz2") returned 4
	[0099.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.281] lstrlenW (lpString=".7z") returned 3
	[0099.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0099.281] lstrlenW (lpString=".dbf") returned 4
	[0099.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0099.281] lstrlenW (lpString=".1cd") returned 4
	[0099.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0099.281] lstrlenW (lpString=".jpg") returned 4
	[0099.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.281] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.281] lstrlenW (lpString="AN01218_.WMF") returned 12
	[0099.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0099.282] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3012) returned 1
	[0099.282] CloseHandle (hObject=0x164) returned 1
	[0099.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20
	[0099.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0099.282] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.282] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.283] GetLastError () returned 0x0
	[0099.283] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xbc4, lpOverlapped=0x0) returned 1
	[0099.293] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xbd0, lpOverlapped=0x0) returned 1
	[0099.294] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.294] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.294] SetEndOfFile (hFile=0x178) returned 1
	[0099.294] CloseHandle (hObject=0x178) returned 1
	[0099.294] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.294] SetEndOfFile (hFile=0x164) returned 1
	[0099.295] CloseHandle (hObject=0x164) returned 1
	[0099.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1
	[0099.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0099.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0099.295] lstrlenW (lpString=".doc") returned 4
	[0099.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.295] lstrlenW (lpString=".docx") returned 5
	[0099.295] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.295] lstrlenW (lpString=".pdf") returned 4
	[0099.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.295] lstrlenW (lpString=".xls") returned 4
	[0099.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.295] lstrlenW (lpString=".xlsx") returned 5
	[0099.295] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.296] lstrlenW (lpString=".ppt") returned 4
	[0099.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0099.296] lstrlenW (lpString=".zip") returned 4
	[0099.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.296] lstrlenW (lpString=".rar") returned 4
	[0099.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.296] lstrlenW (lpString=".bz2") returned 4
	[0099.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.296] lstrlenW (lpString=".7z") returned 3
	[0099.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0099.296] lstrlenW (lpString=".dbf") returned 4
	[0099.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0099.296] lstrlenW (lpString=".1cd") returned 4
	[0099.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0099.296] lstrlenW (lpString=".jpg") returned 4
	[0099.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0099.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0099.296] lstrlenW (lpString=".doc") returned 4
	[0099.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.296] lstrlenW (lpString=".docx") returned 5
	[0099.296] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.296] lstrlenW (lpString=".pdf") returned 4
	[0099.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.296] lstrlenW (lpString=".xls") returned 4
	[0099.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.296] lstrlenW (lpString=".xlsx") returned 5
	[0099.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.296] lstrlenW (lpString=".ppt") returned 4
	[0099.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0099.297] lstrlenW (lpString=".zip") returned 4
	[0099.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.297] lstrlenW (lpString=".rar") returned 4
	[0099.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.297] lstrlenW (lpString=".bz2") returned 4
	[0099.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.297] lstrlenW (lpString=".7z") returned 3
	[0099.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0099.297] lstrlenW (lpString=".dbf") returned 4
	[0099.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0099.297] lstrlenW (lpString=".1cd") returned 4
	[0099.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0099.297] lstrlenW (lpString=".jpg") returned 4
	[0099.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.297] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.297] lstrlenW (lpString="AN01545_.WMF") returned 12
	[0099.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0099.298] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7372) returned 1
	[0099.298] CloseHandle (hObject=0x164) returned 1
	[0099.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20
	[0099.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0099.298] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.299] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.299] GetLastError () returned 0x0
	[0099.299] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1ccc, lpOverlapped=0x0) returned 1
	[0099.307] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1cd0, lpOverlapped=0x0) returned 1
	[0099.308] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.308] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.308] SetEndOfFile (hFile=0x178) returned 1
	[0099.308] CloseHandle (hObject=0x178) returned 1
	[0099.308] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.308] SetEndOfFile (hFile=0x164) returned 1
	[0099.309] CloseHandle (hObject=0x164) returned 1
	[0099.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1
	[0099.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0099.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0099.314] lstrlenW (lpString=".doc") returned 4
	[0099.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.314] lstrlenW (lpString=".docx") returned 5
	[0099.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.314] lstrlenW (lpString=".pdf") returned 4
	[0099.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.314] lstrlenW (lpString=".xls") returned 4
	[0099.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.315] lstrlenW (lpString=".xlsx") returned 5
	[0099.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.315] lstrlenW (lpString=".ppt") returned 4
	[0099.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0099.315] lstrlenW (lpString=".zip") returned 4
	[0099.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.315] lstrlenW (lpString=".rar") returned 4
	[0099.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.315] lstrlenW (lpString=".bz2") returned 4
	[0099.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.315] lstrlenW (lpString=".7z") returned 3
	[0099.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0099.315] lstrlenW (lpString=".dbf") returned 4
	[0099.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0099.315] lstrlenW (lpString=".1cd") returned 4
	[0099.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0099.315] lstrlenW (lpString=".jpg") returned 4
	[0099.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0099.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0099.315] lstrlenW (lpString=".doc") returned 4
	[0099.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.315] lstrlenW (lpString=".docx") returned 5
	[0099.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.315] lstrlenW (lpString=".pdf") returned 4
	[0099.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.315] lstrlenW (lpString=".xls") returned 4
	[0099.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.316] lstrlenW (lpString=".xlsx") returned 5
	[0099.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.316] lstrlenW (lpString=".ppt") returned 4
	[0099.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0099.316] lstrlenW (lpString=".zip") returned 4
	[0099.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.316] lstrlenW (lpString=".rar") returned 4
	[0099.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.316] lstrlenW (lpString=".bz2") returned 4
	[0099.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.316] lstrlenW (lpString=".7z") returned 3
	[0099.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0099.316] lstrlenW (lpString=".dbf") returned 4
	[0099.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0099.316] lstrlenW (lpString=".1cd") returned 4
	[0099.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0099.316] lstrlenW (lpString=".jpg") returned 4
	[0099.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.316] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.316] lstrlenW (lpString="AN02559_.WMF") returned 12
	[0099.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.325] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=6632) returned 1
	[0099.325] CloseHandle (hObject=0x178) returned 1
	[0099.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20
	[0099.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0099.332] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.332] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0099.337] GetLastError () returned 0x0
	[0099.337] ReadFile (in: hFile=0x178, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x19e8, lpOverlapped=0x0) returned 1
	[0099.347] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x19f0, lpOverlapped=0x0) returned 1
	[0099.348] ReadFile (in: hFile=0x178, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.348] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.348] SetEndOfFile (hFile=0x174) returned 1
	[0099.348] CloseHandle (hObject=0x174) returned 1
	[0099.348] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.348] SetEndOfFile (hFile=0x178) returned 1
	[0099.349] CloseHandle (hObject=0x178) returned 1
	[0099.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1
	[0099.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0099.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0099.351] lstrlenW (lpString=".doc") returned 4
	[0099.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.351] lstrlenW (lpString=".docx") returned 5
	[0099.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.351] lstrlenW (lpString=".pdf") returned 4
	[0099.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.351] lstrlenW (lpString=".xls") returned 4
	[0099.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.351] lstrlenW (lpString=".xlsx") returned 5
	[0099.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.351] lstrlenW (lpString=".ppt") returned 4
	[0099.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0099.351] lstrlenW (lpString=".zip") returned 4
	[0099.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.351] lstrlenW (lpString=".rar") returned 4
	[0099.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.351] lstrlenW (lpString=".bz2") returned 4
	[0099.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.352] lstrlenW (lpString=".7z") returned 3
	[0099.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0099.352] lstrlenW (lpString=".dbf") returned 4
	[0099.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0099.352] lstrlenW (lpString=".1cd") returned 4
	[0099.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0099.352] lstrlenW (lpString=".jpg") returned 4
	[0099.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0099.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0099.352] lstrlenW (lpString=".doc") returned 4
	[0099.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.352] lstrlenW (lpString=".docx") returned 5
	[0099.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.352] lstrlenW (lpString=".pdf") returned 4
	[0099.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.352] lstrlenW (lpString=".xls") returned 4
	[0099.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.352] lstrlenW (lpString=".xlsx") returned 5
	[0099.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.352] lstrlenW (lpString=".ppt") returned 4
	[0099.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0099.352] lstrlenW (lpString=".zip") returned 4
	[0099.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.353] lstrlenW (lpString=".rar") returned 4
	[0099.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.353] lstrlenW (lpString=".bz2") returned 4
	[0099.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.353] lstrlenW (lpString=".7z") returned 3
	[0099.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0099.353] lstrlenW (lpString=".dbf") returned 4
	[0099.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0099.353] lstrlenW (lpString=".1cd") returned 4
	[0099.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0099.353] lstrlenW (lpString=".jpg") returned 4
	[0099.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.353] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.353] lstrlenW (lpString="AN03500_.WMF") returned 12
	[0099.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.358] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=9240) returned 1
	[0099.358] CloseHandle (hObject=0x1a0) returned 1
	[0099.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20
	[0099.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.377] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.377] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.380] GetLastError () returned 0x0
	[0099.380] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2418, lpOverlapped=0x0) returned 1
	[0099.389] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2420, lpOverlapped=0x0) returned 1
	[0099.390] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.390] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.390] SetEndOfFile (hFile=0x160) returned 1
	[0099.390] CloseHandle (hObject=0x160) returned 1
	[0099.390] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.390] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.391] CloseHandle (hObject=0x1c0) returned 1
	[0099.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1
	[0099.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0099.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0099.392] lstrlenW (lpString=".doc") returned 4
	[0099.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.392] lstrlenW (lpString=".docx") returned 5
	[0099.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.392] lstrlenW (lpString=".pdf") returned 4
	[0099.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.392] lstrlenW (lpString=".xls") returned 4
	[0099.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.392] lstrlenW (lpString=".xlsx") returned 5
	[0099.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.392] lstrlenW (lpString=".ppt") returned 4
	[0099.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0099.392] lstrlenW (lpString=".zip") returned 4
	[0099.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.392] lstrlenW (lpString=".rar") returned 4
	[0099.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.392] lstrlenW (lpString=".bz2") returned 4
	[0099.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.392] lstrlenW (lpString=".7z") returned 3
	[0099.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0099.392] lstrlenW (lpString=".dbf") returned 4
	[0099.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0099.392] lstrlenW (lpString=".1cd") returned 4
	[0099.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0099.393] lstrlenW (lpString=".jpg") returned 4
	[0099.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0099.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0099.393] lstrlenW (lpString=".doc") returned 4
	[0099.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.393] lstrlenW (lpString=".docx") returned 5
	[0099.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.393] lstrlenW (lpString=".pdf") returned 4
	[0099.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.393] lstrlenW (lpString=".xls") returned 4
	[0099.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.393] lstrlenW (lpString=".xlsx") returned 5
	[0099.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.393] lstrlenW (lpString=".ppt") returned 4
	[0099.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0099.393] lstrlenW (lpString=".zip") returned 4
	[0099.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.393] lstrlenW (lpString=".rar") returned 4
	[0099.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.393] lstrlenW (lpString=".bz2") returned 4
	[0099.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.393] lstrlenW (lpString=".7z") returned 3
	[0099.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0099.393] lstrlenW (lpString=".dbf") returned 4
	[0099.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0099.393] lstrlenW (lpString=".1cd") returned 4
	[0099.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0099.394] lstrlenW (lpString=".jpg") returned 4
	[0099.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.394] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.394] lstrlenW (lpString="AN04117_.WMF") returned 12
	[0099.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.394] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=6060) returned 1
	[0099.394] CloseHandle (hObject=0x1c0) returned 1
	[0099.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20
	[0099.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.395] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.395] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.395] GetLastError () returned 0x0
	[0099.395] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x17ac, lpOverlapped=0x0) returned 1
	[0099.405] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x17b0, lpOverlapped=0x0) returned 1
	[0099.406] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.406] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.406] SetEndOfFile (hFile=0x160) returned 1
	[0099.406] CloseHandle (hObject=0x160) returned 1
	[0099.406] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.406] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.407] CloseHandle (hObject=0x1c0) returned 1
	[0099.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1
	[0099.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0099.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0099.408] lstrlenW (lpString=".doc") returned 4
	[0099.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.408] lstrlenW (lpString=".docx") returned 5
	[0099.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.408] lstrlenW (lpString=".pdf") returned 4
	[0099.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.408] lstrlenW (lpString=".xls") returned 4
	[0099.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.408] lstrlenW (lpString=".xlsx") returned 5
	[0099.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.408] lstrlenW (lpString=".ppt") returned 4
	[0099.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0099.408] lstrlenW (lpString=".zip") returned 4
	[0099.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.408] lstrlenW (lpString=".rar") returned 4
	[0099.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.408] lstrlenW (lpString=".bz2") returned 4
	[0099.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.408] lstrlenW (lpString=".7z") returned 3
	[0099.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0099.408] lstrlenW (lpString=".dbf") returned 4
	[0099.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0099.408] lstrlenW (lpString=".1cd") returned 4
	[0099.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0099.408] lstrlenW (lpString=".jpg") returned 4
	[0099.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0099.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0099.409] lstrlenW (lpString=".doc") returned 4
	[0099.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.409] lstrlenW (lpString=".docx") returned 5
	[0099.409] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.409] lstrlenW (lpString=".pdf") returned 4
	[0099.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.409] lstrlenW (lpString=".xls") returned 4
	[0099.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.409] lstrlenW (lpString=".xlsx") returned 5
	[0099.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.409] lstrlenW (lpString=".ppt") returned 4
	[0099.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0099.409] lstrlenW (lpString=".zip") returned 4
	[0099.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.409] lstrlenW (lpString=".rar") returned 4
	[0099.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.409] lstrlenW (lpString=".bz2") returned 4
	[0099.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.409] lstrlenW (lpString=".7z") returned 3
	[0099.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0099.409] lstrlenW (lpString=".dbf") returned 4
	[0099.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0099.410] lstrlenW (lpString=".1cd") returned 4
	[0099.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0099.410] lstrlenW (lpString=".jpg") returned 4
	[0099.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.410] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.410] lstrlenW (lpString="AN04174_.WMF") returned 12
	[0099.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.427] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2636) returned 1
	[0099.427] CloseHandle (hObject=0x198) returned 1
	[0099.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20
	[0099.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.436] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.436] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.451] GetLastError () returned 0x0
	[0099.451] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xa4c, lpOverlapped=0x0) returned 1
	[0099.455] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa50, lpOverlapped=0x0) returned 1
	[0099.456] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.457] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.457] SetEndOfFile (hFile=0x198) returned 1
	[0099.457] CloseHandle (hObject=0x198) returned 1
	[0099.457] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.457] SetEndOfFile (hFile=0x188) returned 1
	[0099.458] CloseHandle (hObject=0x188) returned 1
	[0099.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1
	[0099.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0099.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0099.459] lstrlenW (lpString=".doc") returned 4
	[0099.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.459] lstrlenW (lpString=".docx") returned 5
	[0099.459] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.459] lstrlenW (lpString=".pdf") returned 4
	[0099.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.459] lstrlenW (lpString=".xls") returned 4
	[0099.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.459] lstrlenW (lpString=".xlsx") returned 5
	[0099.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.459] lstrlenW (lpString=".ppt") returned 4
	[0099.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0099.459] lstrlenW (lpString=".zip") returned 4
	[0099.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.459] lstrlenW (lpString=".rar") returned 4
	[0099.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.459] lstrlenW (lpString=".bz2") returned 4
	[0099.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.460] lstrlenW (lpString=".7z") returned 3
	[0099.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0099.460] lstrlenW (lpString=".dbf") returned 4
	[0099.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0099.460] lstrlenW (lpString=".1cd") returned 4
	[0099.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0099.460] lstrlenW (lpString=".jpg") returned 4
	[0099.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0099.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0099.460] lstrlenW (lpString=".doc") returned 4
	[0099.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.460] lstrlenW (lpString=".docx") returned 5
	[0099.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.460] lstrlenW (lpString=".pdf") returned 4
	[0099.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.460] lstrlenW (lpString=".xls") returned 4
	[0099.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.461] lstrlenW (lpString=".xlsx") returned 5
	[0099.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.461] lstrlenW (lpString=".ppt") returned 4
	[0099.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0099.461] lstrlenW (lpString=".zip") returned 4
	[0099.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.461] lstrlenW (lpString=".rar") returned 4
	[0099.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.461] lstrlenW (lpString=".bz2") returned 4
	[0099.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.461] lstrlenW (lpString=".7z") returned 3
	[0099.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0099.461] lstrlenW (lpString=".dbf") returned 4
	[0099.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0099.461] lstrlenW (lpString=".1cd") returned 4
	[0099.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0099.461] lstrlenW (lpString=".jpg") returned 4
	[0099.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.462] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.462] lstrlenW (lpString="AN04195_.WMF") returned 12
	[0099.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.462] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4612) returned 1
	[0099.462] CloseHandle (hObject=0x188) returned 1
	[0099.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20
	[0099.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.463] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.463] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.464] GetLastError () returned 0x0
	[0099.464] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1204, lpOverlapped=0x0) returned 1
	[0099.475] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1210, lpOverlapped=0x0) returned 1
	[0099.476] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.476] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.477] SetEndOfFile (hFile=0x198) returned 1
	[0099.477] CloseHandle (hObject=0x198) returned 1
	[0099.477] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.477] SetEndOfFile (hFile=0x188) returned 1
	[0099.478] CloseHandle (hObject=0x188) returned 1
	[0099.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1
	[0099.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0099.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0099.479] lstrlenW (lpString=".doc") returned 4
	[0099.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.479] lstrlenW (lpString=".docx") returned 5
	[0099.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.479] lstrlenW (lpString=".pdf") returned 4
	[0099.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.479] lstrlenW (lpString=".xls") returned 4
	[0099.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.479] lstrlenW (lpString=".xlsx") returned 5
	[0099.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.479] lstrlenW (lpString=".ppt") returned 4
	[0099.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0099.479] lstrlenW (lpString=".zip") returned 4
	[0099.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.479] lstrlenW (lpString=".rar") returned 4
	[0099.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.480] lstrlenW (lpString=".bz2") returned 4
	[0099.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.480] lstrlenW (lpString=".7z") returned 3
	[0099.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0099.480] lstrlenW (lpString=".dbf") returned 4
	[0099.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0099.480] lstrlenW (lpString=".1cd") returned 4
	[0099.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0099.480] lstrlenW (lpString=".jpg") returned 4
	[0099.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0099.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0099.480] lstrlenW (lpString=".doc") returned 4
	[0099.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.480] lstrlenW (lpString=".docx") returned 5
	[0099.480] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.480] lstrlenW (lpString=".pdf") returned 4
	[0099.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.481] lstrlenW (lpString=".xls") returned 4
	[0099.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.481] lstrlenW (lpString=".xlsx") returned 5
	[0099.481] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.481] lstrlenW (lpString=".ppt") returned 4
	[0099.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0099.481] lstrlenW (lpString=".zip") returned 4
	[0099.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.481] lstrlenW (lpString=".rar") returned 4
	[0099.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.481] lstrlenW (lpString=".bz2") returned 4
	[0099.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.481] lstrlenW (lpString=".7z") returned 3
	[0099.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0099.481] lstrlenW (lpString=".dbf") returned 4
	[0099.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0099.482] lstrlenW (lpString=".1cd") returned 4
	[0099.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0099.482] lstrlenW (lpString=".jpg") returned 4
	[0099.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.482] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.482] lstrlenW (lpString="AN04206_.WMF") returned 12
	[0099.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.483] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7668) returned 1
	[0099.484] CloseHandle (hObject=0x188) returned 1
	[0099.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20
	[0099.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.484] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.484] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.485] GetLastError () returned 0x0
	[0099.485] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1df4, lpOverlapped=0x0) returned 1
	[0099.496] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1e00, lpOverlapped=0x0) returned 1
	[0099.497] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.497] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.497] SetEndOfFile (hFile=0x198) returned 1
	[0099.497] CloseHandle (hObject=0x198) returned 1
	[0099.497] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.497] SetEndOfFile (hFile=0x188) returned 1
	[0099.498] CloseHandle (hObject=0x188) returned 1
	[0099.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1
	[0099.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0099.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0099.499] lstrlenW (lpString=".doc") returned 4
	[0099.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.499] lstrlenW (lpString=".docx") returned 5
	[0099.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.499] lstrlenW (lpString=".pdf") returned 4
	[0099.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.499] lstrlenW (lpString=".xls") returned 4
	[0099.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.499] lstrlenW (lpString=".xlsx") returned 5
	[0099.499] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.500] lstrlenW (lpString=".ppt") returned 4
	[0099.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0099.500] lstrlenW (lpString=".zip") returned 4
	[0099.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.500] lstrlenW (lpString=".rar") returned 4
	[0099.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.500] lstrlenW (lpString=".bz2") returned 4
	[0099.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.500] lstrlenW (lpString=".7z") returned 3
	[0099.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0099.500] lstrlenW (lpString=".dbf") returned 4
	[0099.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0099.500] lstrlenW (lpString=".1cd") returned 4
	[0099.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0099.500] lstrlenW (lpString=".jpg") returned 4
	[0099.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0099.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0099.501] lstrlenW (lpString=".doc") returned 4
	[0099.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.501] lstrlenW (lpString=".docx") returned 5
	[0099.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.501] lstrlenW (lpString=".pdf") returned 4
	[0099.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.501] lstrlenW (lpString=".xls") returned 4
	[0099.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.501] lstrlenW (lpString=".xlsx") returned 5
	[0099.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.501] lstrlenW (lpString=".ppt") returned 4
	[0099.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0099.501] lstrlenW (lpString=".zip") returned 4
	[0099.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.501] lstrlenW (lpString=".rar") returned 4
	[0099.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.501] lstrlenW (lpString=".bz2") returned 4
	[0099.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.501] lstrlenW (lpString=".7z") returned 3
	[0099.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0099.502] lstrlenW (lpString=".dbf") returned 4
	[0099.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0099.502] lstrlenW (lpString=".1cd") returned 4
	[0099.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0099.502] lstrlenW (lpString=".jpg") returned 4
	[0099.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.502] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.502] lstrlenW (lpString="AN04235_.WMF") returned 12
	[0099.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.503] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7804) returned 1
	[0099.503] CloseHandle (hObject=0x188) returned 1
	[0099.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20
	[0099.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.503] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.503] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.504] GetLastError () returned 0x0
	[0099.504] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1e7c, lpOverlapped=0x0) returned 1
	[0099.516] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1e80, lpOverlapped=0x0) returned 1
	[0099.517] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.517] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.517] SetEndOfFile (hFile=0x198) returned 1
	[0099.517] CloseHandle (hObject=0x198) returned 1
	[0099.518] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.518] SetEndOfFile (hFile=0x188) returned 1
	[0099.519] CloseHandle (hObject=0x188) returned 1
	[0099.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1
	[0099.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0099.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0099.519] lstrlenW (lpString=".doc") returned 4
	[0099.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.519] lstrlenW (lpString=".docx") returned 5
	[0099.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.519] lstrlenW (lpString=".pdf") returned 4
	[0099.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.520] lstrlenW (lpString=".xls") returned 4
	[0099.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.520] lstrlenW (lpString=".xlsx") returned 5
	[0099.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.520] lstrlenW (lpString=".ppt") returned 4
	[0099.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0099.520] lstrlenW (lpString=".zip") returned 4
	[0099.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.520] lstrlenW (lpString=".rar") returned 4
	[0099.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.520] lstrlenW (lpString=".bz2") returned 4
	[0099.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.520] lstrlenW (lpString=".7z") returned 3
	[0099.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0099.520] lstrlenW (lpString=".dbf") returned 4
	[0099.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0099.520] lstrlenW (lpString=".1cd") returned 4
	[0099.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0099.520] lstrlenW (lpString=".jpg") returned 4
	[0099.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0099.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0099.521] lstrlenW (lpString=".doc") returned 4
	[0099.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.521] lstrlenW (lpString=".docx") returned 5
	[0099.521] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.521] lstrlenW (lpString=".pdf") returned 4
	[0099.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.521] lstrlenW (lpString=".xls") returned 4
	[0099.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.521] lstrlenW (lpString=".xlsx") returned 5
	[0099.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.521] lstrlenW (lpString=".ppt") returned 4
	[0099.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0099.521] lstrlenW (lpString=".zip") returned 4
	[0099.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.521] lstrlenW (lpString=".rar") returned 4
	[0099.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.521] lstrlenW (lpString=".bz2") returned 4
	[0099.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.521] lstrlenW (lpString=".7z") returned 3
	[0099.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0099.522] lstrlenW (lpString=".dbf") returned 4
	[0099.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0099.522] lstrlenW (lpString=".1cd") returned 4
	[0099.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0099.522] lstrlenW (lpString=".jpg") returned 4
	[0099.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.522] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.522] lstrlenW (lpString="AN04269_.WMF") returned 12
	[0099.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.523] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2016) returned 1
	[0099.523] CloseHandle (hObject=0x188) returned 1
	[0099.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20
	[0099.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.523] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.523] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.524] GetLastError () returned 0x0
	[0099.524] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x7e0, lpOverlapped=0x0) returned 1
	[0099.533] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7f0, lpOverlapped=0x0) returned 1
	[0099.534] ReadFile (in: hFile=0x188, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.534] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.534] SetEndOfFile (hFile=0x198) returned 1
	[0099.534] CloseHandle (hObject=0x198) returned 1
	[0099.534] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.534] SetEndOfFile (hFile=0x188) returned 1
	[0099.535] CloseHandle (hObject=0x188) returned 1
	[0099.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1
	[0099.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0099.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0099.536] lstrlenW (lpString=".doc") returned 4
	[0099.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.536] lstrlenW (lpString=".docx") returned 5
	[0099.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.536] lstrlenW (lpString=".pdf") returned 4
	[0099.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.536] lstrlenW (lpString=".xls") returned 4
	[0099.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.536] lstrlenW (lpString=".xlsx") returned 5
	[0099.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.536] lstrlenW (lpString=".ppt") returned 4
	[0099.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0099.537] lstrlenW (lpString=".zip") returned 4
	[0099.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.537] lstrlenW (lpString=".rar") returned 4
	[0099.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.537] lstrlenW (lpString=".bz2") returned 4
	[0099.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.537] lstrlenW (lpString=".7z") returned 3
	[0099.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0099.537] lstrlenW (lpString=".dbf") returned 4
	[0099.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0099.537] lstrlenW (lpString=".1cd") returned 4
	[0099.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0099.537] lstrlenW (lpString=".jpg") returned 4
	[0099.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0099.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0099.537] lstrlenW (lpString=".doc") returned 4
	[0099.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.537] lstrlenW (lpString=".docx") returned 5
	[0099.538] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.538] lstrlenW (lpString=".pdf") returned 4
	[0099.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.538] lstrlenW (lpString=".xls") returned 4
	[0099.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.538] lstrlenW (lpString=".xlsx") returned 5
	[0099.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.538] lstrlenW (lpString=".ppt") returned 4
	[0099.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0099.538] lstrlenW (lpString=".zip") returned 4
	[0099.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.538] lstrlenW (lpString=".rar") returned 4
	[0099.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.538] lstrlenW (lpString=".bz2") returned 4
	[0099.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.538] lstrlenW (lpString=".7z") returned 3
	[0099.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0099.538] lstrlenW (lpString=".dbf") returned 4
	[0099.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0099.538] lstrlenW (lpString=".1cd") returned 4
	[0099.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0099.538] lstrlenW (lpString=".jpg") returned 4
	[0099.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.539] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.539] lstrlenW (lpString="AN04326_.WMF") returned 12
	[0099.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.546] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3348) returned 1
	[0099.546] CloseHandle (hObject=0x198) returned 1
	[0099.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20
	[0099.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.557] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.557] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.570] GetLastError () returned 0x0
	[0099.570] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xd14, lpOverlapped=0x0) returned 1
	[0099.580] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xd20, lpOverlapped=0x0) returned 1
	[0099.581] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.581] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.581] SetEndOfFile (hFile=0x184) returned 1
	[0099.582] CloseHandle (hObject=0x184) returned 1
	[0099.582] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.582] SetEndOfFile (hFile=0x198) returned 1
	[0099.583] CloseHandle (hObject=0x198) returned 1
	[0099.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1
	[0099.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0099.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0099.585] lstrlenW (lpString=".doc") returned 4
	[0099.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.585] lstrlenW (lpString=".docx") returned 5
	[0099.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.585] lstrlenW (lpString=".pdf") returned 4
	[0099.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.585] lstrlenW (lpString=".xls") returned 4
	[0099.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.585] lstrlenW (lpString=".xlsx") returned 5
	[0099.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.585] lstrlenW (lpString=".ppt") returned 4
	[0099.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0099.585] lstrlenW (lpString=".zip") returned 4
	[0099.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.585] lstrlenW (lpString=".rar") returned 4
	[0099.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.586] lstrlenW (lpString=".bz2") returned 4
	[0099.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.586] lstrlenW (lpString=".7z") returned 3
	[0099.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0099.586] lstrlenW (lpString=".dbf") returned 4
	[0099.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0099.586] lstrlenW (lpString=".1cd") returned 4
	[0099.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0099.586] lstrlenW (lpString=".jpg") returned 4
	[0099.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0099.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0099.586] lstrlenW (lpString=".doc") returned 4
	[0099.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.587] lstrlenW (lpString=".docx") returned 5
	[0099.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.587] lstrlenW (lpString=".pdf") returned 4
	[0099.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.587] lstrlenW (lpString=".xls") returned 4
	[0099.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.587] lstrlenW (lpString=".xlsx") returned 5
	[0099.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.587] lstrlenW (lpString=".ppt") returned 4
	[0099.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0099.587] lstrlenW (lpString=".zip") returned 4
	[0099.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.587] lstrlenW (lpString=".rar") returned 4
	[0099.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.587] lstrlenW (lpString=".bz2") returned 4
	[0099.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.588] lstrlenW (lpString=".7z") returned 3
	[0099.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0099.588] lstrlenW (lpString=".dbf") returned 4
	[0099.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0099.588] lstrlenW (lpString=".1cd") returned 4
	[0099.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0099.588] lstrlenW (lpString=".jpg") returned 4
	[0099.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.588] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.589] lstrlenW (lpString="AN04355_.WMF") returned 12
	[0099.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.595] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3228) returned 1
	[0099.596] CloseHandle (hObject=0x184) returned 1
	[0099.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20
	[0099.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.608] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.608] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.610] GetLastError () returned 0x0
	[0099.610] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xc9c, lpOverlapped=0x0) returned 1
	[0099.620] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xca0, lpOverlapped=0x0) returned 1
	[0099.621] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.621] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.622] SetEndOfFile (hFile=0x1a0) returned 1
	[0099.622] CloseHandle (hObject=0x1a0) returned 1
	[0099.622] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.622] SetEndOfFile (hFile=0x198) returned 1
	[0099.623] CloseHandle (hObject=0x198) returned 1
	[0099.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1
	[0099.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0099.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0099.623] lstrlenW (lpString=".doc") returned 4
	[0099.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.623] lstrlenW (lpString=".docx") returned 5
	[0099.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.623] lstrlenW (lpString=".pdf") returned 4
	[0099.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.623] lstrlenW (lpString=".xls") returned 4
	[0099.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.623] lstrlenW (lpString=".xlsx") returned 5
	[0099.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.623] lstrlenW (lpString=".ppt") returned 4
	[0099.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0099.624] lstrlenW (lpString=".zip") returned 4
	[0099.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.624] lstrlenW (lpString=".rar") returned 4
	[0099.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.624] lstrlenW (lpString=".bz2") returned 4
	[0099.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.624] lstrlenW (lpString=".7z") returned 3
	[0099.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0099.624] lstrlenW (lpString=".dbf") returned 4
	[0099.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0099.624] lstrlenW (lpString=".1cd") returned 4
	[0099.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0099.624] lstrlenW (lpString=".jpg") returned 4
	[0099.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0099.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0099.624] lstrlenW (lpString=".doc") returned 4
	[0099.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.624] lstrlenW (lpString=".docx") returned 5
	[0099.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.624] lstrlenW (lpString=".pdf") returned 4
	[0099.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.625] lstrlenW (lpString=".xls") returned 4
	[0099.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.625] lstrlenW (lpString=".xlsx") returned 5
	[0099.625] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.625] lstrlenW (lpString=".ppt") returned 4
	[0099.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0099.625] lstrlenW (lpString=".zip") returned 4
	[0099.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.625] lstrlenW (lpString=".rar") returned 4
	[0099.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.625] lstrlenW (lpString=".bz2") returned 4
	[0099.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.625] lstrlenW (lpString=".7z") returned 3
	[0099.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0099.625] lstrlenW (lpString=".dbf") returned 4
	[0099.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0099.625] lstrlenW (lpString=".1cd") returned 4
	[0099.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0099.625] lstrlenW (lpString=".jpg") returned 4
	[0099.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.625] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.626] lstrlenW (lpString="AN04384_.WMF") returned 12
	[0099.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.626] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4996) returned 1
	[0099.626] CloseHandle (hObject=0x198) returned 1
	[0099.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20
	[0099.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.627] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.627] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.627] GetLastError () returned 0x0
	[0099.627] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1384, lpOverlapped=0x0) returned 1
	[0099.639] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1390, lpOverlapped=0x0) returned 1
	[0099.640] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.640] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.641] SetEndOfFile (hFile=0x1a0) returned 1
	[0099.641] CloseHandle (hObject=0x1a0) returned 1
	[0099.641] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.641] SetEndOfFile (hFile=0x198) returned 1
	[0099.642] CloseHandle (hObject=0x198) returned 1
	[0099.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1
	[0099.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0099.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0099.642] lstrlenW (lpString=".doc") returned 4
	[0099.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.642] lstrlenW (lpString=".docx") returned 5
	[0099.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.642] lstrlenW (lpString=".pdf") returned 4
	[0099.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.642] lstrlenW (lpString=".xls") returned 4
	[0099.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.642] lstrlenW (lpString=".xlsx") returned 5
	[0099.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.642] lstrlenW (lpString=".ppt") returned 4
	[0099.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0099.643] lstrlenW (lpString=".zip") returned 4
	[0099.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.643] lstrlenW (lpString=".rar") returned 4
	[0099.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.643] lstrlenW (lpString=".bz2") returned 4
	[0099.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.643] lstrlenW (lpString=".7z") returned 3
	[0099.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0099.643] lstrlenW (lpString=".dbf") returned 4
	[0099.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0099.643] lstrlenW (lpString=".1cd") returned 4
	[0099.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0099.643] lstrlenW (lpString=".jpg") returned 4
	[0099.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0099.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0099.643] lstrlenW (lpString=".doc") returned 4
	[0099.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.643] lstrlenW (lpString=".docx") returned 5
	[0099.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.643] lstrlenW (lpString=".pdf") returned 4
	[0099.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.643] lstrlenW (lpString=".xls") returned 4
	[0099.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.643] lstrlenW (lpString=".xlsx") returned 5
	[0099.643] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.643] lstrlenW (lpString=".ppt") returned 4
	[0099.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0099.644] lstrlenW (lpString=".zip") returned 4
	[0099.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.644] lstrlenW (lpString=".rar") returned 4
	[0099.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.644] lstrlenW (lpString=".bz2") returned 4
	[0099.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.644] lstrlenW (lpString=".7z") returned 3
	[0099.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0099.644] lstrlenW (lpString=".dbf") returned 4
	[0099.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0099.644] lstrlenW (lpString=".1cd") returned 4
	[0099.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0099.644] lstrlenW (lpString=".jpg") returned 4
	[0099.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.644] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.644] lstrlenW (lpString="BD00116_.WMF") returned 12
	[0099.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.653] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4870) returned 1
	[0099.653] CloseHandle (hObject=0x184) returned 1
	[0099.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20
	[0099.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.661] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.661] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.664] GetLastError () returned 0x0
	[0099.664] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1306, lpOverlapped=0x0) returned 1
	[0099.667] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1310, lpOverlapped=0x0) returned 1
	[0099.668] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.668] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.668] SetEndOfFile (hFile=0x198) returned 1
	[0099.668] CloseHandle (hObject=0x198) returned 1
	[0099.668] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.668] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.669] CloseHandle (hObject=0x1c0) returned 1
	[0099.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1
	[0099.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0099.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0099.670] lstrlenW (lpString=".doc") returned 4
	[0099.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.670] lstrlenW (lpString=".docx") returned 5
	[0099.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.670] lstrlenW (lpString=".pdf") returned 4
	[0099.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.670] lstrlenW (lpString=".xls") returned 4
	[0099.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.670] lstrlenW (lpString=".xlsx") returned 5
	[0099.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.670] lstrlenW (lpString=".ppt") returned 4
	[0099.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0099.670] lstrlenW (lpString=".zip") returned 4
	[0099.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.670] lstrlenW (lpString=".rar") returned 4
	[0099.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.670] lstrlenW (lpString=".bz2") returned 4
	[0099.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.670] lstrlenW (lpString=".7z") returned 3
	[0099.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0099.670] lstrlenW (lpString=".dbf") returned 4
	[0099.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0099.670] lstrlenW (lpString=".1cd") returned 4
	[0099.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0099.670] lstrlenW (lpString=".jpg") returned 4
	[0099.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0099.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0099.671] lstrlenW (lpString=".doc") returned 4
	[0099.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.671] lstrlenW (lpString=".docx") returned 5
	[0099.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.671] lstrlenW (lpString=".pdf") returned 4
	[0099.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.671] lstrlenW (lpString=".xls") returned 4
	[0099.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.671] lstrlenW (lpString=".xlsx") returned 5
	[0099.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.671] lstrlenW (lpString=".ppt") returned 4
	[0099.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0099.671] lstrlenW (lpString=".zip") returned 4
	[0099.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.671] lstrlenW (lpString=".rar") returned 4
	[0099.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.671] lstrlenW (lpString=".bz2") returned 4
	[0099.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.671] lstrlenW (lpString=".7z") returned 3
	[0099.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0099.671] lstrlenW (lpString=".dbf") returned 4
	[0099.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0099.671] lstrlenW (lpString=".1cd") returned 4
	[0099.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0099.672] lstrlenW (lpString=".jpg") returned 4
	[0099.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.672] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.672] lstrlenW (lpString="BD00146_.WMF") returned 12
	[0099.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.672] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=28948) returned 1
	[0099.672] CloseHandle (hObject=0x1c0) returned 1
	[0099.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20
	[0099.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.673] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.673] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0099.673] GetLastError () returned 0x0
	[0099.673] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x7114, lpOverlapped=0x0) returned 1
	[0099.687] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7120, lpOverlapped=0x0) returned 1
	[0099.689] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.689] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.689] SetEndOfFile (hFile=0x198) returned 1
	[0099.689] CloseHandle (hObject=0x198) returned 1
	[0099.689] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.689] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.690] CloseHandle (hObject=0x1c0) returned 1
	[0099.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1
	[0099.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0099.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0099.691] lstrlenW (lpString=".doc") returned 4
	[0099.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.691] lstrlenW (lpString=".docx") returned 5
	[0099.691] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.691] lstrlenW (lpString=".pdf") returned 4
	[0099.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.691] lstrlenW (lpString=".xls") returned 4
	[0099.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.691] lstrlenW (lpString=".xlsx") returned 5
	[0099.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.691] lstrlenW (lpString=".ppt") returned 4
	[0099.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0099.691] lstrlenW (lpString=".zip") returned 4
	[0099.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.691] lstrlenW (lpString=".rar") returned 4
	[0099.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.691] lstrlenW (lpString=".bz2") returned 4
	[0099.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.691] lstrlenW (lpString=".7z") returned 3
	[0099.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0099.692] lstrlenW (lpString=".dbf") returned 4
	[0099.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0099.692] lstrlenW (lpString=".1cd") returned 4
	[0099.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0099.692] lstrlenW (lpString=".jpg") returned 4
	[0099.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0099.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0099.692] lstrlenW (lpString=".doc") returned 4
	[0099.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.692] lstrlenW (lpString=".docx") returned 5
	[0099.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.692] lstrlenW (lpString=".pdf") returned 4
	[0099.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.692] lstrlenW (lpString=".xls") returned 4
	[0099.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.692] lstrlenW (lpString=".xlsx") returned 5
	[0099.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.692] lstrlenW (lpString=".ppt") returned 4
	[0099.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0099.692] lstrlenW (lpString=".zip") returned 4
	[0099.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.693] lstrlenW (lpString=".rar") returned 4
	[0099.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.693] lstrlenW (lpString=".bz2") returned 4
	[0099.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.693] lstrlenW (lpString=".7z") returned 3
	[0099.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0099.693] lstrlenW (lpString=".dbf") returned 4
	[0099.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0099.693] lstrlenW (lpString=".1cd") returned 4
	[0099.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0099.693] lstrlenW (lpString=".jpg") returned 4
	[0099.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.693] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.693] lstrlenW (lpString="BD00160_.WMF") returned 12
	[0099.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0099.702] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=22516) returned 1
	[0099.702] CloseHandle (hObject=0x1a0) returned 1
	[0099.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20
	[0099.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.753] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.753] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.762] GetLastError () returned 0x0
	[0099.762] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x57f4, lpOverlapped=0x0) returned 1
	[0099.765] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5800, lpOverlapped=0x0) returned 1
	[0099.767] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.767] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.767] SetEndOfFile (hFile=0x184) returned 1
	[0099.767] CloseHandle (hObject=0x184) returned 1
	[0099.767] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.767] SetEndOfFile (hFile=0x160) returned 1
	[0099.768] CloseHandle (hObject=0x160) returned 1
	[0099.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1
	[0099.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0099.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0099.769] lstrlenW (lpString=".doc") returned 4
	[0099.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.769] lstrlenW (lpString=".docx") returned 5
	[0099.769] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.769] lstrlenW (lpString=".pdf") returned 4
	[0099.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.769] lstrlenW (lpString=".xls") returned 4
	[0099.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.769] lstrlenW (lpString=".xlsx") returned 5
	[0099.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.769] lstrlenW (lpString=".ppt") returned 4
	[0099.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0099.769] lstrlenW (lpString=".zip") returned 4
	[0099.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.769] lstrlenW (lpString=".rar") returned 4
	[0099.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.769] lstrlenW (lpString=".bz2") returned 4
	[0099.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.769] lstrlenW (lpString=".7z") returned 3
	[0099.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0099.769] lstrlenW (lpString=".dbf") returned 4
	[0099.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0099.770] lstrlenW (lpString=".1cd") returned 4
	[0099.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0099.770] lstrlenW (lpString=".jpg") returned 4
	[0099.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0099.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0099.770] lstrlenW (lpString=".doc") returned 4
	[0099.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.770] lstrlenW (lpString=".docx") returned 5
	[0099.770] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.770] lstrlenW (lpString=".pdf") returned 4
	[0099.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.770] lstrlenW (lpString=".xls") returned 4
	[0099.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.770] lstrlenW (lpString=".xlsx") returned 5
	[0099.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.770] lstrlenW (lpString=".ppt") returned 4
	[0099.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0099.770] lstrlenW (lpString=".zip") returned 4
	[0099.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.770] lstrlenW (lpString=".rar") returned 4
	[0099.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.770] lstrlenW (lpString=".bz2") returned 4
	[0099.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.771] lstrlenW (lpString=".7z") returned 3
	[0099.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0099.771] lstrlenW (lpString=".dbf") returned 4
	[0099.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0099.771] lstrlenW (lpString=".1cd") returned 4
	[0099.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0099.771] lstrlenW (lpString=".jpg") returned 4
	[0099.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.771] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.771] lstrlenW (lpString="BD05119_.WMF") returned 12
	[0099.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.772] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=17236) returned 1
	[0099.772] CloseHandle (hObject=0x160) returned 1
	[0099.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20
	[0099.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.773] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.773] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.773] GetLastError () returned 0x0
	[0099.773] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x4354, lpOverlapped=0x0) returned 1
	[0099.789] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4360, lpOverlapped=0x0) returned 1
	[0099.790] ReadFile (in: hFile=0x160, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.790] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.791] SetEndOfFile (hFile=0x184) returned 1
	[0099.791] CloseHandle (hObject=0x184) returned 1
	[0099.791] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.791] SetEndOfFile (hFile=0x160) returned 1
	[0099.792] CloseHandle (hObject=0x160) returned 1
	[0099.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1
	[0099.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0099.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0099.792] lstrlenW (lpString=".doc") returned 4
	[0099.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.792] lstrlenW (lpString=".docx") returned 5
	[0099.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.793] lstrlenW (lpString=".pdf") returned 4
	[0099.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.793] lstrlenW (lpString=".xls") returned 4
	[0099.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.793] lstrlenW (lpString=".xlsx") returned 5
	[0099.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.793] lstrlenW (lpString=".ppt") returned 4
	[0099.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0099.793] lstrlenW (lpString=".zip") returned 4
	[0099.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.793] lstrlenW (lpString=".rar") returned 4
	[0099.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.793] lstrlenW (lpString=".bz2") returned 4
	[0099.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.793] lstrlenW (lpString=".7z") returned 3
	[0099.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0099.793] lstrlenW (lpString=".dbf") returned 4
	[0099.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0099.793] lstrlenW (lpString=".1cd") returned 4
	[0099.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0099.793] lstrlenW (lpString=".jpg") returned 4
	[0099.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0099.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0099.793] lstrlenW (lpString=".doc") returned 4
	[0099.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.794] lstrlenW (lpString=".docx") returned 5
	[0099.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.794] lstrlenW (lpString=".pdf") returned 4
	[0099.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.794] lstrlenW (lpString=".xls") returned 4
	[0099.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.794] lstrlenW (lpString=".xlsx") returned 5
	[0099.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.794] lstrlenW (lpString=".ppt") returned 4
	[0099.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0099.794] lstrlenW (lpString=".zip") returned 4
	[0099.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.794] lstrlenW (lpString=".rar") returned 4
	[0099.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.794] lstrlenW (lpString=".bz2") returned 4
	[0099.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.794] lstrlenW (lpString=".7z") returned 3
	[0099.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0099.794] lstrlenW (lpString=".dbf") returned 4
	[0099.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0099.794] lstrlenW (lpString=".1cd") returned 4
	[0099.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0099.795] lstrlenW (lpString=".jpg") returned 4
	[0099.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.795] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.795] lstrlenW (lpString="BD06200_.WMF") returned 12
	[0099.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.809] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=16676) returned 1
	[0099.809] CloseHandle (hObject=0x190) returned 1
	[0099.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20
	[0099.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.837] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.838] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0099.855] GetLastError () returned 0x0
	[0099.855] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x4124, lpOverlapped=0x0) returned 1
	[0099.860] WriteFile (in: hFile=0x170, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4130, lpOverlapped=0x0) returned 1
	[0099.861] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.862] WriteFile (in: hFile=0x170, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.862] SetEndOfFile (hFile=0x170) returned 1
	[0099.862] CloseHandle (hObject=0x170) returned 1
	[0099.862] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.862] SetEndOfFile (hFile=0x190) returned 1
	[0099.863] CloseHandle (hObject=0x190) returned 1
	[0099.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1
	[0099.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0099.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0099.864] lstrlenW (lpString=".doc") returned 4
	[0099.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.864] lstrlenW (lpString=".docx") returned 5
	[0099.864] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.864] lstrlenW (lpString=".pdf") returned 4
	[0099.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.864] lstrlenW (lpString=".xls") returned 4
	[0099.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.864] lstrlenW (lpString=".xlsx") returned 5
	[0099.864] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.864] lstrlenW (lpString=".ppt") returned 4
	[0099.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0099.864] lstrlenW (lpString=".zip") returned 4
	[0099.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.864] lstrlenW (lpString=".rar") returned 4
	[0099.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.864] lstrlenW (lpString=".bz2") returned 4
	[0099.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.864] lstrlenW (lpString=".7z") returned 3
	[0099.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0099.864] lstrlenW (lpString=".dbf") returned 4
	[0099.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0099.864] lstrlenW (lpString=".1cd") returned 4
	[0099.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0099.864] lstrlenW (lpString=".jpg") returned 4
	[0099.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0099.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0099.865] lstrlenW (lpString=".doc") returned 4
	[0099.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.865] lstrlenW (lpString=".docx") returned 5
	[0099.865] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.865] lstrlenW (lpString=".pdf") returned 4
	[0099.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.865] lstrlenW (lpString=".xls") returned 4
	[0099.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.865] lstrlenW (lpString=".xlsx") returned 5
	[0099.865] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.865] lstrlenW (lpString=".ppt") returned 4
	[0099.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0099.865] lstrlenW (lpString=".zip") returned 4
	[0099.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.865] lstrlenW (lpString=".rar") returned 4
	[0099.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.865] lstrlenW (lpString=".bz2") returned 4
	[0099.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.865] lstrlenW (lpString=".7z") returned 3
	[0099.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0099.865] lstrlenW (lpString=".dbf") returned 4
	[0099.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0099.865] lstrlenW (lpString=".1cd") returned 4
	[0099.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0099.866] lstrlenW (lpString=".jpg") returned 4
	[0099.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.866] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.866] lstrlenW (lpString="BD07804_.WMF") returned 12
	[0099.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.866] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4924) returned 1
	[0099.866] CloseHandle (hObject=0x190) returned 1
	[0099.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20
	[0099.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.867] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.867] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0099.868] GetLastError () returned 0x0
	[0099.868] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x133c, lpOverlapped=0x0) returned 1
	[0099.877] WriteFile (in: hFile=0x170, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1340, lpOverlapped=0x0) returned 1
	[0099.878] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.878] WriteFile (in: hFile=0x170, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.878] SetEndOfFile (hFile=0x170) returned 1
	[0099.878] CloseHandle (hObject=0x170) returned 1
	[0099.878] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.878] SetEndOfFile (hFile=0x190) returned 1
	[0099.879] CloseHandle (hObject=0x190) returned 1
	[0099.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1
	[0099.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0099.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0099.881] lstrlenW (lpString=".doc") returned 4
	[0099.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.881] lstrlenW (lpString=".docx") returned 5
	[0099.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.881] lstrlenW (lpString=".pdf") returned 4
	[0099.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.881] lstrlenW (lpString=".xls") returned 4
	[0099.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.881] lstrlenW (lpString=".xlsx") returned 5
	[0099.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.881] lstrlenW (lpString=".ppt") returned 4
	[0099.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0099.882] lstrlenW (lpString=".zip") returned 4
	[0099.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.882] lstrlenW (lpString=".rar") returned 4
	[0099.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.882] lstrlenW (lpString=".bz2") returned 4
	[0099.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.882] lstrlenW (lpString=".7z") returned 3
	[0099.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0099.882] lstrlenW (lpString=".dbf") returned 4
	[0099.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0099.882] lstrlenW (lpString=".1cd") returned 4
	[0099.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0099.882] lstrlenW (lpString=".jpg") returned 4
	[0099.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0099.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0099.882] lstrlenW (lpString=".doc") returned 4
	[0099.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.882] lstrlenW (lpString=".docx") returned 5
	[0099.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.883] lstrlenW (lpString=".pdf") returned 4
	[0099.883] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.883] lstrlenW (lpString=".xls") returned 4
	[0099.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.883] lstrlenW (lpString=".xlsx") returned 5
	[0099.883] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.883] lstrlenW (lpString=".ppt") returned 4
	[0099.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0099.883] lstrlenW (lpString=".zip") returned 4
	[0099.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.883] lstrlenW (lpString=".rar") returned 4
	[0099.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.883] lstrlenW (lpString=".bz2") returned 4
	[0099.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.883] lstrlenW (lpString=".7z") returned 3
	[0099.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0099.883] lstrlenW (lpString=".dbf") returned 4
	[0099.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0099.883] lstrlenW (lpString=".1cd") returned 4
	[0099.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0099.883] lstrlenW (lpString=".jpg") returned 4
	[0099.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.884] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.884] lstrlenW (lpString="BD08758_.WMF") returned 12
	[0099.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.897] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=24320) returned 1
	[0099.897] CloseHandle (hObject=0x188) returned 1
	[0099.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20
	[0099.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.924] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.924] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.929] GetLastError () returned 0x0
	[0099.929] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x5f00, lpOverlapped=0x0) returned 1
	[0099.940] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5f10, lpOverlapped=0x0) returned 1
	[0099.941] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.941] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.941] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.941] CloseHandle (hObject=0x1c0) returned 1
	[0099.941] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.941] SetEndOfFile (hFile=0x190) returned 1
	[0099.942] CloseHandle (hObject=0x190) returned 1
	[0099.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1
	[0099.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0099.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0099.943] lstrlenW (lpString=".doc") returned 4
	[0099.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.943] lstrlenW (lpString=".docx") returned 5
	[0099.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.943] lstrlenW (lpString=".pdf") returned 4
	[0099.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.943] lstrlenW (lpString=".xls") returned 4
	[0099.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.943] lstrlenW (lpString=".xlsx") returned 5
	[0099.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.943] lstrlenW (lpString=".ppt") returned 4
	[0099.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0099.943] lstrlenW (lpString=".zip") returned 4
	[0099.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.943] lstrlenW (lpString=".rar") returned 4
	[0099.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.943] lstrlenW (lpString=".bz2") returned 4
	[0099.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.943] lstrlenW (lpString=".7z") returned 3
	[0099.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0099.943] lstrlenW (lpString=".dbf") returned 4
	[0099.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0099.943] lstrlenW (lpString=".1cd") returned 4
	[0099.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0099.943] lstrlenW (lpString=".jpg") returned 4
	[0099.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0099.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0099.944] lstrlenW (lpString=".doc") returned 4
	[0099.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.944] lstrlenW (lpString=".docx") returned 5
	[0099.944] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.944] lstrlenW (lpString=".pdf") returned 4
	[0099.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.944] lstrlenW (lpString=".xls") returned 4
	[0099.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.944] lstrlenW (lpString=".xlsx") returned 5
	[0099.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.944] lstrlenW (lpString=".ppt") returned 4
	[0099.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0099.944] lstrlenW (lpString=".zip") returned 4
	[0099.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.944] lstrlenW (lpString=".rar") returned 4
	[0099.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.944] lstrlenW (lpString=".bz2") returned 4
	[0099.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.944] lstrlenW (lpString=".7z") returned 3
	[0099.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0099.944] lstrlenW (lpString=".dbf") returned 4
	[0099.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0099.944] lstrlenW (lpString=".1cd") returned 4
	[0099.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0099.945] lstrlenW (lpString=".jpg") returned 4
	[0099.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.945] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.945] lstrlenW (lpString="BD08808_.WMF") returned 12
	[0099.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.945] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=47996) returned 1
	[0099.945] CloseHandle (hObject=0x190) returned 1
	[0099.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20
	[0099.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.946] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.946] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.947] GetLastError () returned 0x0
	[0099.947] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xbb7c, lpOverlapped=0x0) returned 1
	[0099.958] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xbb80, lpOverlapped=0x0) returned 1
	[0099.960] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.960] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.960] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.960] CloseHandle (hObject=0x1c0) returned 1
	[0099.960] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.960] SetEndOfFile (hFile=0x190) returned 1
	[0099.961] CloseHandle (hObject=0x190) returned 1
	[0099.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1
	[0099.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0099.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0099.962] lstrlenW (lpString=".doc") returned 4
	[0099.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.964] lstrlenW (lpString=".docx") returned 5
	[0099.964] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.964] lstrlenW (lpString=".pdf") returned 4
	[0099.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.964] lstrlenW (lpString=".xls") returned 4
	[0099.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.964] lstrlenW (lpString=".xlsx") returned 5
	[0099.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.964] lstrlenW (lpString=".ppt") returned 4
	[0099.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0099.964] lstrlenW (lpString=".zip") returned 4
	[0099.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.964] lstrlenW (lpString=".rar") returned 4
	[0099.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.964] lstrlenW (lpString=".bz2") returned 4
	[0099.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.965] lstrlenW (lpString=".7z") returned 3
	[0099.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0099.965] lstrlenW (lpString=".dbf") returned 4
	[0099.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0099.965] lstrlenW (lpString=".1cd") returned 4
	[0099.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0099.965] lstrlenW (lpString=".jpg") returned 4
	[0099.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0099.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0099.965] lstrlenW (lpString=".doc") returned 4
	[0099.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.965] lstrlenW (lpString=".docx") returned 5
	[0099.965] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.965] lstrlenW (lpString=".pdf") returned 4
	[0099.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.965] lstrlenW (lpString=".xls") returned 4
	[0099.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.965] lstrlenW (lpString=".xlsx") returned 5
	[0099.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.965] lstrlenW (lpString=".ppt") returned 4
	[0099.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0099.965] lstrlenW (lpString=".zip") returned 4
	[0099.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.965] lstrlenW (lpString=".rar") returned 4
	[0099.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.965] lstrlenW (lpString=".bz2") returned 4
	[0099.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.966] lstrlenW (lpString=".7z") returned 3
	[0099.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0099.966] lstrlenW (lpString=".dbf") returned 4
	[0099.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0099.966] lstrlenW (lpString=".1cd") returned 4
	[0099.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0099.966] lstrlenW (lpString=".jpg") returned 4
	[0099.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.966] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.966] lstrlenW (lpString="BD09031_.WMF") returned 12
	[0099.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.967] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=47786) returned 1
	[0099.967] CloseHandle (hObject=0x190) returned 1
	[0099.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20
	[0099.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.967] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.967] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.968] GetLastError () returned 0x0
	[0099.968] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xbaaa, lpOverlapped=0x0) returned 1
	[0099.980] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xbab0, lpOverlapped=0x0) returned 1
	[0099.982] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.982] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.982] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.984] CloseHandle (hObject=0x1c0) returned 1
	[0099.986] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.986] SetEndOfFile (hFile=0x190) returned 1
	[0099.991] CloseHandle (hObject=0x190) returned 1
	[0099.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1
	[0099.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0099.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0099.991] lstrlenW (lpString=".doc") returned 4
	[0099.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.991] lstrlenW (lpString=".docx") returned 5
	[0099.992] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.992] lstrlenW (lpString=".pdf") returned 4
	[0099.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.992] lstrlenW (lpString=".xls") returned 4
	[0099.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.992] lstrlenW (lpString=".xlsx") returned 5
	[0099.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.992] lstrlenW (lpString=".ppt") returned 4
	[0099.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0099.992] lstrlenW (lpString=".zip") returned 4
	[0099.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.992] lstrlenW (lpString=".rar") returned 4
	[0099.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.992] lstrlenW (lpString=".bz2") returned 4
	[0099.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.993] lstrlenW (lpString=".7z") returned 3
	[0099.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0099.993] lstrlenW (lpString=".dbf") returned 4
	[0099.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0099.993] lstrlenW (lpString=".1cd") returned 4
	[0099.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0099.993] lstrlenW (lpString=".jpg") returned 4
	[0099.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0099.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0099.993] lstrlenW (lpString=".doc") returned 4
	[0099.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0099.994] lstrlenW (lpString=".docx") returned 5
	[0099.994] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0099.994] lstrlenW (lpString=".pdf") returned 4
	[0099.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0099.994] lstrlenW (lpString=".xls") returned 4
	[0099.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0099.994] lstrlenW (lpString=".xlsx") returned 5
	[0099.994] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0099.994] lstrlenW (lpString=".ppt") returned 4
	[0099.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0099.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0099.994] lstrlenW (lpString=".zip") returned 4
	[0099.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0099.994] lstrlenW (lpString=".rar") returned 4
	[0099.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0099.995] lstrlenW (lpString=".bz2") returned 4
	[0099.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0099.995] lstrlenW (lpString=".7z") returned 3
	[0099.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0099.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0099.995] lstrlenW (lpString=".dbf") returned 4
	[0099.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0099.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0099.995] lstrlenW (lpString=".1cd") returned 4
	[0099.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0099.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0099.995] lstrlenW (lpString=".jpg") returned 4
	[0099.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0099.996] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0099.996] lstrlenW (lpString="BD09662_.WMF") returned 12
	[0099.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.997] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=20554) returned 1
	[0099.997] CloseHandle (hObject=0x190) returned 1
	[0099.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20
	[0099.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.998] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.998] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0099.999] GetLastError () returned 0x0
	[0099.999] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x504a, lpOverlapped=0x0) returned 1
	[0100.011] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5050, lpOverlapped=0x0) returned 1
	[0100.012] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.012] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.013] SetEndOfFile (hFile=0x188) returned 1
	[0100.013] CloseHandle (hObject=0x188) returned 1
	[0100.013] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.013] SetEndOfFile (hFile=0x190) returned 1
	[0100.014] CloseHandle (hObject=0x190) returned 1
	[0100.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1
	[0100.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0100.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0100.015] lstrlenW (lpString=".doc") returned 4
	[0100.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.015] lstrlenW (lpString=".docx") returned 5
	[0100.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.015] lstrlenW (lpString=".pdf") returned 4
	[0100.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.015] lstrlenW (lpString=".xls") returned 4
	[0100.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.015] lstrlenW (lpString=".xlsx") returned 5
	[0100.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.015] lstrlenW (lpString=".ppt") returned 4
	[0100.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0100.015] lstrlenW (lpString=".zip") returned 4
	[0100.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.015] lstrlenW (lpString=".rar") returned 4
	[0100.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.015] lstrlenW (lpString=".bz2") returned 4
	[0100.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.015] lstrlenW (lpString=".7z") returned 3
	[0100.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0100.015] lstrlenW (lpString=".dbf") returned 4
	[0100.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0100.016] lstrlenW (lpString=".1cd") returned 4
	[0100.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0100.016] lstrlenW (lpString=".jpg") returned 4
	[0100.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0100.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0100.016] lstrlenW (lpString=".doc") returned 4
	[0100.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.016] lstrlenW (lpString=".docx") returned 5
	[0100.016] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.016] lstrlenW (lpString=".pdf") returned 4
	[0100.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.016] lstrlenW (lpString=".xls") returned 4
	[0100.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.016] lstrlenW (lpString=".xlsx") returned 5
	[0100.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.016] lstrlenW (lpString=".ppt") returned 4
	[0100.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0100.016] lstrlenW (lpString=".zip") returned 4
	[0100.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.016] lstrlenW (lpString=".rar") returned 4
	[0100.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.017] lstrlenW (lpString=".bz2") returned 4
	[0100.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.017] lstrlenW (lpString=".7z") returned 3
	[0100.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0100.017] lstrlenW (lpString=".dbf") returned 4
	[0100.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0100.017] lstrlenW (lpString=".1cd") returned 4
	[0100.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0100.017] lstrlenW (lpString=".jpg") returned 4
	[0100.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.017] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0100.017] lstrlenW (lpString="BD10890_.GIF") returned 12
	[0100.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.018] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=13515) returned 1
	[0100.018] CloseHandle (hObject=0x190) returned 1
	[0100.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20
	[0100.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.019] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.019] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0100.020] GetLastError () returned 0x0
	[0100.020] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x34cb, lpOverlapped=0x0) returned 1
	[0100.031] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x34d0, lpOverlapped=0x0) returned 1
	[0100.033] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.033] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.033] SetEndOfFile (hFile=0x188) returned 1
	[0100.033] CloseHandle (hObject=0x188) returned 1
	[0100.033] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.033] SetEndOfFile (hFile=0x190) returned 1
	[0100.034] CloseHandle (hObject=0x190) returned 1
	[0100.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1
	[0100.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0100.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0100.036] lstrlenW (lpString=".doc") returned 4
	[0100.036] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0100.036] lstrlenW (lpString=".docx") returned 5
	[0100.036] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0100.036] lstrlenW (lpString=".pdf") returned 4
	[0100.036] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0100.036] lstrlenW (lpString=".xls") returned 4
	[0100.036] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0100.036] lstrlenW (lpString=".xlsx") returned 5
	[0100.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0100.036] lstrlenW (lpString=".ppt") returned 4
	[0100.036] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0100.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0100.036] lstrlenW (lpString=".zip") returned 4
	[0100.036] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0100.036] lstrlenW (lpString=".rar") returned 4
	[0100.036] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0100.036] lstrlenW (lpString=".bz2") returned 4
	[0100.036] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0100.036] lstrlenW (lpString=".7z") returned 3
	[0100.036] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0100.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0100.036] lstrlenW (lpString=".dbf") returned 4
	[0100.036] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0100.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0100.037] lstrlenW (lpString=".1cd") returned 4
	[0100.037] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0100.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0100.037] lstrlenW (lpString=".jpg") returned 4
	[0100.037] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0100.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0100.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0100.037] lstrlenW (lpString=".doc") returned 4
	[0100.037] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0100.037] lstrlenW (lpString=".docx") returned 5
	[0100.037] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0100.037] lstrlenW (lpString=".pdf") returned 4
	[0100.037] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0100.037] lstrlenW (lpString=".xls") returned 4
	[0100.037] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0100.037] lstrlenW (lpString=".xlsx") returned 5
	[0100.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0100.037] lstrlenW (lpString=".ppt") returned 4
	[0100.037] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0100.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0100.037] lstrlenW (lpString=".zip") returned 4
	[0100.037] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0100.037] lstrlenW (lpString=".rar") returned 4
	[0100.037] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0100.037] lstrlenW (lpString=".bz2") returned 4
	[0100.037] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0100.038] lstrlenW (lpString=".7z") returned 3
	[0100.038] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0100.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0100.038] lstrlenW (lpString=".dbf") returned 4
	[0100.038] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0100.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0100.038] lstrlenW (lpString=".1cd") returned 4
	[0100.038] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0100.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0100.038] lstrlenW (lpString=".jpg") returned 4
	[0100.038] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0100.038] lstrcmpiW (lpString1=".GIF", lpString2=".adobe") returned 1
	[0100.038] lstrlenW (lpString="BD19563_.GIF") returned 12
	[0100.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.046] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=20454) returned 1
	[0100.046] CloseHandle (hObject=0x1c0) returned 1
	[0100.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20
	[0100.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0100.057] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.057] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0100.060] GetLastError () returned 0x0
	[0100.060] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x4fe6, lpOverlapped=0x0) returned 1
	[0100.072] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4ff0, lpOverlapped=0x0) returned 1
	[0100.073] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.074] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.074] SetEndOfFile (hFile=0x188) returned 1
	[0100.074] CloseHandle (hObject=0x188) returned 1
	[0100.074] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.074] SetEndOfFile (hFile=0x1cc) returned 1
	[0100.075] CloseHandle (hObject=0x1cc) returned 1
	[0100.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1
	[0100.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0100.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0100.076] lstrlenW (lpString=".doc") returned 4
	[0100.076] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0100.076] lstrlenW (lpString=".docx") returned 5
	[0100.076] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0100.076] lstrlenW (lpString=".pdf") returned 4
	[0100.076] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0100.076] lstrlenW (lpString=".xls") returned 4
	[0100.076] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0100.076] lstrlenW (lpString=".xlsx") returned 5
	[0100.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0100.076] lstrlenW (lpString=".ppt") returned 4
	[0100.076] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0100.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0100.076] lstrlenW (lpString=".zip") returned 4
	[0100.076] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0100.076] lstrlenW (lpString=".rar") returned 4
	[0100.076] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0100.076] lstrlenW (lpString=".bz2") returned 4
	[0100.076] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0100.076] lstrlenW (lpString=".7z") returned 3
	[0100.076] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0100.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0100.076] lstrlenW (lpString=".dbf") returned 4
	[0100.076] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0100.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0100.076] lstrlenW (lpString=".1cd") returned 4
	[0100.076] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0100.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0100.076] lstrlenW (lpString=".jpg") returned 4
	[0100.076] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0100.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0100.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0100.076] lstrlenW (lpString=".doc") returned 4
	[0100.077] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0100.077] lstrlenW (lpString=".docx") returned 5
	[0100.077] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0100.077] lstrlenW (lpString=".pdf") returned 4
	[0100.077] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0100.077] lstrlenW (lpString=".xls") returned 4
	[0100.077] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0100.077] lstrlenW (lpString=".xlsx") returned 5
	[0100.077] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0100.077] lstrlenW (lpString=".ppt") returned 4
	[0100.077] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0100.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0100.077] lstrlenW (lpString=".zip") returned 4
	[0100.077] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0100.077] lstrlenW (lpString=".rar") returned 4
	[0100.077] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0100.077] lstrlenW (lpString=".bz2") returned 4
	[0100.077] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0100.077] lstrlenW (lpString=".7z") returned 3
	[0100.077] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0100.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0100.077] lstrlenW (lpString=".dbf") returned 4
	[0100.077] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0100.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0100.077] lstrlenW (lpString=".1cd") returned 4
	[0100.077] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0100.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0100.077] lstrlenW (lpString=".jpg") returned 4
	[0100.077] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0100.078] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.078] lstrlenW (lpString="BD19695_.WMF") returned 12
	[0100.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0100.078] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=12982) returned 1
	[0100.078] CloseHandle (hObject=0x1cc) returned 1
	[0100.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20
	[0100.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0100.079] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.079] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0100.079] GetLastError () returned 0x0
	[0100.079] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x32b6, lpOverlapped=0x0) returned 1
	[0100.091] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x32c0, lpOverlapped=0x0) returned 1
	[0100.092] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.093] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.093] SetEndOfFile (hFile=0x188) returned 1
	[0100.093] CloseHandle (hObject=0x188) returned 1
	[0100.093] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.093] SetEndOfFile (hFile=0x1cc) returned 1
	[0100.094] CloseHandle (hObject=0x1cc) returned 1
	[0100.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1
	[0100.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0100.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0100.094] lstrlenW (lpString=".doc") returned 4
	[0100.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.094] lstrlenW (lpString=".docx") returned 5
	[0100.094] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.094] lstrlenW (lpString=".pdf") returned 4
	[0100.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.094] lstrlenW (lpString=".xls") returned 4
	[0100.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.095] lstrlenW (lpString=".xlsx") returned 5
	[0100.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.095] lstrlenW (lpString=".ppt") returned 4
	[0100.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0100.095] lstrlenW (lpString=".zip") returned 4
	[0100.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.095] lstrlenW (lpString=".rar") returned 4
	[0100.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.095] lstrlenW (lpString=".bz2") returned 4
	[0100.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.095] lstrlenW (lpString=".7z") returned 3
	[0100.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0100.095] lstrlenW (lpString=".dbf") returned 4
	[0100.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0100.095] lstrlenW (lpString=".1cd") returned 4
	[0100.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0100.095] lstrlenW (lpString=".jpg") returned 4
	[0100.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0100.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0100.095] lstrlenW (lpString=".doc") returned 4
	[0100.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.095] lstrlenW (lpString=".docx") returned 5
	[0100.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.095] lstrlenW (lpString=".pdf") returned 4
	[0100.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.095] lstrlenW (lpString=".xls") returned 4
	[0100.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.096] lstrlenW (lpString=".xlsx") returned 5
	[0100.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.096] lstrlenW (lpString=".ppt") returned 4
	[0100.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0100.096] lstrlenW (lpString=".zip") returned 4
	[0100.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.096] lstrlenW (lpString=".rar") returned 4
	[0100.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.096] lstrlenW (lpString=".bz2") returned 4
	[0100.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.096] lstrlenW (lpString=".7z") returned 3
	[0100.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0100.096] lstrlenW (lpString=".dbf") returned 4
	[0100.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0100.096] lstrlenW (lpString=".1cd") returned 4
	[0100.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0100.096] lstrlenW (lpString=".jpg") returned 4
	[0100.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.096] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.096] lstrlenW (lpString="BD19828_.WMF") returned 12
	[0100.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0100.097] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8772) returned 1
	[0100.097] CloseHandle (hObject=0x1cc) returned 1
	[0100.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20
	[0100.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0100.098] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.098] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0100.098] GetLastError () returned 0x0
	[0100.098] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2244, lpOverlapped=0x0) returned 1
	[0100.111] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2250, lpOverlapped=0x0) returned 1
	[0100.112] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.112] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.112] SetEndOfFile (hFile=0x188) returned 1
	[0100.112] CloseHandle (hObject=0x188) returned 1
	[0100.112] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.112] SetEndOfFile (hFile=0x1cc) returned 1
	[0100.113] CloseHandle (hObject=0x1cc) returned 1
	[0100.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1
	[0100.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0100.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0100.114] lstrlenW (lpString=".doc") returned 4
	[0100.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.114] lstrlenW (lpString=".docx") returned 5
	[0100.114] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.114] lstrlenW (lpString=".pdf") returned 4
	[0100.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.114] lstrlenW (lpString=".xls") returned 4
	[0100.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.114] lstrlenW (lpString=".xlsx") returned 5
	[0100.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.114] lstrlenW (lpString=".ppt") returned 4
	[0100.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0100.114] lstrlenW (lpString=".zip") returned 4
	[0100.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.114] lstrlenW (lpString=".rar") returned 4
	[0100.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.114] lstrlenW (lpString=".bz2") returned 4
	[0100.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.114] lstrlenW (lpString=".7z") returned 3
	[0100.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0100.114] lstrlenW (lpString=".dbf") returned 4
	[0100.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0100.114] lstrlenW (lpString=".1cd") returned 4
	[0100.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0100.115] lstrlenW (lpString=".jpg") returned 4
	[0100.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0100.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0100.115] lstrlenW (lpString=".doc") returned 4
	[0100.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.115] lstrlenW (lpString=".docx") returned 5
	[0100.115] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.115] lstrlenW (lpString=".pdf") returned 4
	[0100.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.115] lstrlenW (lpString=".xls") returned 4
	[0100.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.115] lstrlenW (lpString=".xlsx") returned 5
	[0100.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.115] lstrlenW (lpString=".ppt") returned 4
	[0100.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0100.115] lstrlenW (lpString=".zip") returned 4
	[0100.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.115] lstrlenW (lpString=".rar") returned 4
	[0100.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.115] lstrlenW (lpString=".bz2") returned 4
	[0100.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.115] lstrlenW (lpString=".7z") returned 3
	[0100.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0100.115] lstrlenW (lpString=".dbf") returned 4
	[0100.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0100.115] lstrlenW (lpString=".1cd") returned 4
	[0100.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0100.116] lstrlenW (lpString=".jpg") returned 4
	[0100.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.116] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.116] lstrlenW (lpString="BD19988_.WMF") returned 12
	[0100.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0100.116] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=18304) returned 1
	[0100.116] CloseHandle (hObject=0x1cc) returned 1
	[0100.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20
	[0100.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0100.117] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.117] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0100.118] GetLastError () returned 0x0
	[0100.118] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x4780, lpOverlapped=0x0) returned 1
	[0100.130] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4790, lpOverlapped=0x0) returned 1
	[0100.133] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.134] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.134] SetEndOfFile (hFile=0x188) returned 1
	[0100.135] CloseHandle (hObject=0x188) returned 1
	[0100.135] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.135] SetEndOfFile (hFile=0x1cc) returned 1
	[0100.137] CloseHandle (hObject=0x1cc) returned 1
	[0100.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1
	[0100.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0100.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0100.138] lstrlenW (lpString=".doc") returned 4
	[0100.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.138] lstrlenW (lpString=".docx") returned 5
	[0100.138] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.138] lstrlenW (lpString=".pdf") returned 4
	[0100.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.139] lstrlenW (lpString=".xls") returned 4
	[0100.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.139] lstrlenW (lpString=".xlsx") returned 5
	[0100.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.139] lstrlenW (lpString=".ppt") returned 4
	[0100.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0100.139] lstrlenW (lpString=".zip") returned 4
	[0100.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.139] lstrlenW (lpString=".rar") returned 4
	[0100.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.139] lstrlenW (lpString=".bz2") returned 4
	[0100.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.139] lstrlenW (lpString=".7z") returned 3
	[0100.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0100.139] lstrlenW (lpString=".dbf") returned 4
	[0100.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0100.139] lstrlenW (lpString=".1cd") returned 4
	[0100.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0100.139] lstrlenW (lpString=".jpg") returned 4
	[0100.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0100.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0100.139] lstrlenW (lpString=".doc") returned 4
	[0100.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.139] lstrlenW (lpString=".docx") returned 5
	[0100.139] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.140] lstrlenW (lpString=".pdf") returned 4
	[0100.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.140] lstrlenW (lpString=".xls") returned 4
	[0100.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.140] lstrlenW (lpString=".xlsx") returned 5
	[0100.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.140] lstrlenW (lpString=".ppt") returned 4
	[0100.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0100.140] lstrlenW (lpString=".zip") returned 4
	[0100.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.140] lstrlenW (lpString=".rar") returned 4
	[0100.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.140] lstrlenW (lpString=".bz2") returned 4
	[0100.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.140] lstrlenW (lpString=".7z") returned 3
	[0100.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0100.140] lstrlenW (lpString=".dbf") returned 4
	[0100.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0100.140] lstrlenW (lpString=".1cd") returned 4
	[0100.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0100.140] lstrlenW (lpString=".jpg") returned 4
	[0100.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.140] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.140] lstrlenW (lpString="BD20013_.WMF") returned 12
	[0100.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0100.142] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=11058) returned 1
	[0100.142] CloseHandle (hObject=0x1cc) returned 1
	[0100.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20
	[0100.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0100.143] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.143] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0100.144] GetLastError () returned 0x0
	[0100.144] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2b32, lpOverlapped=0x0) returned 1
	[0100.162] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2b40, lpOverlapped=0x0) returned 1
	[0100.163] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.163] WriteFile (in: hFile=0x188, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.163] SetEndOfFile (hFile=0x188) returned 1
	[0100.163] CloseHandle (hObject=0x188) returned 1
	[0100.166] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.167] SetEndOfFile (hFile=0x1cc) returned 1
	[0100.167] CloseHandle (hObject=0x1cc) returned 1
	[0100.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1
	[0100.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0100.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0100.170] lstrlenW (lpString=".doc") returned 4
	[0100.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.170] lstrlenW (lpString=".docx") returned 5
	[0100.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.170] lstrlenW (lpString=".pdf") returned 4
	[0100.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.170] lstrlenW (lpString=".xls") returned 4
	[0100.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.170] lstrlenW (lpString=".xlsx") returned 5
	[0100.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.170] lstrlenW (lpString=".ppt") returned 4
	[0100.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0100.171] lstrlenW (lpString=".zip") returned 4
	[0100.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.171] lstrlenW (lpString=".rar") returned 4
	[0100.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.171] lstrlenW (lpString=".bz2") returned 4
	[0100.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.171] lstrlenW (lpString=".7z") returned 3
	[0100.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0100.171] lstrlenW (lpString=".dbf") returned 4
	[0100.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0100.171] lstrlenW (lpString=".1cd") returned 4
	[0100.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0100.171] lstrlenW (lpString=".jpg") returned 4
	[0100.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0100.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0100.171] lstrlenW (lpString=".doc") returned 4
	[0100.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.171] lstrlenW (lpString=".docx") returned 5
	[0100.171] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.171] lstrlenW (lpString=".pdf") returned 4
	[0100.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.171] lstrlenW (lpString=".xls") returned 4
	[0100.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.171] lstrlenW (lpString=".xlsx") returned 5
	[0100.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.172] lstrlenW (lpString=".ppt") returned 4
	[0100.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0100.172] lstrlenW (lpString=".zip") returned 4
	[0100.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.172] lstrlenW (lpString=".rar") returned 4
	[0100.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.172] lstrlenW (lpString=".bz2") returned 4
	[0100.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.172] lstrlenW (lpString=".7z") returned 3
	[0100.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0100.172] lstrlenW (lpString=".dbf") returned 4
	[0100.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0100.172] lstrlenW (lpString=".1cd") returned 4
	[0100.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0100.172] lstrlenW (lpString=".jpg") returned 4
	[0100.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.172] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.172] lstrlenW (lpString="BL00012_.WMF") returned 12
	[0100.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.183] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=9818) returned 1
	[0100.183] CloseHandle (hObject=0x164) returned 1
	[0100.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20
	[0100.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.197] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.197] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.200] GetLastError () returned 0x0
	[0100.201] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x265a, lpOverlapped=0x0) returned 1
	[0100.214] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2660, lpOverlapped=0x0) returned 1
	[0100.215] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.215] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.216] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.216] CloseHandle (hObject=0x1c0) returned 1
	[0100.216] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.216] SetEndOfFile (hFile=0x190) returned 1
	[0100.217] CloseHandle (hObject=0x190) returned 1
	[0100.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1
	[0100.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0100.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0100.218] lstrlenW (lpString=".doc") returned 4
	[0100.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.218] lstrlenW (lpString=".docx") returned 5
	[0100.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.218] lstrlenW (lpString=".pdf") returned 4
	[0100.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.218] lstrlenW (lpString=".xls") returned 4
	[0100.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.218] lstrlenW (lpString=".xlsx") returned 5
	[0100.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.218] lstrlenW (lpString=".ppt") returned 4
	[0100.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0100.218] lstrlenW (lpString=".zip") returned 4
	[0100.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.218] lstrlenW (lpString=".rar") returned 4
	[0100.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.218] lstrlenW (lpString=".bz2") returned 4
	[0100.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.218] lstrlenW (lpString=".7z") returned 3
	[0100.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0100.219] lstrlenW (lpString=".dbf") returned 4
	[0100.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0100.219] lstrlenW (lpString=".1cd") returned 4
	[0100.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0100.219] lstrlenW (lpString=".jpg") returned 4
	[0100.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0100.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0100.219] lstrlenW (lpString=".doc") returned 4
	[0100.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.219] lstrlenW (lpString=".docx") returned 5
	[0100.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.219] lstrlenW (lpString=".pdf") returned 4
	[0100.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.219] lstrlenW (lpString=".xls") returned 4
	[0100.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.219] lstrlenW (lpString=".xlsx") returned 5
	[0100.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.219] lstrlenW (lpString=".ppt") returned 4
	[0100.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0100.220] lstrlenW (lpString=".zip") returned 4
	[0100.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.220] lstrlenW (lpString=".rar") returned 4
	[0100.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.220] lstrlenW (lpString=".bz2") returned 4
	[0100.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.220] lstrlenW (lpString=".7z") returned 3
	[0100.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0100.220] lstrlenW (lpString=".dbf") returned 4
	[0100.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0100.220] lstrlenW (lpString=".1cd") returned 4
	[0100.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0100.220] lstrlenW (lpString=".jpg") returned 4
	[0100.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.220] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.220] lstrlenW (lpString="BL00098_.WMF") returned 12
	[0100.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.221] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1012) returned 1
	[0100.221] CloseHandle (hObject=0x190) returned 1
	[0100.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20
	[0100.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.222] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.222] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.226] GetLastError () returned 0x0
	[0100.226] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x3f4, lpOverlapped=0x0) returned 1
	[0100.235] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x400, lpOverlapped=0x0) returned 1
	[0100.237] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.237] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.237] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.237] CloseHandle (hObject=0x1c0) returned 1
	[0100.237] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.237] SetEndOfFile (hFile=0x190) returned 1
	[0100.238] CloseHandle (hObject=0x190) returned 1
	[0100.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1
	[0100.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0100.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0100.240] lstrlenW (lpString=".doc") returned 4
	[0100.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.240] lstrlenW (lpString=".docx") returned 5
	[0100.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.240] lstrlenW (lpString=".pdf") returned 4
	[0100.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.240] lstrlenW (lpString=".xls") returned 4
	[0100.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.241] lstrlenW (lpString=".xlsx") returned 5
	[0100.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.241] lstrlenW (lpString=".ppt") returned 4
	[0100.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0100.241] lstrlenW (lpString=".zip") returned 4
	[0100.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.241] lstrlenW (lpString=".rar") returned 4
	[0100.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.241] lstrlenW (lpString=".bz2") returned 4
	[0100.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.241] lstrlenW (lpString=".7z") returned 3
	[0100.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0100.241] lstrlenW (lpString=".dbf") returned 4
	[0100.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0100.241] lstrlenW (lpString=".1cd") returned 4
	[0100.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0100.241] lstrlenW (lpString=".jpg") returned 4
	[0100.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0100.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0100.242] lstrlenW (lpString=".doc") returned 4
	[0100.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.242] lstrlenW (lpString=".docx") returned 5
	[0100.242] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.242] lstrlenW (lpString=".pdf") returned 4
	[0100.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.242] lstrlenW (lpString=".xls") returned 4
	[0100.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.242] lstrlenW (lpString=".xlsx") returned 5
	[0100.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.242] lstrlenW (lpString=".ppt") returned 4
	[0100.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0100.242] lstrlenW (lpString=".zip") returned 4
	[0100.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.242] lstrlenW (lpString=".rar") returned 4
	[0100.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.242] lstrlenW (lpString=".bz2") returned 4
	[0100.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.242] lstrlenW (lpString=".7z") returned 3
	[0100.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0100.242] lstrlenW (lpString=".dbf") returned 4
	[0100.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0100.243] lstrlenW (lpString=".1cd") returned 4
	[0100.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0100.243] lstrlenW (lpString=".jpg") returned 4
	[0100.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.243] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.243] lstrlenW (lpString="BL00122_.WMF") returned 12
	[0100.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.248] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=10146) returned 1
	[0100.248] CloseHandle (hObject=0x190) returned 1
	[0100.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20
	[0100.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.255] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.255] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.329] GetLastError () returned 0x0
	[0100.329] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x27a2, lpOverlapped=0x0) returned 1
	[0100.376] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x27b0, lpOverlapped=0x0) returned 1
	[0100.377] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.378] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.378] SetEndOfFile (hFile=0x164) returned 1
	[0100.378] CloseHandle (hObject=0x164) returned 1
	[0100.378] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.378] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.379] CloseHandle (hObject=0x1c0) returned 1
	[0100.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1
	[0100.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0100.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0100.380] lstrlenW (lpString=".doc") returned 4
	[0100.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.380] lstrlenW (lpString=".docx") returned 5
	[0100.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.380] lstrlenW (lpString=".pdf") returned 4
	[0100.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.380] lstrlenW (lpString=".xls") returned 4
	[0100.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.380] lstrlenW (lpString=".xlsx") returned 5
	[0100.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.380] lstrlenW (lpString=".ppt") returned 4
	[0100.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0100.381] lstrlenW (lpString=".zip") returned 4
	[0100.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.381] lstrlenW (lpString=".rar") returned 4
	[0100.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.381] lstrlenW (lpString=".bz2") returned 4
	[0100.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.381] lstrlenW (lpString=".7z") returned 3
	[0100.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0100.381] lstrlenW (lpString=".dbf") returned 4
	[0100.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0100.381] lstrlenW (lpString=".1cd") returned 4
	[0100.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0100.381] lstrlenW (lpString=".jpg") returned 4
	[0100.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0100.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0100.382] lstrlenW (lpString=".doc") returned 4
	[0100.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.382] lstrlenW (lpString=".docx") returned 5
	[0100.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.382] lstrlenW (lpString=".pdf") returned 4
	[0100.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.382] lstrlenW (lpString=".xls") returned 4
	[0100.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.382] lstrlenW (lpString=".xlsx") returned 5
	[0100.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.382] lstrlenW (lpString=".ppt") returned 4
	[0100.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0100.382] lstrlenW (lpString=".zip") returned 4
	[0100.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.382] lstrlenW (lpString=".rar") returned 4
	[0100.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.383] lstrlenW (lpString=".bz2") returned 4
	[0100.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.383] lstrlenW (lpString=".7z") returned 3
	[0100.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0100.383] lstrlenW (lpString=".dbf") returned 4
	[0100.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0100.383] lstrlenW (lpString=".1cd") returned 4
	[0100.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0100.383] lstrlenW (lpString=".jpg") returned 4
	[0100.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.383] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.383] lstrlenW (lpString="BL00247_.WMF") returned 12
	[0100.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.384] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=14444) returned 1
	[0100.385] CloseHandle (hObject=0x1c0) returned 1
	[0100.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20
	[0100.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.385] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.385] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.386] GetLastError () returned 0x0
	[0100.386] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x386c, lpOverlapped=0x0) returned 1
	[0100.389] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3870, lpOverlapped=0x0) returned 1
	[0100.390] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.390] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.391] SetEndOfFile (hFile=0x164) returned 1
	[0100.391] CloseHandle (hObject=0x164) returned 1
	[0100.391] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.391] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.392] CloseHandle (hObject=0x1c0) returned 1
	[0100.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1
	[0100.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0100.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0100.393] lstrlenW (lpString=".doc") returned 4
	[0100.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.393] lstrlenW (lpString=".docx") returned 5
	[0100.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.393] lstrlenW (lpString=".pdf") returned 4
	[0100.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.393] lstrlenW (lpString=".xls") returned 4
	[0100.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.393] lstrlenW (lpString=".xlsx") returned 5
	[0100.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.394] lstrlenW (lpString=".ppt") returned 4
	[0100.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0100.394] lstrlenW (lpString=".zip") returned 4
	[0100.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.394] lstrlenW (lpString=".rar") returned 4
	[0100.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.394] lstrlenW (lpString=".bz2") returned 4
	[0100.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.394] lstrlenW (lpString=".7z") returned 3
	[0100.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0100.394] lstrlenW (lpString=".dbf") returned 4
	[0100.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0100.394] lstrlenW (lpString=".1cd") returned 4
	[0100.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0100.394] lstrlenW (lpString=".jpg") returned 4
	[0100.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0100.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0100.395] lstrlenW (lpString=".doc") returned 4
	[0100.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.395] lstrlenW (lpString=".docx") returned 5
	[0100.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.395] lstrlenW (lpString=".pdf") returned 4
	[0100.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.395] lstrlenW (lpString=".xls") returned 4
	[0100.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.395] lstrlenW (lpString=".xlsx") returned 5
	[0100.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.395] lstrlenW (lpString=".ppt") returned 4
	[0100.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0100.395] lstrlenW (lpString=".zip") returned 4
	[0100.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.395] lstrlenW (lpString=".rar") returned 4
	[0100.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.396] lstrlenW (lpString=".bz2") returned 4
	[0100.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.396] lstrlenW (lpString=".7z") returned 3
	[0100.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0100.396] lstrlenW (lpString=".dbf") returned 4
	[0100.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0100.396] lstrlenW (lpString=".1cd") returned 4
	[0100.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0100.396] lstrlenW (lpString=".jpg") returned 4
	[0100.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.396] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.396] lstrlenW (lpString="BL00248_.WMF") returned 12
	[0100.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.397] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1536) returned 1
	[0100.397] CloseHandle (hObject=0x1c0) returned 1
	[0100.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20
	[0100.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.398] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.398] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.399] GetLastError () returned 0x0
	[0100.399] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x600, lpOverlapped=0x0) returned 1
	[0100.400] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x610, lpOverlapped=0x0) returned 1
	[0100.402] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.402] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.402] SetEndOfFile (hFile=0x164) returned 1
	[0100.402] CloseHandle (hObject=0x164) returned 1
	[0100.402] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.402] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.403] CloseHandle (hObject=0x1c0) returned 1
	[0100.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1
	[0100.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0100.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0100.404] lstrlenW (lpString=".doc") returned 4
	[0100.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.404] lstrlenW (lpString=".docx") returned 5
	[0100.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.404] lstrlenW (lpString=".pdf") returned 4
	[0100.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.404] lstrlenW (lpString=".xls") returned 4
	[0100.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.404] lstrlenW (lpString=".xlsx") returned 5
	[0100.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.404] lstrlenW (lpString=".ppt") returned 4
	[0100.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0100.404] lstrlenW (lpString=".zip") returned 4
	[0100.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.404] lstrlenW (lpString=".rar") returned 4
	[0100.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.404] lstrlenW (lpString=".bz2") returned 4
	[0100.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.404] lstrlenW (lpString=".7z") returned 3
	[0100.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0100.404] lstrlenW (lpString=".dbf") returned 4
	[0100.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0100.405] lstrlenW (lpString=".1cd") returned 4
	[0100.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0100.405] lstrlenW (lpString=".jpg") returned 4
	[0100.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0100.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0100.405] lstrlenW (lpString=".doc") returned 4
	[0100.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.405] lstrlenW (lpString=".docx") returned 5
	[0100.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.405] lstrlenW (lpString=".pdf") returned 4
	[0100.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.405] lstrlenW (lpString=".xls") returned 4
	[0100.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.405] lstrlenW (lpString=".xlsx") returned 5
	[0100.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.405] lstrlenW (lpString=".ppt") returned 4
	[0100.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0100.405] lstrlenW (lpString=".zip") returned 4
	[0100.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.405] lstrlenW (lpString=".rar") returned 4
	[0100.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.405] lstrlenW (lpString=".bz2") returned 4
	[0100.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.406] lstrlenW (lpString=".7z") returned 3
	[0100.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0100.406] lstrlenW (lpString=".dbf") returned 4
	[0100.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0100.406] lstrlenW (lpString=".1cd") returned 4
	[0100.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0100.406] lstrlenW (lpString=".jpg") returned 4
	[0100.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.406] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.406] lstrlenW (lpString="BL00252_.WMF") returned 12
	[0100.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.407] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4708) returned 1
	[0100.407] CloseHandle (hObject=0x1c0) returned 1
	[0100.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20
	[0100.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.408] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.408] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.409] GetLastError () returned 0x0
	[0100.409] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1264, lpOverlapped=0x0) returned 1
	[0100.411] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1270, lpOverlapped=0x0) returned 1
	[0100.413] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.413] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.413] SetEndOfFile (hFile=0x164) returned 1
	[0100.413] CloseHandle (hObject=0x164) returned 1
	[0100.413] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.413] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.414] CloseHandle (hObject=0x1c0) returned 1
	[0100.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1
	[0100.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0100.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0100.415] lstrlenW (lpString=".doc") returned 4
	[0100.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.415] lstrlenW (lpString=".docx") returned 5
	[0100.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.415] lstrlenW (lpString=".pdf") returned 4
	[0100.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.415] lstrlenW (lpString=".xls") returned 4
	[0100.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.415] lstrlenW (lpString=".xlsx") returned 5
	[0100.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.415] lstrlenW (lpString=".ppt") returned 4
	[0100.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0100.415] lstrlenW (lpString=".zip") returned 4
	[0100.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.415] lstrlenW (lpString=".rar") returned 4
	[0100.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.415] lstrlenW (lpString=".bz2") returned 4
	[0100.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.415] lstrlenW (lpString=".7z") returned 3
	[0100.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0100.416] lstrlenW (lpString=".dbf") returned 4
	[0100.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0100.416] lstrlenW (lpString=".1cd") returned 4
	[0100.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0100.416] lstrlenW (lpString=".jpg") returned 4
	[0100.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0100.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0100.416] lstrlenW (lpString=".doc") returned 4
	[0100.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.416] lstrlenW (lpString=".docx") returned 5
	[0100.416] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.416] lstrlenW (lpString=".pdf") returned 4
	[0100.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.416] lstrlenW (lpString=".xls") returned 4
	[0100.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.416] lstrlenW (lpString=".xlsx") returned 5
	[0100.416] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.416] lstrlenW (lpString=".ppt") returned 4
	[0100.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0100.416] lstrlenW (lpString=".zip") returned 4
	[0100.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.417] lstrlenW (lpString=".rar") returned 4
	[0100.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.417] lstrlenW (lpString=".bz2") returned 4
	[0100.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.417] lstrlenW (lpString=".7z") returned 3
	[0100.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0100.417] lstrlenW (lpString=".dbf") returned 4
	[0100.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0100.417] lstrlenW (lpString=".1cd") returned 4
	[0100.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0100.417] lstrlenW (lpString=".jpg") returned 4
	[0100.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.417] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.417] lstrlenW (lpString="BL00254_.WMF") returned 12
	[0100.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.422] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1736) returned 1
	[0100.422] CloseHandle (hObject=0x1c0) returned 1
	[0100.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20
	[0100.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.429] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.429] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.430] GetLastError () returned 0x0
	[0100.430] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x6c8, lpOverlapped=0x0) returned 1
	[0100.432] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6d0, lpOverlapped=0x0) returned 1
	[0100.433] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.433] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.433] SetEndOfFile (hFile=0x174) returned 1
	[0100.433] CloseHandle (hObject=0x174) returned 1
	[0100.434] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.434] SetEndOfFile (hFile=0x190) returned 1
	[0100.435] CloseHandle (hObject=0x190) returned 1
	[0100.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1
	[0100.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0100.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0100.435] lstrlenW (lpString=".doc") returned 4
	[0100.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.435] lstrlenW (lpString=".docx") returned 5
	[0100.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.435] lstrlenW (lpString=".pdf") returned 4
	[0100.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.435] lstrlenW (lpString=".xls") returned 4
	[0100.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.435] lstrlenW (lpString=".xlsx") returned 5
	[0100.436] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.436] lstrlenW (lpString=".ppt") returned 4
	[0100.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0100.436] lstrlenW (lpString=".zip") returned 4
	[0100.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.436] lstrlenW (lpString=".rar") returned 4
	[0100.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.436] lstrlenW (lpString=".bz2") returned 4
	[0100.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.436] lstrlenW (lpString=".7z") returned 3
	[0100.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0100.436] lstrlenW (lpString=".dbf") returned 4
	[0100.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0100.436] lstrlenW (lpString=".1cd") returned 4
	[0100.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0100.436] lstrlenW (lpString=".jpg") returned 4
	[0100.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0100.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0100.436] lstrlenW (lpString=".doc") returned 4
	[0100.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.436] lstrlenW (lpString=".docx") returned 5
	[0100.436] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.437] lstrlenW (lpString=".pdf") returned 4
	[0100.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.437] lstrlenW (lpString=".xls") returned 4
	[0100.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.437] lstrlenW (lpString=".xlsx") returned 5
	[0100.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.437] lstrlenW (lpString=".ppt") returned 4
	[0100.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0100.437] lstrlenW (lpString=".zip") returned 4
	[0100.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.437] lstrlenW (lpString=".rar") returned 4
	[0100.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.437] lstrlenW (lpString=".bz2") returned 4
	[0100.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.437] lstrlenW (lpString=".7z") returned 3
	[0100.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0100.437] lstrlenW (lpString=".dbf") returned 4
	[0100.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0100.437] lstrlenW (lpString=".1cd") returned 4
	[0100.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0100.437] lstrlenW (lpString=".jpg") returned 4
	[0100.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.438] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.438] lstrlenW (lpString="BL00262_.WMF") returned 12
	[0100.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.439] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2556) returned 1
	[0100.439] CloseHandle (hObject=0x190) returned 1
	[0100.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20
	[0100.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.440] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.440] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.441] GetLastError () returned 0x0
	[0100.441] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x9fc, lpOverlapped=0x0) returned 1
	[0100.442] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa00, lpOverlapped=0x0) returned 1
	[0100.443] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.444] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.444] SetEndOfFile (hFile=0x174) returned 1
	[0100.444] CloseHandle (hObject=0x174) returned 1
	[0100.444] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.444] SetEndOfFile (hFile=0x190) returned 1
	[0100.445] CloseHandle (hObject=0x190) returned 1
	[0100.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1
	[0100.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0100.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0100.445] lstrlenW (lpString=".doc") returned 4
	[0100.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.446] lstrlenW (lpString=".docx") returned 5
	[0100.446] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.446] lstrlenW (lpString=".pdf") returned 4
	[0100.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.446] lstrlenW (lpString=".xls") returned 4
	[0100.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.446] lstrlenW (lpString=".xlsx") returned 5
	[0100.446] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.446] lstrlenW (lpString=".ppt") returned 4
	[0100.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0100.446] lstrlenW (lpString=".zip") returned 4
	[0100.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.446] lstrlenW (lpString=".rar") returned 4
	[0100.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.446] lstrlenW (lpString=".bz2") returned 4
	[0100.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.446] lstrlenW (lpString=".7z") returned 3
	[0100.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0100.446] lstrlenW (lpString=".dbf") returned 4
	[0100.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0100.446] lstrlenW (lpString=".1cd") returned 4
	[0100.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0100.446] lstrlenW (lpString=".jpg") returned 4
	[0100.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0100.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0100.447] lstrlenW (lpString=".doc") returned 4
	[0100.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.447] lstrlenW (lpString=".docx") returned 5
	[0100.447] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.447] lstrlenW (lpString=".pdf") returned 4
	[0100.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.447] lstrlenW (lpString=".xls") returned 4
	[0100.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.447] lstrlenW (lpString=".xlsx") returned 5
	[0100.447] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.447] lstrlenW (lpString=".ppt") returned 4
	[0100.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0100.447] lstrlenW (lpString=".zip") returned 4
	[0100.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.447] lstrlenW (lpString=".rar") returned 4
	[0100.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.447] lstrlenW (lpString=".bz2") returned 4
	[0100.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.447] lstrlenW (lpString=".7z") returned 3
	[0100.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0100.447] lstrlenW (lpString=".dbf") returned 4
	[0100.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0100.448] lstrlenW (lpString=".1cd") returned 4
	[0100.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0100.448] lstrlenW (lpString=".jpg") returned 4
	[0100.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.448] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.448] lstrlenW (lpString="BL00265_.WMF") returned 12
	[0100.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.449] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5752) returned 1
	[0100.449] CloseHandle (hObject=0x190) returned 1
	[0100.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20
	[0100.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.449] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.450] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.450] GetLastError () returned 0x0
	[0100.450] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1678, lpOverlapped=0x0) returned 1
	[0100.452] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1680, lpOverlapped=0x0) returned 1
	[0100.454] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.454] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.454] SetEndOfFile (hFile=0x174) returned 1
	[0100.454] CloseHandle (hObject=0x174) returned 1
	[0100.454] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.454] SetEndOfFile (hFile=0x190) returned 1
	[0100.455] CloseHandle (hObject=0x190) returned 1
	[0100.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 1
	[0100.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0100.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0100.456] lstrlenW (lpString=".doc") returned 4
	[0100.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.456] lstrlenW (lpString=".docx") returned 5
	[0100.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.456] lstrlenW (lpString=".pdf") returned 4
	[0100.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.456] lstrlenW (lpString=".xls") returned 4
	[0100.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.456] lstrlenW (lpString=".xlsx") returned 5
	[0100.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.456] lstrlenW (lpString=".ppt") returned 4
	[0100.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0100.456] lstrlenW (lpString=".zip") returned 4
	[0100.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.456] lstrlenW (lpString=".rar") returned 4
	[0100.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.457] lstrlenW (lpString=".bz2") returned 4
	[0100.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.457] lstrlenW (lpString=".7z") returned 3
	[0100.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0100.457] lstrlenW (lpString=".dbf") returned 4
	[0100.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0100.457] lstrlenW (lpString=".1cd") returned 4
	[0100.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0100.457] lstrlenW (lpString=".jpg") returned 4
	[0100.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0100.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0100.457] lstrlenW (lpString=".doc") returned 4
	[0100.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.457] lstrlenW (lpString=".docx") returned 5
	[0100.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.457] lstrlenW (lpString=".pdf") returned 4
	[0100.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.457] lstrlenW (lpString=".xls") returned 4
	[0100.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.457] lstrlenW (lpString=".xlsx") returned 5
	[0100.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.458] lstrlenW (lpString=".ppt") returned 4
	[0100.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0100.458] lstrlenW (lpString=".zip") returned 4
	[0100.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.458] lstrlenW (lpString=".rar") returned 4
	[0100.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.458] lstrlenW (lpString=".bz2") returned 4
	[0100.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.458] lstrlenW (lpString=".7z") returned 3
	[0100.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0100.458] lstrlenW (lpString=".dbf") returned 4
	[0100.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0100.458] lstrlenW (lpString=".1cd") returned 4
	[0100.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0100.458] lstrlenW (lpString=".jpg") returned 4
	[0100.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.458] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.458] lstrlenW (lpString="BL00267_.WMF") returned 12
	[0100.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.460] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2644) returned 1
	[0100.460] CloseHandle (hObject=0x190) returned 1
	[0100.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20
	[0100.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.460] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.460] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.461] GetLastError () returned 0x0
	[0100.461] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xa54, lpOverlapped=0x0) returned 1
	[0100.463] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa60, lpOverlapped=0x0) returned 1
	[0100.464] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.464] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.464] SetEndOfFile (hFile=0x174) returned 1
	[0100.464] CloseHandle (hObject=0x174) returned 1
	[0100.464] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.464] SetEndOfFile (hFile=0x190) returned 1
	[0100.465] CloseHandle (hObject=0x190) returned 1
	[0100.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1
	[0100.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0100.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0100.466] lstrlenW (lpString=".doc") returned 4
	[0100.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.466] lstrlenW (lpString=".docx") returned 5
	[0100.466] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.466] lstrlenW (lpString=".pdf") returned 4
	[0100.466] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.466] lstrlenW (lpString=".xls") returned 4
	[0100.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.466] lstrlenW (lpString=".xlsx") returned 5
	[0100.466] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.466] lstrlenW (lpString=".ppt") returned 4
	[0100.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0100.466] lstrlenW (lpString=".zip") returned 4
	[0100.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.467] lstrlenW (lpString=".rar") returned 4
	[0100.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.467] lstrlenW (lpString=".bz2") returned 4
	[0100.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.467] lstrlenW (lpString=".7z") returned 3
	[0100.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0100.467] lstrlenW (lpString=".dbf") returned 4
	[0100.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0100.467] lstrlenW (lpString=".1cd") returned 4
	[0100.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0100.467] lstrlenW (lpString=".jpg") returned 4
	[0100.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0100.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0100.467] lstrlenW (lpString=".doc") returned 4
	[0100.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.467] lstrlenW (lpString=".docx") returned 5
	[0100.467] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.467] lstrlenW (lpString=".pdf") returned 4
	[0100.467] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.467] lstrlenW (lpString=".xls") returned 4
	[0100.467] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.467] lstrlenW (lpString=".xlsx") returned 5
	[0100.467] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.468] lstrlenW (lpString=".ppt") returned 4
	[0100.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0100.468] lstrlenW (lpString=".zip") returned 4
	[0100.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.468] lstrlenW (lpString=".rar") returned 4
	[0100.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.468] lstrlenW (lpString=".bz2") returned 4
	[0100.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.468] lstrlenW (lpString=".7z") returned 3
	[0100.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0100.468] lstrlenW (lpString=".dbf") returned 4
	[0100.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0100.468] lstrlenW (lpString=".1cd") returned 4
	[0100.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0100.468] lstrlenW (lpString=".jpg") returned 4
	[0100.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.468] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.468] lstrlenW (lpString="BL00269_.WMF") returned 12
	[0100.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.482] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5272) returned 1
	[0100.482] CloseHandle (hObject=0x190) returned 1
	[0100.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20
	[0100.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.482] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.486] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.486] GetLastError () returned 0x0
	[0100.486] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1498, lpOverlapped=0x0) returned 1
	[0100.499] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x14a0, lpOverlapped=0x0) returned 1
	[0100.501] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.501] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.501] SetEndOfFile (hFile=0x174) returned 1
	[0100.501] CloseHandle (hObject=0x174) returned 1
	[0100.501] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.501] SetEndOfFile (hFile=0x190) returned 1
	[0100.502] CloseHandle (hObject=0x190) returned 1
	[0100.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 1
	[0100.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0100.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0100.503] lstrlenW (lpString=".doc") returned 4
	[0100.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.503] lstrlenW (lpString=".docx") returned 5
	[0100.503] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.503] lstrlenW (lpString=".pdf") returned 4
	[0100.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.503] lstrlenW (lpString=".xls") returned 4
	[0100.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.503] lstrlenW (lpString=".xlsx") returned 5
	[0100.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.504] lstrlenW (lpString=".ppt") returned 4
	[0100.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0100.504] lstrlenW (lpString=".zip") returned 4
	[0100.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.504] lstrlenW (lpString=".rar") returned 4
	[0100.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.504] lstrlenW (lpString=".bz2") returned 4
	[0100.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.504] lstrlenW (lpString=".7z") returned 3
	[0100.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0100.504] lstrlenW (lpString=".dbf") returned 4
	[0100.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0100.504] lstrlenW (lpString=".1cd") returned 4
	[0100.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0100.504] lstrlenW (lpString=".jpg") returned 4
	[0100.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0100.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0100.505] lstrlenW (lpString=".doc") returned 4
	[0100.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.505] lstrlenW (lpString=".docx") returned 5
	[0100.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.505] lstrlenW (lpString=".pdf") returned 4
	[0100.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.505] lstrlenW (lpString=".xls") returned 4
	[0100.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.505] lstrlenW (lpString=".xlsx") returned 5
	[0100.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.505] lstrlenW (lpString=".ppt") returned 4
	[0100.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0100.505] lstrlenW (lpString=".zip") returned 4
	[0100.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.506] lstrlenW (lpString=".rar") returned 4
	[0100.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.506] lstrlenW (lpString=".bz2") returned 4
	[0100.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.506] lstrlenW (lpString=".7z") returned 3
	[0100.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0100.506] lstrlenW (lpString=".dbf") returned 4
	[0100.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0100.506] lstrlenW (lpString=".1cd") returned 4
	[0100.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0100.506] lstrlenW (lpString=".jpg") returned 4
	[0100.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.506] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.507] lstrlenW (lpString="BL00274_.WMF") returned 12
	[0100.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.508] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4164) returned 1
	[0100.508] CloseHandle (hObject=0x190) returned 1
	[0100.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20
	[0100.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.508] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.508] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.509] GetLastError () returned 0x0
	[0100.509] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1044, lpOverlapped=0x0) returned 1
	[0100.511] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1050, lpOverlapped=0x0) returned 1
	[0100.516] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.516] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.516] SetEndOfFile (hFile=0x174) returned 1
	[0100.517] CloseHandle (hObject=0x174) returned 1
	[0100.517] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.517] SetEndOfFile (hFile=0x190) returned 1
	[0100.518] CloseHandle (hObject=0x190) returned 1
	[0100.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 1
	[0100.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0100.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0100.519] lstrlenW (lpString=".doc") returned 4
	[0100.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.519] lstrlenW (lpString=".docx") returned 5
	[0100.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.519] lstrlenW (lpString=".pdf") returned 4
	[0100.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.519] lstrlenW (lpString=".xls") returned 4
	[0100.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.519] lstrlenW (lpString=".xlsx") returned 5
	[0100.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.519] lstrlenW (lpString=".ppt") returned 4
	[0100.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0100.519] lstrlenW (lpString=".zip") returned 4
	[0100.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.520] lstrlenW (lpString=".rar") returned 4
	[0100.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.520] lstrlenW (lpString=".bz2") returned 4
	[0100.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.520] lstrlenW (lpString=".7z") returned 3
	[0100.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0100.520] lstrlenW (lpString=".dbf") returned 4
	[0100.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0100.520] lstrlenW (lpString=".1cd") returned 4
	[0100.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0100.520] lstrlenW (lpString=".jpg") returned 4
	[0100.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0100.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0100.520] lstrlenW (lpString=".doc") returned 4
	[0100.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.521] lstrlenW (lpString=".docx") returned 5
	[0100.521] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.521] lstrlenW (lpString=".pdf") returned 4
	[0100.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.521] lstrlenW (lpString=".xls") returned 4
	[0100.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.521] lstrlenW (lpString=".xlsx") returned 5
	[0100.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.521] lstrlenW (lpString=".ppt") returned 4
	[0100.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0100.521] lstrlenW (lpString=".zip") returned 4
	[0100.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.521] lstrlenW (lpString=".rar") returned 4
	[0100.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.521] lstrlenW (lpString=".bz2") returned 4
	[0100.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.521] lstrlenW (lpString=".7z") returned 3
	[0100.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0100.522] lstrlenW (lpString=".dbf") returned 4
	[0100.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0100.522] lstrlenW (lpString=".1cd") returned 4
	[0100.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0100.522] lstrlenW (lpString=".jpg") returned 4
	[0100.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.522] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.522] lstrlenW (lpString="BL00296_.WMF") returned 12
	[0100.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.523] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=812) returned 1
	[0100.523] CloseHandle (hObject=0x190) returned 1
	[0100.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20
	[0100.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0100.524] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.524] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.525] GetLastError () returned 0x0
	[0100.525] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x32c, lpOverlapped=0x0) returned 1
	[0100.526] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x330, lpOverlapped=0x0) returned 1
	[0100.528] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.528] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.528] SetEndOfFile (hFile=0x174) returned 1
	[0100.528] CloseHandle (hObject=0x174) returned 1
	[0100.528] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.528] SetEndOfFile (hFile=0x190) returned 1
	[0100.529] CloseHandle (hObject=0x190) returned 1
	[0100.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1
	[0100.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0100.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0100.530] lstrlenW (lpString=".doc") returned 4
	[0100.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.530] lstrlenW (lpString=".docx") returned 5
	[0100.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.530] lstrlenW (lpString=".pdf") returned 4
	[0100.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.530] lstrlenW (lpString=".xls") returned 4
	[0100.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.531] lstrlenW (lpString=".xlsx") returned 5
	[0100.531] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.531] lstrlenW (lpString=".ppt") returned 4
	[0100.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0100.531] lstrlenW (lpString=".zip") returned 4
	[0100.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.531] lstrlenW (lpString=".rar") returned 4
	[0100.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.531] lstrlenW (lpString=".bz2") returned 4
	[0100.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.531] lstrlenW (lpString=".7z") returned 3
	[0100.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0100.531] lstrlenW (lpString=".dbf") returned 4
	[0100.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0100.581] lstrlenW (lpString=".1cd") returned 4
	[0100.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0100.581] lstrlenW (lpString=".jpg") returned 4
	[0100.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0100.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0100.581] lstrlenW (lpString=".doc") returned 4
	[0100.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.582] lstrlenW (lpString=".docx") returned 5
	[0100.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.582] lstrlenW (lpString=".pdf") returned 4
	[0100.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.582] lstrlenW (lpString=".xls") returned 4
	[0100.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.582] lstrlenW (lpString=".xlsx") returned 5
	[0100.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.582] lstrlenW (lpString=".ppt") returned 4
	[0100.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0100.582] lstrlenW (lpString=".zip") returned 4
	[0100.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.582] lstrlenW (lpString=".rar") returned 4
	[0100.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.582] lstrlenW (lpString=".bz2") returned 4
	[0100.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.582] lstrlenW (lpString=".7z") returned 3
	[0100.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0100.582] lstrlenW (lpString=".dbf") returned 4
	[0100.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0100.582] lstrlenW (lpString=".1cd") returned 4
	[0100.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0100.583] lstrlenW (lpString=".jpg") returned 4
	[0100.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.583] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.583] lstrlenW (lpString="BL00525_.WMF") returned 12
	[0100.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.584] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=9590) returned 1
	[0100.584] CloseHandle (hObject=0x1c0) returned 1
	[0100.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20
	[0100.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.585] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.585] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.588] GetLastError () returned 0x0
	[0100.588] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2576, lpOverlapped=0x0) returned 1
	[0100.597] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2580, lpOverlapped=0x0) returned 1
	[0100.617] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.618] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.618] SetEndOfFile (hFile=0x164) returned 1
	[0100.618] CloseHandle (hObject=0x164) returned 1
	[0100.618] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.618] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.619] CloseHandle (hObject=0x1c0) returned 1
	[0100.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1
	[0100.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0100.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0100.620] lstrlenW (lpString=".doc") returned 4
	[0100.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.620] lstrlenW (lpString=".docx") returned 5
	[0100.620] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.620] lstrlenW (lpString=".pdf") returned 4
	[0100.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.620] lstrlenW (lpString=".xls") returned 4
	[0100.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.620] lstrlenW (lpString=".xlsx") returned 5
	[0100.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.620] lstrlenW (lpString=".ppt") returned 4
	[0100.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0100.620] lstrlenW (lpString=".zip") returned 4
	[0100.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.620] lstrlenW (lpString=".rar") returned 4
	[0100.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.621] lstrlenW (lpString=".bz2") returned 4
	[0100.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.621] lstrlenW (lpString=".7z") returned 3
	[0100.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0100.621] lstrlenW (lpString=".dbf") returned 4
	[0100.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0100.621] lstrlenW (lpString=".1cd") returned 4
	[0100.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0100.621] lstrlenW (lpString=".jpg") returned 4
	[0100.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0100.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0100.621] lstrlenW (lpString=".doc") returned 4
	[0100.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.621] lstrlenW (lpString=".docx") returned 5
	[0100.621] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.621] lstrlenW (lpString=".pdf") returned 4
	[0100.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.621] lstrlenW (lpString=".xls") returned 4
	[0100.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.622] lstrlenW (lpString=".xlsx") returned 5
	[0100.622] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.622] lstrlenW (lpString=".ppt") returned 4
	[0100.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0100.622] lstrlenW (lpString=".zip") returned 4
	[0100.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.622] lstrlenW (lpString=".rar") returned 4
	[0100.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.622] lstrlenW (lpString=".bz2") returned 4
	[0100.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.622] lstrlenW (lpString=".7z") returned 3
	[0100.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0100.622] lstrlenW (lpString=".dbf") returned 4
	[0100.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0100.622] lstrlenW (lpString=".1cd") returned 4
	[0100.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0100.622] lstrlenW (lpString=".jpg") returned 4
	[0100.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.623] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.623] lstrlenW (lpString="BL00648_.WMF") returned 12
	[0100.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.623] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=11500) returned 1
	[0100.624] CloseHandle (hObject=0x1c0) returned 1
	[0100.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20
	[0100.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.624] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.624] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.625] GetLastError () returned 0x0
	[0100.625] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2cec, lpOverlapped=0x0) returned 1
	[0100.705] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2cf0, lpOverlapped=0x0) returned 1
	[0100.706] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.706] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.706] SetEndOfFile (hFile=0x164) returned 1
	[0100.706] CloseHandle (hObject=0x164) returned 1
	[0100.706] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.707] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.708] CloseHandle (hObject=0x1c0) returned 1
	[0100.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1
	[0100.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0100.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0100.722] lstrlenW (lpString=".doc") returned 4
	[0100.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.722] lstrlenW (lpString=".docx") returned 5
	[0100.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.722] lstrlenW (lpString=".pdf") returned 4
	[0100.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.722] lstrlenW (lpString=".xls") returned 4
	[0100.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.722] lstrlenW (lpString=".xlsx") returned 5
	[0100.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.722] lstrlenW (lpString=".ppt") returned 4
	[0100.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0100.722] lstrlenW (lpString=".zip") returned 4
	[0100.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.722] lstrlenW (lpString=".rar") returned 4
	[0100.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.722] lstrlenW (lpString=".bz2") returned 4
	[0100.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.722] lstrlenW (lpString=".7z") returned 3
	[0100.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0100.723] lstrlenW (lpString=".dbf") returned 4
	[0100.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0100.723] lstrlenW (lpString=".1cd") returned 4
	[0100.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0100.723] lstrlenW (lpString=".jpg") returned 4
	[0100.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0100.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0100.723] lstrlenW (lpString=".doc") returned 4
	[0100.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.723] lstrlenW (lpString=".docx") returned 5
	[0100.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.723] lstrlenW (lpString=".pdf") returned 4
	[0100.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.723] lstrlenW (lpString=".xls") returned 4
	[0100.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.723] lstrlenW (lpString=".xlsx") returned 5
	[0100.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.723] lstrlenW (lpString=".ppt") returned 4
	[0100.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0100.723] lstrlenW (lpString=".zip") returned 4
	[0100.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.724] lstrlenW (lpString=".rar") returned 4
	[0100.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.724] lstrlenW (lpString=".bz2") returned 4
	[0100.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.724] lstrlenW (lpString=".7z") returned 3
	[0100.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0100.724] lstrlenW (lpString=".dbf") returned 4
	[0100.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0100.724] lstrlenW (lpString=".1cd") returned 4
	[0100.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0100.724] lstrlenW (lpString=".jpg") returned 4
	[0100.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.724] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.724] lstrlenW (lpString="BL00923_.WMF") returned 12
	[0100.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0100.735] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=6256) returned 1
	[0100.735] CloseHandle (hObject=0x164) returned 1
	[0100.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20
	[0100.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.801] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.801] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.810] GetLastError () returned 0x0
	[0100.810] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1870, lpOverlapped=0x0) returned 1
	[0100.821] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1880, lpOverlapped=0x0) returned 1
	[0100.822] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.822] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.822] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.823] CloseHandle (hObject=0x1c0) returned 1
	[0100.823] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.823] SetEndOfFile (hFile=0x174) returned 1
	[0100.824] CloseHandle (hObject=0x174) returned 1
	[0100.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1
	[0100.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0100.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0100.824] lstrlenW (lpString=".doc") returned 4
	[0100.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.825] lstrlenW (lpString=".docx") returned 5
	[0100.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.825] lstrlenW (lpString=".pdf") returned 4
	[0100.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.825] lstrlenW (lpString=".xls") returned 4
	[0100.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.825] lstrlenW (lpString=".xlsx") returned 5
	[0100.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.825] lstrlenW (lpString=".ppt") returned 4
	[0100.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0100.825] lstrlenW (lpString=".zip") returned 4
	[0100.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.825] lstrlenW (lpString=".rar") returned 4
	[0100.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.825] lstrlenW (lpString=".bz2") returned 4
	[0100.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.825] lstrlenW (lpString=".7z") returned 3
	[0100.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0100.825] lstrlenW (lpString=".dbf") returned 4
	[0100.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0100.825] lstrlenW (lpString=".1cd") returned 4
	[0100.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0100.826] lstrlenW (lpString=".jpg") returned 4
	[0100.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0100.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0100.826] lstrlenW (lpString=".doc") returned 4
	[0100.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.826] lstrlenW (lpString=".docx") returned 5
	[0100.826] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.826] lstrlenW (lpString=".pdf") returned 4
	[0100.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.826] lstrlenW (lpString=".xls") returned 4
	[0100.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.826] lstrlenW (lpString=".xlsx") returned 5
	[0100.826] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.826] lstrlenW (lpString=".ppt") returned 4
	[0100.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0100.826] lstrlenW (lpString=".zip") returned 4
	[0100.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.826] lstrlenW (lpString=".rar") returned 4
	[0100.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.826] lstrlenW (lpString=".bz2") returned 4
	[0100.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.826] lstrlenW (lpString=".7z") returned 3
	[0100.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0100.827] lstrlenW (lpString=".dbf") returned 4
	[0100.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0100.827] lstrlenW (lpString=".1cd") returned 4
	[0100.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0100.827] lstrlenW (lpString=".jpg") returned 4
	[0100.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.827] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.827] lstrlenW (lpString="BL00985_.WMF") returned 12
	[0100.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.829] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3768) returned 1
	[0100.829] CloseHandle (hObject=0x174) returned 1
	[0100.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20
	[0100.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.829] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.829] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.830] GetLastError () returned 0x0
	[0100.830] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xeb8, lpOverlapped=0x0) returned 1
	[0100.832] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec0, lpOverlapped=0x0) returned 1
	[0100.833] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.833] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.833] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.833] CloseHandle (hObject=0x1c0) returned 1
	[0100.834] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.834] SetEndOfFile (hFile=0x174) returned 1
	[0100.835] CloseHandle (hObject=0x174) returned 1
	[0100.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1
	[0100.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0100.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0100.835] lstrlenW (lpString=".doc") returned 4
	[0100.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.836] lstrlenW (lpString=".docx") returned 5
	[0100.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.836] lstrlenW (lpString=".pdf") returned 4
	[0100.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.836] lstrlenW (lpString=".xls") returned 4
	[0100.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.836] lstrlenW (lpString=".xlsx") returned 5
	[0100.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.836] lstrlenW (lpString=".ppt") returned 4
	[0100.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0100.836] lstrlenW (lpString=".zip") returned 4
	[0100.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.836] lstrlenW (lpString=".rar") returned 4
	[0100.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.836] lstrlenW (lpString=".bz2") returned 4
	[0100.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.836] lstrlenW (lpString=".7z") returned 3
	[0100.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0100.836] lstrlenW (lpString=".dbf") returned 4
	[0100.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0100.836] lstrlenW (lpString=".1cd") returned 4
	[0100.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0100.836] lstrlenW (lpString=".jpg") returned 4
	[0100.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0100.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0100.837] lstrlenW (lpString=".doc") returned 4
	[0100.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.837] lstrlenW (lpString=".docx") returned 5
	[0100.837] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.837] lstrlenW (lpString=".pdf") returned 4
	[0100.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.837] lstrlenW (lpString=".xls") returned 4
	[0100.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.837] lstrlenW (lpString=".xlsx") returned 5
	[0100.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.837] lstrlenW (lpString=".ppt") returned 4
	[0100.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0100.837] lstrlenW (lpString=".zip") returned 4
	[0100.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.837] lstrlenW (lpString=".rar") returned 4
	[0100.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.837] lstrlenW (lpString=".bz2") returned 4
	[0100.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.837] lstrlenW (lpString=".7z") returned 3
	[0100.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0100.837] lstrlenW (lpString=".dbf") returned 4
	[0100.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0100.838] lstrlenW (lpString=".1cd") returned 4
	[0100.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0100.838] lstrlenW (lpString=".jpg") returned 4
	[0100.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.838] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.838] lstrlenW (lpString="BOAT.WMF") returned 8
	[0100.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.839] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3350) returned 1
	[0100.839] CloseHandle (hObject=0x174) returned 1
	[0100.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20
	[0100.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.840] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.840] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.840] GetLastError () returned 0x0
	[0100.841] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xd16, lpOverlapped=0x0) returned 1
	[0100.856] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xd20, lpOverlapped=0x0) returned 1
	[0100.857] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.858] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0100.858] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.858] CloseHandle (hObject=0x1c0) returned 1
	[0100.858] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.858] SetEndOfFile (hFile=0x174) returned 1
	[0100.859] CloseHandle (hObject=0x174) returned 1
	[0100.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1
	[0100.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0100.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0100.860] lstrlenW (lpString=".doc") returned 4
	[0100.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.860] lstrlenW (lpString=".docx") returned 5
	[0100.860] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0100.860] lstrlenW (lpString=".pdf") returned 4
	[0100.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.860] lstrlenW (lpString=".xls") returned 4
	[0100.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.860] lstrlenW (lpString=".xlsx") returned 5
	[0100.860] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0100.860] lstrlenW (lpString=".ppt") returned 4
	[0100.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0100.860] lstrlenW (lpString=".zip") returned 4
	[0100.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.860] lstrlenW (lpString=".rar") returned 4
	[0100.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.860] lstrlenW (lpString=".bz2") returned 4
	[0100.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.861] lstrlenW (lpString=".7z") returned 3
	[0100.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0100.861] lstrlenW (lpString=".dbf") returned 4
	[0100.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0100.861] lstrlenW (lpString=".1cd") returned 4
	[0100.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0100.861] lstrlenW (lpString=".jpg") returned 4
	[0100.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0100.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0100.861] lstrlenW (lpString=".doc") returned 4
	[0100.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.861] lstrlenW (lpString=".docx") returned 5
	[0100.861] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0100.861] lstrlenW (lpString=".pdf") returned 4
	[0100.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.861] lstrlenW (lpString=".xls") returned 4
	[0100.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.861] lstrlenW (lpString=".xlsx") returned 5
	[0100.861] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0100.861] lstrlenW (lpString=".ppt") returned 4
	[0100.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0100.861] lstrlenW (lpString=".zip") returned 4
	[0100.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.862] lstrlenW (lpString=".rar") returned 4
	[0100.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.862] lstrlenW (lpString=".bz2") returned 4
	[0100.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.862] lstrlenW (lpString=".7z") returned 3
	[0100.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0100.862] lstrlenW (lpString=".dbf") returned 4
	[0100.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0100.862] lstrlenW (lpString=".1cd") returned 4
	[0100.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0100.862] lstrlenW (lpString=".jpg") returned 4
	[0100.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.862] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.862] lstrlenW (lpString="BS00076_.WMF") returned 12
	[0100.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.863] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1330) returned 1
	[0100.863] CloseHandle (hObject=0x174) returned 1
	[0100.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20
	[0100.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0100.863] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.864] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0100.864] GetLastError () returned 0x0
	[0100.864] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x532, lpOverlapped=0x0) returned 1
	[0100.873] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x540, lpOverlapped=0x0) returned 1
	[0100.874] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.875] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.875] SetEndOfFile (hFile=0x1c0) returned 1
	[0100.875] CloseHandle (hObject=0x1c0) returned 1
	[0100.875] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.875] SetEndOfFile (hFile=0x174) returned 1
	[0100.876] CloseHandle (hObject=0x174) returned 1
	[0100.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 1
	[0100.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0100.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0100.877] lstrlenW (lpString=".doc") returned 4
	[0100.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.878] lstrlenW (lpString=".docx") returned 5
	[0100.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.878] lstrlenW (lpString=".pdf") returned 4
	[0100.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.878] lstrlenW (lpString=".xls") returned 4
	[0100.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.878] lstrlenW (lpString=".xlsx") returned 5
	[0100.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.878] lstrlenW (lpString=".ppt") returned 4
	[0100.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0100.878] lstrlenW (lpString=".zip") returned 4
	[0100.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.878] lstrlenW (lpString=".rar") returned 4
	[0100.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.878] lstrlenW (lpString=".bz2") returned 4
	[0100.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.878] lstrlenW (lpString=".7z") returned 3
	[0100.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0100.878] lstrlenW (lpString=".dbf") returned 4
	[0100.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0100.878] lstrlenW (lpString=".1cd") returned 4
	[0100.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0100.879] lstrlenW (lpString=".jpg") returned 4
	[0100.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0100.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0100.879] lstrlenW (lpString=".doc") returned 4
	[0100.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.879] lstrlenW (lpString=".docx") returned 5
	[0100.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.879] lstrlenW (lpString=".pdf") returned 4
	[0100.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.879] lstrlenW (lpString=".xls") returned 4
	[0100.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.879] lstrlenW (lpString=".xlsx") returned 5
	[0100.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.879] lstrlenW (lpString=".ppt") returned 4
	[0100.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0100.879] lstrlenW (lpString=".zip") returned 4
	[0100.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.879] lstrlenW (lpString=".rar") returned 4
	[0100.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.879] lstrlenW (lpString=".bz2") returned 4
	[0100.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.879] lstrlenW (lpString=".7z") returned 3
	[0100.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0100.880] lstrlenW (lpString=".dbf") returned 4
	[0100.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0100.880] lstrlenW (lpString=".1cd") returned 4
	[0100.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0100.880] lstrlenW (lpString=".jpg") returned 4
	[0100.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.880] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.880] lstrlenW (lpString="BS00092_.WMF") returned 12
	[0100.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.889] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7974) returned 1
	[0100.889] CloseHandle (hObject=0x184) returned 1
	[0100.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20
	[0100.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0100.897] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.897] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0100.921] GetLastError () returned 0x0
	[0100.921] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1f26, lpOverlapped=0x0) returned 1
	[0100.950] WriteFile (in: hFile=0x1a4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1f30, lpOverlapped=0x0) returned 1
	[0100.952] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.952] WriteFile (in: hFile=0x1a4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.952] SetEndOfFile (hFile=0x1a4) returned 1
	[0100.952] CloseHandle (hObject=0x1a4) returned 1
	[0100.952] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.952] SetEndOfFile (hFile=0x19c) returned 1
	[0100.953] CloseHandle (hObject=0x19c) returned 1
	[0100.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0100.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 1
	[0100.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0100.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0100.954] lstrlenW (lpString=".doc") returned 4
	[0100.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.954] lstrlenW (lpString=".docx") returned 5
	[0100.954] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.954] lstrlenW (lpString=".pdf") returned 4
	[0100.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.954] lstrlenW (lpString=".xls") returned 4
	[0100.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.954] lstrlenW (lpString=".xlsx") returned 5
	[0100.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.955] lstrlenW (lpString=".ppt") returned 4
	[0100.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0100.955] lstrlenW (lpString=".zip") returned 4
	[0100.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.955] lstrlenW (lpString=".rar") returned 4
	[0100.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.955] lstrlenW (lpString=".bz2") returned 4
	[0100.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.955] lstrlenW (lpString=".7z") returned 3
	[0100.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0100.955] lstrlenW (lpString=".dbf") returned 4
	[0100.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0100.955] lstrlenW (lpString=".1cd") returned 4
	[0100.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0100.955] lstrlenW (lpString=".jpg") returned 4
	[0100.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0100.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0100.956] lstrlenW (lpString=".doc") returned 4
	[0100.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0100.956] lstrlenW (lpString=".docx") returned 5
	[0100.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0100.956] lstrlenW (lpString=".pdf") returned 4
	[0100.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0100.956] lstrlenW (lpString=".xls") returned 4
	[0100.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0100.956] lstrlenW (lpString=".xlsx") returned 5
	[0100.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0100.956] lstrlenW (lpString=".ppt") returned 4
	[0100.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0100.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0100.956] lstrlenW (lpString=".zip") returned 4
	[0100.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0100.956] lstrlenW (lpString=".rar") returned 4
	[0100.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0100.956] lstrlenW (lpString=".bz2") returned 4
	[0100.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0100.956] lstrlenW (lpString=".7z") returned 3
	[0100.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0100.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0100.957] lstrlenW (lpString=".dbf") returned 4
	[0100.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0100.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0100.957] lstrlenW (lpString=".1cd") returned 4
	[0100.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0100.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0100.957] lstrlenW (lpString=".jpg") returned 4
	[0100.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0100.957] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0100.957] lstrlenW (lpString="BS00136_.WMF") returned 12
	[0100.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0100.958] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2166) returned 1
	[0100.958] CloseHandle (hObject=0x19c) returned 1
	[0100.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20
	[0100.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0100.959] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.959] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0100.960] GetLastError () returned 0x0
	[0100.960] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x876, lpOverlapped=0x0) returned 1
	[0101.024] WriteFile (in: hFile=0x1a4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x880, lpOverlapped=0x0) returned 1
	[0101.026] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.026] WriteFile (in: hFile=0x1a4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.026] SetEndOfFile (hFile=0x1a4) returned 1
	[0101.026] CloseHandle (hObject=0x1a4) returned 1
	[0101.026] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.027] SetEndOfFile (hFile=0x19c) returned 1
	[0101.028] CloseHandle (hObject=0x19c) returned 1
	[0101.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 1
	[0101.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0101.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0101.032] lstrlenW (lpString=".doc") returned 4
	[0101.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.032] lstrlenW (lpString=".docx") returned 5
	[0101.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.032] lstrlenW (lpString=".pdf") returned 4
	[0101.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.032] lstrlenW (lpString=".xls") returned 4
	[0101.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.032] lstrlenW (lpString=".xlsx") returned 5
	[0101.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.032] lstrlenW (lpString=".ppt") returned 4
	[0101.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0101.032] lstrlenW (lpString=".zip") returned 4
	[0101.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.032] lstrlenW (lpString=".rar") returned 4
	[0101.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.032] lstrlenW (lpString=".bz2") returned 4
	[0101.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.032] lstrlenW (lpString=".7z") returned 3
	[0101.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0101.033] lstrlenW (lpString=".dbf") returned 4
	[0101.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0101.033] lstrlenW (lpString=".1cd") returned 4
	[0101.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0101.033] lstrlenW (lpString=".jpg") returned 4
	[0101.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0101.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0101.033] lstrlenW (lpString=".doc") returned 4
	[0101.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.033] lstrlenW (lpString=".docx") returned 5
	[0101.033] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.033] lstrlenW (lpString=".pdf") returned 4
	[0101.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.033] lstrlenW (lpString=".xls") returned 4
	[0101.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.033] lstrlenW (lpString=".xlsx") returned 5
	[0101.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.033] lstrlenW (lpString=".ppt") returned 4
	[0101.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0101.034] lstrlenW (lpString=".zip") returned 4
	[0101.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.034] lstrlenW (lpString=".rar") returned 4
	[0101.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.034] lstrlenW (lpString=".bz2") returned 4
	[0101.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.034] lstrlenW (lpString=".7z") returned 3
	[0101.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0101.034] lstrlenW (lpString=".dbf") returned 4
	[0101.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0101.034] lstrlenW (lpString=".1cd") returned 4
	[0101.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0101.034] lstrlenW (lpString=".jpg") returned 4
	[0101.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.034] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.034] lstrlenW (lpString="BS00200_.WMF") returned 12
	[0101.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0101.057] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3104) returned 1
	[0101.057] CloseHandle (hObject=0x188) returned 1
	[0101.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20
	[0101.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0101.067] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.067] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0101.071] GetLastError () returned 0x0
	[0101.071] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xc20, lpOverlapped=0x0) returned 1
	[0101.114] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xc30, lpOverlapped=0x0) returned 1
	[0101.115] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.116] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.116] SetEndOfFile (hFile=0x1b0) returned 1
	[0101.116] CloseHandle (hObject=0x1b0) returned 1
	[0101.116] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.116] SetEndOfFile (hFile=0x170) returned 1
	[0101.117] CloseHandle (hObject=0x170) returned 1
	[0101.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 1
	[0101.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0101.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0101.117] lstrlenW (lpString=".doc") returned 4
	[0101.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.117] lstrlenW (lpString=".docx") returned 5
	[0101.117] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.118] lstrlenW (lpString=".pdf") returned 4
	[0101.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.118] lstrlenW (lpString=".xls") returned 4
	[0101.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.118] lstrlenW (lpString=".xlsx") returned 5
	[0101.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.118] lstrlenW (lpString=".ppt") returned 4
	[0101.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0101.118] lstrlenW (lpString=".zip") returned 4
	[0101.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.118] lstrlenW (lpString=".rar") returned 4
	[0101.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.118] lstrlenW (lpString=".bz2") returned 4
	[0101.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.118] lstrlenW (lpString=".7z") returned 3
	[0101.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0101.118] lstrlenW (lpString=".dbf") returned 4
	[0101.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0101.118] lstrlenW (lpString=".1cd") returned 4
	[0101.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0101.118] lstrlenW (lpString=".jpg") returned 4
	[0101.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0101.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0101.118] lstrlenW (lpString=".doc") returned 4
	[0101.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.118] lstrlenW (lpString=".docx") returned 5
	[0101.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.119] lstrlenW (lpString=".pdf") returned 4
	[0101.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.119] lstrlenW (lpString=".xls") returned 4
	[0101.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.119] lstrlenW (lpString=".xlsx") returned 5
	[0101.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.119] lstrlenW (lpString=".ppt") returned 4
	[0101.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0101.119] lstrlenW (lpString=".zip") returned 4
	[0101.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.119] lstrlenW (lpString=".rar") returned 4
	[0101.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.119] lstrlenW (lpString=".bz2") returned 4
	[0101.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.119] lstrlenW (lpString=".7z") returned 3
	[0101.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0101.119] lstrlenW (lpString=".dbf") returned 4
	[0101.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0101.119] lstrlenW (lpString=".1cd") returned 4
	[0101.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0101.119] lstrlenW (lpString=".jpg") returned 4
	[0101.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.119] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.120] lstrlenW (lpString="BS00438_.WMF") returned 12
	[0101.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0101.120] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1212) returned 1
	[0101.120] CloseHandle (hObject=0x170) returned 1
	[0101.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20
	[0101.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0101.121] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.121] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0101.122] GetLastError () returned 0x0
	[0101.122] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x4bc, lpOverlapped=0x0) returned 1
	[0101.130] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4c0, lpOverlapped=0x0) returned 1
	[0101.131] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.131] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.131] SetEndOfFile (hFile=0x1b0) returned 1
	[0101.132] CloseHandle (hObject=0x1b0) returned 1
	[0101.132] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.132] SetEndOfFile (hFile=0x170) returned 1
	[0101.133] CloseHandle (hObject=0x170) returned 1
	[0101.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 1
	[0101.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0101.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0101.134] lstrlenW (lpString=".doc") returned 4
	[0101.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.134] lstrlenW (lpString=".docx") returned 5
	[0101.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.134] lstrlenW (lpString=".pdf") returned 4
	[0101.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.134] lstrlenW (lpString=".xls") returned 4
	[0101.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.134] lstrlenW (lpString=".xlsx") returned 5
	[0101.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.134] lstrlenW (lpString=".ppt") returned 4
	[0101.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0101.134] lstrlenW (lpString=".zip") returned 4
	[0101.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.134] lstrlenW (lpString=".rar") returned 4
	[0101.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.134] lstrlenW (lpString=".bz2") returned 4
	[0101.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.134] lstrlenW (lpString=".7z") returned 3
	[0101.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0101.134] lstrlenW (lpString=".dbf") returned 4
	[0101.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0101.134] lstrlenW (lpString=".1cd") returned 4
	[0101.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0101.135] lstrlenW (lpString=".jpg") returned 4
	[0101.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0101.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0101.135] lstrlenW (lpString=".doc") returned 4
	[0101.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.135] lstrlenW (lpString=".docx") returned 5
	[0101.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.135] lstrlenW (lpString=".pdf") returned 4
	[0101.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.135] lstrlenW (lpString=".xls") returned 4
	[0101.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.135] lstrlenW (lpString=".xlsx") returned 5
	[0101.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.135] lstrlenW (lpString=".ppt") returned 4
	[0101.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0101.135] lstrlenW (lpString=".zip") returned 4
	[0101.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.135] lstrlenW (lpString=".rar") returned 4
	[0101.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.135] lstrlenW (lpString=".bz2") returned 4
	[0101.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.135] lstrlenW (lpString=".7z") returned 3
	[0101.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0101.136] lstrlenW (lpString=".dbf") returned 4
	[0101.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0101.136] lstrlenW (lpString=".1cd") returned 4
	[0101.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0101.136] lstrlenW (lpString=".jpg") returned 4
	[0101.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.136] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.136] lstrlenW (lpString="BS00440_.WMF") returned 12
	[0101.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0101.139] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5580) returned 1
	[0101.139] CloseHandle (hObject=0x170) returned 1
	[0101.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20
	[0101.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0101.169] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.169] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0101.183] GetLastError () returned 0x0
	[0101.183] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x15cc, lpOverlapped=0x0) returned 1
	[0101.206] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x15d0, lpOverlapped=0x0) returned 1
	[0101.207] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.207] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.207] SetEndOfFile (hFile=0x1a0) returned 1
	[0101.207] CloseHandle (hObject=0x1a0) returned 1
	[0101.207] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.207] SetEndOfFile (hFile=0x1cc) returned 1
	[0101.208] CloseHandle (hObject=0x1cc) returned 1
	[0101.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 1
	[0101.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0101.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0101.209] lstrlenW (lpString=".doc") returned 4
	[0101.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.209] lstrlenW (lpString=".docx") returned 5
	[0101.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.209] lstrlenW (lpString=".pdf") returned 4
	[0101.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.209] lstrlenW (lpString=".xls") returned 4
	[0101.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.209] lstrlenW (lpString=".xlsx") returned 5
	[0101.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.209] lstrlenW (lpString=".ppt") returned 4
	[0101.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0101.209] lstrlenW (lpString=".zip") returned 4
	[0101.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.209] lstrlenW (lpString=".rar") returned 4
	[0101.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.209] lstrlenW (lpString=".bz2") returned 4
	[0101.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.209] lstrlenW (lpString=".7z") returned 3
	[0101.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0101.209] lstrlenW (lpString=".dbf") returned 4
	[0101.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0101.210] lstrlenW (lpString=".1cd") returned 4
	[0101.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0101.210] lstrlenW (lpString=".jpg") returned 4
	[0101.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0101.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0101.210] lstrlenW (lpString=".doc") returned 4
	[0101.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.210] lstrlenW (lpString=".docx") returned 5
	[0101.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.210] lstrlenW (lpString=".pdf") returned 4
	[0101.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.210] lstrlenW (lpString=".xls") returned 4
	[0101.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.210] lstrlenW (lpString=".xlsx") returned 5
	[0101.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.210] lstrlenW (lpString=".ppt") returned 4
	[0101.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0101.210] lstrlenW (lpString=".zip") returned 4
	[0101.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.210] lstrlenW (lpString=".rar") returned 4
	[0101.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.210] lstrlenW (lpString=".bz2") returned 4
	[0101.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.210] lstrlenW (lpString=".7z") returned 3
	[0101.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0101.210] lstrlenW (lpString=".dbf") returned 4
	[0101.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0101.211] lstrlenW (lpString=".1cd") returned 4
	[0101.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0101.211] lstrlenW (lpString=".jpg") returned 4
	[0101.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.211] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.211] lstrlenW (lpString="BS00442_.WMF") returned 12
	[0101.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0101.212] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2488) returned 1
	[0101.212] CloseHandle (hObject=0x1cc) returned 1
	[0101.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20
	[0101.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0101.212] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.212] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0101.213] GetLastError () returned 0x0
	[0101.213] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x9b8, lpOverlapped=0x0) returned 1
	[0101.265] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x9c0, lpOverlapped=0x0) returned 1
	[0101.266] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.267] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.267] SetEndOfFile (hFile=0x1a0) returned 1
	[0101.267] CloseHandle (hObject=0x1a0) returned 1
	[0101.267] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.267] SetEndOfFile (hFile=0x1cc) returned 1
	[0101.268] CloseHandle (hObject=0x1cc) returned 1
	[0101.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 1
	[0101.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0101.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0101.268] lstrlenW (lpString=".doc") returned 4
	[0101.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.268] lstrlenW (lpString=".docx") returned 5
	[0101.268] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.268] lstrlenW (lpString=".pdf") returned 4
	[0101.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.269] lstrlenW (lpString=".xls") returned 4
	[0101.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.269] lstrlenW (lpString=".xlsx") returned 5
	[0101.269] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.269] lstrlenW (lpString=".ppt") returned 4
	[0101.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0101.269] lstrlenW (lpString=".zip") returned 4
	[0101.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.269] lstrlenW (lpString=".rar") returned 4
	[0101.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.269] lstrlenW (lpString=".bz2") returned 4
	[0101.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.269] lstrlenW (lpString=".7z") returned 3
	[0101.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0101.269] lstrlenW (lpString=".dbf") returned 4
	[0101.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0101.269] lstrlenW (lpString=".1cd") returned 4
	[0101.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0101.269] lstrlenW (lpString=".jpg") returned 4
	[0101.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0101.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0101.269] lstrlenW (lpString=".doc") returned 4
	[0101.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.270] lstrlenW (lpString=".docx") returned 5
	[0101.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.270] lstrlenW (lpString=".pdf") returned 4
	[0101.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.270] lstrlenW (lpString=".xls") returned 4
	[0101.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.270] lstrlenW (lpString=".xlsx") returned 5
	[0101.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.270] lstrlenW (lpString=".ppt") returned 4
	[0101.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0101.270] lstrlenW (lpString=".zip") returned 4
	[0101.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.270] lstrlenW (lpString=".rar") returned 4
	[0101.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.270] lstrlenW (lpString=".bz2") returned 4
	[0101.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.270] lstrlenW (lpString=".7z") returned 3
	[0101.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0101.270] lstrlenW (lpString=".dbf") returned 4
	[0101.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0101.270] lstrlenW (lpString=".1cd") returned 4
	[0101.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0101.270] lstrlenW (lpString=".jpg") returned 4
	[0101.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.271] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.271] lstrlenW (lpString="BS00444_.WMF") returned 12
	[0101.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0101.376] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3896) returned 1
	[0101.376] CloseHandle (hObject=0x190) returned 1
	[0101.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20
	[0101.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0101.384] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.384] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0101.385] GetLastError () returned 0x0
	[0101.386] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xf38, lpOverlapped=0x0) returned 1
	[0101.389] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf40, lpOverlapped=0x0) returned 1
	[0101.390] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.390] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.390] SetEndOfFile (hFile=0x164) returned 1
	[0101.390] CloseHandle (hObject=0x164) returned 1
	[0101.391] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.391] SetEndOfFile (hFile=0x190) returned 1
	[0101.392] CloseHandle (hObject=0x190) returned 1
	[0101.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 1
	[0101.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0101.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0101.392] lstrlenW (lpString=".doc") returned 4
	[0101.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.392] lstrlenW (lpString=".docx") returned 5
	[0101.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.392] lstrlenW (lpString=".pdf") returned 4
	[0101.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.392] lstrlenW (lpString=".xls") returned 4
	[0101.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.392] lstrlenW (lpString=".xlsx") returned 5
	[0101.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.392] lstrlenW (lpString=".ppt") returned 4
	[0101.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0101.393] lstrlenW (lpString=".zip") returned 4
	[0101.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.393] lstrlenW (lpString=".rar") returned 4
	[0101.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.393] lstrlenW (lpString=".bz2") returned 4
	[0101.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.393] lstrlenW (lpString=".7z") returned 3
	[0101.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0101.393] lstrlenW (lpString=".dbf") returned 4
	[0101.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0101.393] lstrlenW (lpString=".1cd") returned 4
	[0101.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0101.393] lstrlenW (lpString=".jpg") returned 4
	[0101.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0101.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0101.393] lstrlenW (lpString=".doc") returned 4
	[0101.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.393] lstrlenW (lpString=".docx") returned 5
	[0101.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.393] lstrlenW (lpString=".pdf") returned 4
	[0101.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.394] lstrlenW (lpString=".xls") returned 4
	[0101.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.394] lstrlenW (lpString=".xlsx") returned 5
	[0101.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.394] lstrlenW (lpString=".ppt") returned 4
	[0101.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0101.394] lstrlenW (lpString=".zip") returned 4
	[0101.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.394] lstrlenW (lpString=".rar") returned 4
	[0101.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.394] lstrlenW (lpString=".bz2") returned 4
	[0101.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.394] lstrlenW (lpString=".7z") returned 3
	[0101.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0101.394] lstrlenW (lpString=".dbf") returned 4
	[0101.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0101.394] lstrlenW (lpString=".1cd") returned 4
	[0101.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0101.394] lstrlenW (lpString=".jpg") returned 4
	[0101.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.394] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.395] lstrlenW (lpString="BS00453_.WMF") returned 12
	[0101.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0101.395] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2436) returned 1
	[0101.395] CloseHandle (hObject=0x190) returned 1
	[0101.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20
	[0101.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0101.396] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.396] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0101.397] GetLastError () returned 0x0
	[0101.397] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x984, lpOverlapped=0x0) returned 1
	[0101.411] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x990, lpOverlapped=0x0) returned 1
	[0101.412] ReadFile (in: hFile=0x190, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.412] WriteFile (in: hFile=0x164, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.412] SetEndOfFile (hFile=0x164) returned 1
	[0101.412] CloseHandle (hObject=0x164) returned 1
	[0101.412] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.412] SetEndOfFile (hFile=0x190) returned 1
	[0101.413] CloseHandle (hObject=0x190) returned 1
	[0101.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 1
	[0101.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0101.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0101.414] lstrlenW (lpString=".doc") returned 4
	[0101.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.414] lstrlenW (lpString=".docx") returned 5
	[0101.414] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.414] lstrlenW (lpString=".pdf") returned 4
	[0101.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.414] lstrlenW (lpString=".xls") returned 4
	[0101.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.414] lstrlenW (lpString=".xlsx") returned 5
	[0101.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.414] lstrlenW (lpString=".ppt") returned 4
	[0101.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0101.414] lstrlenW (lpString=".zip") returned 4
	[0101.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.414] lstrlenW (lpString=".rar") returned 4
	[0101.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.415] lstrlenW (lpString=".bz2") returned 4
	[0101.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.415] lstrlenW (lpString=".7z") returned 3
	[0101.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0101.415] lstrlenW (lpString=".dbf") returned 4
	[0101.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0101.415] lstrlenW (lpString=".1cd") returned 4
	[0101.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0101.415] lstrlenW (lpString=".jpg") returned 4
	[0101.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0101.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0101.415] lstrlenW (lpString=".doc") returned 4
	[0101.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.415] lstrlenW (lpString=".docx") returned 5
	[0101.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.415] lstrlenW (lpString=".pdf") returned 4
	[0101.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.415] lstrlenW (lpString=".xls") returned 4
	[0101.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.415] lstrlenW (lpString=".xlsx") returned 5
	[0101.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.415] lstrlenW (lpString=".ppt") returned 4
	[0101.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0101.415] lstrlenW (lpString=".zip") returned 4
	[0101.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.415] lstrlenW (lpString=".rar") returned 4
	[0101.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.415] lstrlenW (lpString=".bz2") returned 4
	[0101.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.416] lstrlenW (lpString=".7z") returned 3
	[0101.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0101.416] lstrlenW (lpString=".dbf") returned 4
	[0101.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0101.416] lstrlenW (lpString=".1cd") returned 4
	[0101.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0101.416] lstrlenW (lpString=".jpg") returned 4
	[0101.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.416] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.416] lstrlenW (lpString="BS01603_.WMF") returned 12
	[0101.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0101.587] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7176) returned 1
	[0101.587] CloseHandle (hObject=0x160) returned 1
	[0101.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20
	[0101.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0101.608] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.608] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0101.613] GetLastError () returned 0x0
	[0101.613] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1c08, lpOverlapped=0x0) returned 1
	[0101.614] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1c10, lpOverlapped=0x0) returned 1
	[0101.615] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.615] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.615] SetEndOfFile (hFile=0x1cc) returned 1
	[0101.617] CloseHandle (hObject=0x1cc) returned 1
	[0101.618] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.618] SetEndOfFile (hFile=0x170) returned 1
	[0101.620] CloseHandle (hObject=0x170) returned 1
	[0101.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 1
	[0101.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0101.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0101.635] lstrlenW (lpString=".doc") returned 4
	[0101.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.635] lstrlenW (lpString=".docx") returned 5
	[0101.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.636] lstrlenW (lpString=".pdf") returned 4
	[0101.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.636] lstrlenW (lpString=".xls") returned 4
	[0101.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.636] lstrlenW (lpString=".xlsx") returned 5
	[0101.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.636] lstrlenW (lpString=".ppt") returned 4
	[0101.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0101.637] lstrlenW (lpString=".zip") returned 4
	[0101.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.637] lstrlenW (lpString=".rar") returned 4
	[0101.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.637] lstrlenW (lpString=".bz2") returned 4
	[0101.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.637] lstrlenW (lpString=".7z") returned 3
	[0101.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0101.637] lstrlenW (lpString=".dbf") returned 4
	[0101.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0101.637] lstrlenW (lpString=".1cd") returned 4
	[0101.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0101.637] lstrlenW (lpString=".jpg") returned 4
	[0101.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0101.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0101.637] lstrlenW (lpString=".doc") returned 4
	[0101.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.637] lstrlenW (lpString=".docx") returned 5
	[0101.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.637] lstrlenW (lpString=".pdf") returned 4
	[0101.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.637] lstrlenW (lpString=".xls") returned 4
	[0101.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.638] lstrlenW (lpString=".xlsx") returned 5
	[0101.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.638] lstrlenW (lpString=".ppt") returned 4
	[0101.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0101.638] lstrlenW (lpString=".zip") returned 4
	[0101.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.638] lstrlenW (lpString=".rar") returned 4
	[0101.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.638] lstrlenW (lpString=".bz2") returned 4
	[0101.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.638] lstrlenW (lpString=".7z") returned 3
	[0101.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0101.638] lstrlenW (lpString=".dbf") returned 4
	[0101.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0101.638] lstrlenW (lpString=".1cd") returned 4
	[0101.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0101.638] lstrlenW (lpString=".jpg") returned 4
	[0101.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.638] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.639] lstrlenW (lpString="BS01635_.WMF") returned 12
	[0101.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0101.664] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=14996) returned 1
	[0101.664] CloseHandle (hObject=0x170) returned 1
	[0101.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20
	[0101.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0101.686] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.686] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0101.695] GetLastError () returned 0x0
	[0101.695] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x3a94, lpOverlapped=0x0) returned 1
	[0101.697] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3aa0, lpOverlapped=0x0) returned 1
	[0101.698] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.698] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.699] SetEndOfFile (hFile=0x160) returned 1
	[0101.700] CloseHandle (hObject=0x160) returned 1
	[0101.700] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.700] SetEndOfFile (hFile=0x174) returned 1
	[0101.707] CloseHandle (hObject=0x174) returned 1
	[0101.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 1
	[0101.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0101.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0101.715] lstrlenW (lpString=".doc") returned 4
	[0101.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.715] lstrlenW (lpString=".docx") returned 5
	[0101.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.715] lstrlenW (lpString=".pdf") returned 4
	[0101.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.715] lstrlenW (lpString=".xls") returned 4
	[0101.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.715] lstrlenW (lpString=".xlsx") returned 5
	[0101.715] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.715] lstrlenW (lpString=".ppt") returned 4
	[0101.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0101.715] lstrlenW (lpString=".zip") returned 4
	[0101.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.715] lstrlenW (lpString=".rar") returned 4
	[0101.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.715] lstrlenW (lpString=".bz2") returned 4
	[0101.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.715] lstrlenW (lpString=".7z") returned 3
	[0101.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0101.715] lstrlenW (lpString=".dbf") returned 4
	[0101.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0101.716] lstrlenW (lpString=".1cd") returned 4
	[0101.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0101.716] lstrlenW (lpString=".jpg") returned 4
	[0101.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0101.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0101.716] lstrlenW (lpString=".doc") returned 4
	[0101.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.716] lstrlenW (lpString=".docx") returned 5
	[0101.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.716] lstrlenW (lpString=".pdf") returned 4
	[0101.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.716] lstrlenW (lpString=".xls") returned 4
	[0101.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.716] lstrlenW (lpString=".xlsx") returned 5
	[0101.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.716] lstrlenW (lpString=".ppt") returned 4
	[0101.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0101.716] lstrlenW (lpString=".zip") returned 4
	[0101.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.716] lstrlenW (lpString=".rar") returned 4
	[0101.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.717] lstrlenW (lpString=".bz2") returned 4
	[0101.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.717] lstrlenW (lpString=".7z") returned 3
	[0101.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0101.717] lstrlenW (lpString=".dbf") returned 4
	[0101.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0101.717] lstrlenW (lpString=".1cd") returned 4
	[0101.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0101.717] lstrlenW (lpString=".jpg") returned 4
	[0101.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.717] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.717] lstrlenW (lpString="BS01637_.WMF") returned 12
	[0101.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0101.737] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3948) returned 1
	[0101.737] CloseHandle (hObject=0x178) returned 1
	[0101.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20
	[0101.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0101.763] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.763] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0101.773] GetLastError () returned 0x0
	[0101.773] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xf6c, lpOverlapped=0x0) returned 1
	[0101.776] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf70, lpOverlapped=0x0) returned 1
	[0101.777] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.777] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.778] SetEndOfFile (hFile=0x1cc) returned 1
	[0101.781] CloseHandle (hObject=0x1cc) returned 1
	[0101.785] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.786] SetEndOfFile (hFile=0x174) returned 1
	[0101.789] CloseHandle (hObject=0x174) returned 1
	[0101.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 1
	[0101.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0101.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0101.793] lstrlenW (lpString=".doc") returned 4
	[0101.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.793] lstrlenW (lpString=".docx") returned 5
	[0101.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.793] lstrlenW (lpString=".pdf") returned 4
	[0101.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.793] lstrlenW (lpString=".xls") returned 4
	[0101.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.794] lstrlenW (lpString=".xlsx") returned 5
	[0101.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.794] lstrlenW (lpString=".ppt") returned 4
	[0101.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0101.794] lstrlenW (lpString=".zip") returned 4
	[0101.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.794] lstrlenW (lpString=".rar") returned 4
	[0101.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.794] lstrlenW (lpString=".bz2") returned 4
	[0101.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.794] lstrlenW (lpString=".7z") returned 3
	[0101.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0101.794] lstrlenW (lpString=".dbf") returned 4
	[0101.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0101.794] lstrlenW (lpString=".1cd") returned 4
	[0101.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0101.794] lstrlenW (lpString=".jpg") returned 4
	[0101.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0101.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0101.794] lstrlenW (lpString=".doc") returned 4
	[0101.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.794] lstrlenW (lpString=".docx") returned 5
	[0101.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.794] lstrlenW (lpString=".pdf") returned 4
	[0101.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.795] lstrlenW (lpString=".xls") returned 4
	[0101.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.795] lstrlenW (lpString=".xlsx") returned 5
	[0101.795] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.795] lstrlenW (lpString=".ppt") returned 4
	[0101.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0101.795] lstrlenW (lpString=".zip") returned 4
	[0101.795] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.795] lstrlenW (lpString=".rar") returned 4
	[0101.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.795] lstrlenW (lpString=".bz2") returned 4
	[0101.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.795] lstrlenW (lpString=".7z") returned 3
	[0101.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0101.795] lstrlenW (lpString=".dbf") returned 4
	[0101.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0101.795] lstrlenW (lpString=".1cd") returned 4
	[0101.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0101.795] lstrlenW (lpString=".jpg") returned 4
	[0101.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.795] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.796] lstrlenW (lpString="BS01639_.WMF") returned 12
	[0101.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0101.811] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4236) returned 1
	[0101.811] CloseHandle (hObject=0x1cc) returned 1
	[0101.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20
	[0101.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0101.830] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.830] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0101.843] GetLastError () returned 0x0
	[0101.843] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x108c, lpOverlapped=0x0) returned 1
	[0101.845] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1090, lpOverlapped=0x0) returned 1
	[0101.846] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.846] WriteFile (in: hFile=0x198, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.846] SetEndOfFile (hFile=0x198) returned 1
	[0101.847] CloseHandle (hObject=0x198) returned 1
	[0101.848] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.848] SetEndOfFile (hFile=0x19c) returned 1
	[0101.855] CloseHandle (hObject=0x19c) returned 1
	[0101.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 1
	[0101.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0101.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0101.859] lstrlenW (lpString=".doc") returned 4
	[0101.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.859] lstrlenW (lpString=".docx") returned 5
	[0101.859] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.859] lstrlenW (lpString=".pdf") returned 4
	[0101.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.859] lstrlenW (lpString=".xls") returned 4
	[0101.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.860] lstrlenW (lpString=".xlsx") returned 5
	[0101.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.860] lstrlenW (lpString=".ppt") returned 4
	[0101.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0101.860] lstrlenW (lpString=".zip") returned 4
	[0101.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.860] lstrlenW (lpString=".rar") returned 4
	[0101.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.860] lstrlenW (lpString=".bz2") returned 4
	[0101.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.860] lstrlenW (lpString=".7z") returned 3
	[0101.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0101.860] lstrlenW (lpString=".dbf") returned 4
	[0101.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0101.860] lstrlenW (lpString=".1cd") returned 4
	[0101.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0101.860] lstrlenW (lpString=".jpg") returned 4
	[0101.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0101.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0101.860] lstrlenW (lpString=".doc") returned 4
	[0101.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.860] lstrlenW (lpString=".docx") returned 5
	[0101.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0101.861] lstrlenW (lpString=".pdf") returned 4
	[0101.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.861] lstrlenW (lpString=".xls") returned 4
	[0101.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.861] lstrlenW (lpString=".xlsx") returned 5
	[0101.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0101.861] lstrlenW (lpString=".ppt") returned 4
	[0101.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0101.861] lstrlenW (lpString=".zip") returned 4
	[0101.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.861] lstrlenW (lpString=".rar") returned 4
	[0101.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.861] lstrlenW (lpString=".bz2") returned 4
	[0101.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.861] lstrlenW (lpString=".7z") returned 3
	[0101.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0101.861] lstrlenW (lpString=".dbf") returned 4
	[0101.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0101.861] lstrlenW (lpString=".1cd") returned 4
	[0101.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0101.861] lstrlenW (lpString=".jpg") returned 4
	[0101.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.862] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.862] lstrlenW (lpString="CLASSIC1.WMF") returned 12
	[0101.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0101.883] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2422) returned 1
	[0101.883] CloseHandle (hObject=0x198) returned 1
	[0101.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 0x20
	[0101.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0101.946] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.946] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0101.959] GetLastError () returned 0x0
	[0101.959] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x976, lpOverlapped=0x0) returned 1
	[0101.962] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x980, lpOverlapped=0x0) returned 1
	[0101.963] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.963] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.963] SetEndOfFile (hFile=0x1a8) returned 1
	[0101.964] CloseHandle (hObject=0x1a8) returned 1
	[0101.967] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.967] SetEndOfFile (hFile=0x19c) returned 1
	[0101.973] CloseHandle (hObject=0x19c) returned 1
	[0101.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 1
	[0101.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0101.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0101.981] lstrlenW (lpString=".doc") returned 4
	[0101.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.982] lstrlenW (lpString=".docx") returned 5
	[0101.982] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0101.982] lstrlenW (lpString=".pdf") returned 4
	[0101.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.982] lstrlenW (lpString=".xls") returned 4
	[0101.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.982] lstrlenW (lpString=".xlsx") returned 5
	[0101.982] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0101.982] lstrlenW (lpString=".ppt") returned 4
	[0101.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0101.982] lstrlenW (lpString=".zip") returned 4
	[0101.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.982] lstrlenW (lpString=".rar") returned 4
	[0101.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.982] lstrlenW (lpString=".bz2") returned 4
	[0101.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.982] lstrlenW (lpString=".7z") returned 3
	[0101.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0101.982] lstrlenW (lpString=".dbf") returned 4
	[0101.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0101.982] lstrlenW (lpString=".1cd") returned 4
	[0101.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0101.982] lstrlenW (lpString=".jpg") returned 4
	[0101.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0101.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0101.983] lstrlenW (lpString=".doc") returned 4
	[0101.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0101.983] lstrlenW (lpString=".docx") returned 5
	[0101.983] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0101.983] lstrlenW (lpString=".pdf") returned 4
	[0101.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0101.983] lstrlenW (lpString=".xls") returned 4
	[0101.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0101.983] lstrlenW (lpString=".xlsx") returned 5
	[0101.983] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0101.983] lstrlenW (lpString=".ppt") returned 4
	[0101.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0101.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0101.983] lstrlenW (lpString=".zip") returned 4
	[0101.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0101.983] lstrlenW (lpString=".rar") returned 4
	[0101.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0101.983] lstrlenW (lpString=".bz2") returned 4
	[0101.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0101.983] lstrlenW (lpString=".7z") returned 3
	[0101.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0101.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0101.983] lstrlenW (lpString=".dbf") returned 4
	[0101.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0101.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0101.984] lstrlenW (lpString=".1cd") returned 4
	[0101.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0101.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0101.984] lstrlenW (lpString=".jpg") returned 4
	[0101.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0101.984] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0101.984] lstrlenW (lpString="CLIP.WMF") returned 8
	[0101.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.020] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2262) returned 1
	[0102.020] CloseHandle (hObject=0x1d0) returned 1
	[0102.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20
	[0102.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.041] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.041] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0102.047] GetLastError () returned 0x0
	[0102.047] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x8d6, lpOverlapped=0x0) returned 1
	[0102.053] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x8e0, lpOverlapped=0x0) returned 1
	[0102.054] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.054] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0102.054] SetEndOfFile (hFile=0x1e0) returned 1
	[0102.056] CloseHandle (hObject=0x1e0) returned 1
	[0102.057] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.057] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.063] CloseHandle (hObject=0x1a8) returned 1
	[0102.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 1
	[0102.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0102.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0102.074] lstrlenW (lpString=".doc") returned 4
	[0102.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.074] lstrlenW (lpString=".docx") returned 5
	[0102.074] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0102.074] lstrlenW (lpString=".pdf") returned 4
	[0102.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.074] lstrlenW (lpString=".xls") returned 4
	[0102.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.075] lstrlenW (lpString=".xlsx") returned 5
	[0102.075] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0102.075] lstrlenW (lpString=".ppt") returned 4
	[0102.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0102.075] lstrlenW (lpString=".zip") returned 4
	[0102.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.075] lstrlenW (lpString=".rar") returned 4
	[0102.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.075] lstrlenW (lpString=".bz2") returned 4
	[0102.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.075] lstrlenW (lpString=".7z") returned 3
	[0102.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0102.075] lstrlenW (lpString=".dbf") returned 4
	[0102.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0102.075] lstrlenW (lpString=".1cd") returned 4
	[0102.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0102.075] lstrlenW (lpString=".jpg") returned 4
	[0102.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0102.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0102.076] lstrlenW (lpString=".doc") returned 4
	[0102.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.076] lstrlenW (lpString=".docx") returned 5
	[0102.076] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0102.076] lstrlenW (lpString=".pdf") returned 4
	[0102.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.076] lstrlenW (lpString=".xls") returned 4
	[0102.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.076] lstrlenW (lpString=".xlsx") returned 5
	[0102.076] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0102.076] lstrlenW (lpString=".ppt") returned 4
	[0102.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0102.076] lstrlenW (lpString=".zip") returned 4
	[0102.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.076] lstrlenW (lpString=".rar") returned 4
	[0102.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.076] lstrlenW (lpString=".bz2") returned 4
	[0102.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.076] lstrlenW (lpString=".7z") returned 3
	[0102.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0102.076] lstrlenW (lpString=".dbf") returned 4
	[0102.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0102.077] lstrlenW (lpString=".1cd") returned 4
	[0102.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0102.077] lstrlenW (lpString=".jpg") returned 4
	[0102.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.077] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.077] lstrlenW (lpString="CRANINST.WMF") returned 12
	[0102.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.091] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=49546) returned 1
	[0102.091] CloseHandle (hObject=0x1d4) returned 1
	[0102.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20
	[0102.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0102.108] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.108] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.114] GetLastError () returned 0x0
	[0102.114] ReadFile (in: hFile=0x1e0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xc18a, lpOverlapped=0x0) returned 1
	[0102.119] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xc190, lpOverlapped=0x0) returned 1
	[0102.121] ReadFile (in: hFile=0x1e0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.122] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.122] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.123] CloseHandle (hObject=0x1a8) returned 1
	[0102.124] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.124] SetEndOfFile (hFile=0x1e0) returned 1
	[0102.128] CloseHandle (hObject=0x1e0) returned 1
	[0102.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 1
	[0102.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0102.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0102.137] lstrlenW (lpString=".doc") returned 4
	[0102.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.137] lstrlenW (lpString=".docx") returned 5
	[0102.138] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0102.138] lstrlenW (lpString=".pdf") returned 4
	[0102.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.138] lstrlenW (lpString=".xls") returned 4
	[0102.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.138] lstrlenW (lpString=".xlsx") returned 5
	[0102.138] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0102.138] lstrlenW (lpString=".ppt") returned 4
	[0102.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0102.138] lstrlenW (lpString=".zip") returned 4
	[0102.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.138] lstrlenW (lpString=".rar") returned 4
	[0102.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.138] lstrlenW (lpString=".bz2") returned 4
	[0102.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.138] lstrlenW (lpString=".7z") returned 3
	[0102.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0102.138] lstrlenW (lpString=".dbf") returned 4
	[0102.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0102.138] lstrlenW (lpString=".1cd") returned 4
	[0102.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0102.138] lstrlenW (lpString=".jpg") returned 4
	[0102.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0102.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0102.139] lstrlenW (lpString=".doc") returned 4
	[0102.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.139] lstrlenW (lpString=".docx") returned 5
	[0102.139] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0102.139] lstrlenW (lpString=".pdf") returned 4
	[0102.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.139] lstrlenW (lpString=".xls") returned 4
	[0102.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.139] lstrlenW (lpString=".xlsx") returned 5
	[0102.139] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0102.139] lstrlenW (lpString=".ppt") returned 4
	[0102.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0102.139] lstrlenW (lpString=".zip") returned 4
	[0102.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.139] lstrlenW (lpString=".rar") returned 4
	[0102.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.139] lstrlenW (lpString=".bz2") returned 4
	[0102.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.139] lstrlenW (lpString=".7z") returned 3
	[0102.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0102.139] lstrlenW (lpString=".dbf") returned 4
	[0102.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0102.140] lstrlenW (lpString=".1cd") returned 4
	[0102.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0102.140] lstrlenW (lpString=".jpg") returned 4
	[0102.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.140] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.140] lstrlenW (lpString="CUPINST.WMF") returned 11
	[0102.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.154] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=10326) returned 1
	[0102.155] CloseHandle (hObject=0x1d0) returned 1
	[0102.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20
	[0102.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.178] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.178] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0102.184] GetLastError () returned 0x0
	[0102.184] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2856, lpOverlapped=0x0) returned 1
	[0102.187] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2860, lpOverlapped=0x0) returned 1
	[0102.188] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.188] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0102.188] SetEndOfFile (hFile=0x1e0) returned 1
	[0102.189] CloseHandle (hObject=0x1e0) returned 1
	[0102.190] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.190] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.194] CloseHandle (hObject=0x1a8) returned 1
	[0102.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 1
	[0102.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0102.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0102.204] lstrlenW (lpString=".doc") returned 4
	[0102.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.204] lstrlenW (lpString=".docx") returned 5
	[0102.204] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0102.204] lstrlenW (lpString=".pdf") returned 4
	[0102.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.204] lstrlenW (lpString=".xls") returned 4
	[0102.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.204] lstrlenW (lpString=".xlsx") returned 5
	[0102.204] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0102.204] lstrlenW (lpString=".ppt") returned 4
	[0102.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0102.204] lstrlenW (lpString=".zip") returned 4
	[0102.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.204] lstrlenW (lpString=".rar") returned 4
	[0102.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.204] lstrlenW (lpString=".bz2") returned 4
	[0102.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.204] lstrlenW (lpString=".7z") returned 3
	[0102.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0102.204] lstrlenW (lpString=".dbf") returned 4
	[0102.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0102.205] lstrlenW (lpString=".1cd") returned 4
	[0102.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0102.205] lstrlenW (lpString=".jpg") returned 4
	[0102.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0102.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0102.205] lstrlenW (lpString=".doc") returned 4
	[0102.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.205] lstrlenW (lpString=".docx") returned 5
	[0102.205] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0102.205] lstrlenW (lpString=".pdf") returned 4
	[0102.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.205] lstrlenW (lpString=".xls") returned 4
	[0102.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.205] lstrlenW (lpString=".xlsx") returned 5
	[0102.205] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0102.205] lstrlenW (lpString=".ppt") returned 4
	[0102.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0102.205] lstrlenW (lpString=".zip") returned 4
	[0102.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.205] lstrlenW (lpString=".rar") returned 4
	[0102.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.205] lstrlenW (lpString=".bz2") returned 4
	[0102.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.205] lstrlenW (lpString=".7z") returned 3
	[0102.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0102.206] lstrlenW (lpString=".dbf") returned 4
	[0102.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0102.206] lstrlenW (lpString=".1cd") returned 4
	[0102.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0102.206] lstrlenW (lpString=".jpg") returned 4
	[0102.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.206] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.206] lstrlenW (lpString="DD00121_.WMF") returned 12
	[0102.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.221] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8256) returned 1
	[0102.221] CloseHandle (hObject=0x1d0) returned 1
	[0102.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20
	[0102.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.241] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.241] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0102.252] GetLastError () returned 0x0
	[0102.252] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2040, lpOverlapped=0x0) returned 1
	[0102.255] WriteFile (in: hFile=0x190, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2050, lpOverlapped=0x0) returned 1
	[0102.256] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.256] WriteFile (in: hFile=0x190, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.256] SetEndOfFile (hFile=0x190) returned 1
	[0102.257] CloseHandle (hObject=0x190) returned 1
	[0102.259] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.259] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.266] CloseHandle (hObject=0x1a8) returned 1
	[0102.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 1
	[0102.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0102.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0102.276] lstrlenW (lpString=".doc") returned 4
	[0102.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.276] lstrlenW (lpString=".docx") returned 5
	[0102.276] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.276] lstrlenW (lpString=".pdf") returned 4
	[0102.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.276] lstrlenW (lpString=".xls") returned 4
	[0102.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.276] lstrlenW (lpString=".xlsx") returned 5
	[0102.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.276] lstrlenW (lpString=".ppt") returned 4
	[0102.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0102.277] lstrlenW (lpString=".zip") returned 4
	[0102.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.277] lstrlenW (lpString=".rar") returned 4
	[0102.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.277] lstrlenW (lpString=".bz2") returned 4
	[0102.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.277] lstrlenW (lpString=".7z") returned 3
	[0102.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0102.277] lstrlenW (lpString=".dbf") returned 4
	[0102.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0102.277] lstrlenW (lpString=".1cd") returned 4
	[0102.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0102.277] lstrlenW (lpString=".jpg") returned 4
	[0102.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0102.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0102.277] lstrlenW (lpString=".doc") returned 4
	[0102.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.277] lstrlenW (lpString=".docx") returned 5
	[0102.277] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.277] lstrlenW (lpString=".pdf") returned 4
	[0102.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.278] lstrlenW (lpString=".xls") returned 4
	[0102.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.278] lstrlenW (lpString=".xlsx") returned 5
	[0102.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.278] lstrlenW (lpString=".ppt") returned 4
	[0102.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0102.278] lstrlenW (lpString=".zip") returned 4
	[0102.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.278] lstrlenW (lpString=".rar") returned 4
	[0102.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.278] lstrlenW (lpString=".bz2") returned 4
	[0102.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.278] lstrlenW (lpString=".7z") returned 3
	[0102.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0102.278] lstrlenW (lpString=".dbf") returned 4
	[0102.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0102.278] lstrlenW (lpString=".1cd") returned 4
	[0102.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0102.278] lstrlenW (lpString=".jpg") returned 4
	[0102.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.279] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.279] lstrlenW (lpString="DD00255_.WMF") returned 12
	[0102.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.293] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2690) returned 1
	[0102.293] CloseHandle (hObject=0x1d0) returned 1
	[0102.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x20
	[0102.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.315] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.315] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.320] GetLastError () returned 0x0
	[0102.320] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xa82, lpOverlapped=0x0) returned 1
	[0102.322] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa90, lpOverlapped=0x0) returned 1
	[0102.324] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.324] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.324] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.325] CloseHandle (hObject=0x1a8) returned 1
	[0102.325] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.326] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.330] CloseHandle (hObject=0x1d8) returned 1
	[0102.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 1
	[0102.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0102.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0102.339] lstrlenW (lpString=".doc") returned 4
	[0102.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.339] lstrlenW (lpString=".docx") returned 5
	[0102.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.339] lstrlenW (lpString=".pdf") returned 4
	[0102.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.339] lstrlenW (lpString=".xls") returned 4
	[0102.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.339] lstrlenW (lpString=".xlsx") returned 5
	[0102.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.340] lstrlenW (lpString=".ppt") returned 4
	[0102.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0102.340] lstrlenW (lpString=".zip") returned 4
	[0102.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.340] lstrlenW (lpString=".rar") returned 4
	[0102.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.340] lstrlenW (lpString=".bz2") returned 4
	[0102.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.340] lstrlenW (lpString=".7z") returned 3
	[0102.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0102.340] lstrlenW (lpString=".dbf") returned 4
	[0102.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0102.340] lstrlenW (lpString=".1cd") returned 4
	[0102.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0102.340] lstrlenW (lpString=".jpg") returned 4
	[0102.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0102.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0102.340] lstrlenW (lpString=".doc") returned 4
	[0102.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.340] lstrlenW (lpString=".docx") returned 5
	[0102.340] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.340] lstrlenW (lpString=".pdf") returned 4
	[0102.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.340] lstrlenW (lpString=".xls") returned 4
	[0102.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.341] lstrlenW (lpString=".xlsx") returned 5
	[0102.341] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.341] lstrlenW (lpString=".ppt") returned 4
	[0102.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0102.341] lstrlenW (lpString=".zip") returned 4
	[0102.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.341] lstrlenW (lpString=".rar") returned 4
	[0102.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.341] lstrlenW (lpString=".bz2") returned 4
	[0102.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.341] lstrlenW (lpString=".7z") returned 3
	[0102.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0102.341] lstrlenW (lpString=".dbf") returned 4
	[0102.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0102.341] lstrlenW (lpString=".1cd") returned 4
	[0102.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0102.341] lstrlenW (lpString=".jpg") returned 4
	[0102.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.342] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.342] lstrlenW (lpString="DD00261_.WMF") returned 12
	[0102.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.355] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=37974) returned 1
	[0102.355] CloseHandle (hObject=0x1d4) returned 1
	[0102.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x20
	[0102.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.374] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.374] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.381] GetLastError () returned 0x0
	[0102.381] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x9456, lpOverlapped=0x0) returned 1
	[0102.384] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x9460, lpOverlapped=0x0) returned 1
	[0102.386] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.386] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.386] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.388] CloseHandle (hObject=0x1d8) returned 1
	[0102.388] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.388] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.396] CloseHandle (hObject=0x1a8) returned 1
	[0102.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 1
	[0102.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0102.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0102.403] lstrlenW (lpString=".doc") returned 4
	[0102.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.403] lstrlenW (lpString=".docx") returned 5
	[0102.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.403] lstrlenW (lpString=".pdf") returned 4
	[0102.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.403] lstrlenW (lpString=".xls") returned 4
	[0102.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.403] lstrlenW (lpString=".xlsx") returned 5
	[0102.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.403] lstrlenW (lpString=".ppt") returned 4
	[0102.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0102.404] lstrlenW (lpString=".zip") returned 4
	[0102.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.404] lstrlenW (lpString=".rar") returned 4
	[0102.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.404] lstrlenW (lpString=".bz2") returned 4
	[0102.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.404] lstrlenW (lpString=".7z") returned 3
	[0102.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0102.404] lstrlenW (lpString=".dbf") returned 4
	[0102.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0102.404] lstrlenW (lpString=".1cd") returned 4
	[0102.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0102.404] lstrlenW (lpString=".jpg") returned 4
	[0102.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0102.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0102.404] lstrlenW (lpString=".doc") returned 4
	[0102.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.404] lstrlenW (lpString=".docx") returned 5
	[0102.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.404] lstrlenW (lpString=".pdf") returned 4
	[0102.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.405] lstrlenW (lpString=".xls") returned 4
	[0102.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.405] lstrlenW (lpString=".xlsx") returned 5
	[0102.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.405] lstrlenW (lpString=".ppt") returned 4
	[0102.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0102.405] lstrlenW (lpString=".zip") returned 4
	[0102.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.405] lstrlenW (lpString=".rar") returned 4
	[0102.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.405] lstrlenW (lpString=".bz2") returned 4
	[0102.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.405] lstrlenW (lpString=".7z") returned 3
	[0102.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0102.405] lstrlenW (lpString=".dbf") returned 4
	[0102.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0102.405] lstrlenW (lpString=".1cd") returned 4
	[0102.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0102.405] lstrlenW (lpString=".jpg") returned 4
	[0102.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.406] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.406] lstrlenW (lpString="DD00372_.WMF") returned 12
	[0102.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.425] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=792) returned 1
	[0102.425] CloseHandle (hObject=0x1d4) returned 1
	[0102.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x20
	[0102.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.449] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.449] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.455] GetLastError () returned 0x0
	[0102.455] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x318, lpOverlapped=0x0) returned 1
	[0102.457] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x320, lpOverlapped=0x0) returned 1
	[0102.458] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.458] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.458] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.460] CloseHandle (hObject=0x1a8) returned 1
	[0102.460] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.460] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.465] CloseHandle (hObject=0x1d8) returned 1
	[0102.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 1
	[0102.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0102.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0102.475] lstrlenW (lpString=".doc") returned 4
	[0102.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.475] lstrlenW (lpString=".docx") returned 5
	[0102.475] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.475] lstrlenW (lpString=".pdf") returned 4
	[0102.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.476] lstrlenW (lpString=".xls") returned 4
	[0102.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.476] lstrlenW (lpString=".xlsx") returned 5
	[0102.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.476] lstrlenW (lpString=".ppt") returned 4
	[0102.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0102.476] lstrlenW (lpString=".zip") returned 4
	[0102.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.476] lstrlenW (lpString=".rar") returned 4
	[0102.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.476] lstrlenW (lpString=".bz2") returned 4
	[0102.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.476] lstrlenW (lpString=".7z") returned 3
	[0102.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0102.476] lstrlenW (lpString=".dbf") returned 4
	[0102.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0102.476] lstrlenW (lpString=".1cd") returned 4
	[0102.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0102.476] lstrlenW (lpString=".jpg") returned 4
	[0102.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0102.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0102.477] lstrlenW (lpString=".doc") returned 4
	[0102.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.477] lstrlenW (lpString=".docx") returned 5
	[0102.477] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.477] lstrlenW (lpString=".pdf") returned 4
	[0102.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.477] lstrlenW (lpString=".xls") returned 4
	[0102.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.477] lstrlenW (lpString=".xlsx") returned 5
	[0102.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.477] lstrlenW (lpString=".ppt") returned 4
	[0102.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0102.477] lstrlenW (lpString=".zip") returned 4
	[0102.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.477] lstrlenW (lpString=".rar") returned 4
	[0102.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.477] lstrlenW (lpString=".bz2") returned 4
	[0102.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.477] lstrlenW (lpString=".7z") returned 3
	[0102.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0102.477] lstrlenW (lpString=".dbf") returned 4
	[0102.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0102.478] lstrlenW (lpString=".1cd") returned 4
	[0102.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0102.478] lstrlenW (lpString=".jpg") returned 4
	[0102.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.478] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.478] lstrlenW (lpString="DD00407_.WMF") returned 12
	[0102.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.499] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7828) returned 1
	[0102.499] CloseHandle (hObject=0x1d0) returned 1
	[0102.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x20
	[0102.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.515] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.515] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.521] GetLastError () returned 0x0
	[0102.521] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1e94, lpOverlapped=0x0) returned 1
	[0102.523] WriteFile (in: hFile=0x1d0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1ea0, lpOverlapped=0x0) returned 1
	[0102.525] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.525] WriteFile (in: hFile=0x1d0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.525] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.528] CloseHandle (hObject=0x1d0) returned 1
	[0102.528] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.528] SetEndOfFile (hFile=0x184) returned 1
	[0102.532] CloseHandle (hObject=0x184) returned 1
	[0102.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 1
	[0102.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0102.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0102.542] lstrlenW (lpString=".doc") returned 4
	[0102.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.542] lstrlenW (lpString=".docx") returned 5
	[0102.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.542] lstrlenW (lpString=".pdf") returned 4
	[0102.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.542] lstrlenW (lpString=".xls") returned 4
	[0102.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.542] lstrlenW (lpString=".xlsx") returned 5
	[0102.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.542] lstrlenW (lpString=".ppt") returned 4
	[0102.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0102.542] lstrlenW (lpString=".zip") returned 4
	[0102.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.542] lstrlenW (lpString=".rar") returned 4
	[0102.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.542] lstrlenW (lpString=".bz2") returned 4
	[0102.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.542] lstrlenW (lpString=".7z") returned 3
	[0102.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0102.543] lstrlenW (lpString=".dbf") returned 4
	[0102.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0102.543] lstrlenW (lpString=".1cd") returned 4
	[0102.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0102.543] lstrlenW (lpString=".jpg") returned 4
	[0102.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0102.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0102.543] lstrlenW (lpString=".doc") returned 4
	[0102.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.543] lstrlenW (lpString=".docx") returned 5
	[0102.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.543] lstrlenW (lpString=".pdf") returned 4
	[0102.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.543] lstrlenW (lpString=".xls") returned 4
	[0102.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.543] lstrlenW (lpString=".xlsx") returned 5
	[0102.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.544] lstrlenW (lpString=".ppt") returned 4
	[0102.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0102.544] lstrlenW (lpString=".zip") returned 4
	[0102.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.544] lstrlenW (lpString=".rar") returned 4
	[0102.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.544] lstrlenW (lpString=".bz2") returned 4
	[0102.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.544] lstrlenW (lpString=".7z") returned 3
	[0102.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0102.544] lstrlenW (lpString=".dbf") returned 4
	[0102.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0102.544] lstrlenW (lpString=".1cd") returned 4
	[0102.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0102.544] lstrlenW (lpString=".jpg") returned 4
	[0102.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.545] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.545] lstrlenW (lpString="DD00414_.WMF") returned 12
	[0102.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0102.585] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=42908) returned 1
	[0102.585] CloseHandle (hObject=0x1bc) returned 1
	[0102.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x20
	[0102.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.605] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.605] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0102.611] GetLastError () returned 0x0
	[0102.611] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xa79c, lpOverlapped=0x0) returned 1
	[0102.614] WriteFile (in: hFile=0x1bc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa7a0, lpOverlapped=0x0) returned 1
	[0102.616] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.616] WriteFile (in: hFile=0x1bc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.616] SetEndOfFile (hFile=0x1bc) returned 1
	[0102.617] CloseHandle (hObject=0x1bc) returned 1
	[0102.618] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.618] SetEndOfFile (hFile=0x184) returned 1
	[0102.625] CloseHandle (hObject=0x184) returned 1
	[0102.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 1
	[0102.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0102.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0102.628] lstrlenW (lpString=".doc") returned 4
	[0102.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.629] lstrlenW (lpString=".docx") returned 5
	[0102.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.629] lstrlenW (lpString=".pdf") returned 4
	[0102.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.629] lstrlenW (lpString=".xls") returned 4
	[0102.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.629] lstrlenW (lpString=".xlsx") returned 5
	[0102.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.629] lstrlenW (lpString=".ppt") returned 4
	[0102.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0102.629] lstrlenW (lpString=".zip") returned 4
	[0102.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.629] lstrlenW (lpString=".rar") returned 4
	[0102.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.629] lstrlenW (lpString=".bz2") returned 4
	[0102.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.629] lstrlenW (lpString=".7z") returned 3
	[0102.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0102.629] lstrlenW (lpString=".dbf") returned 4
	[0102.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0102.629] lstrlenW (lpString=".1cd") returned 4
	[0102.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0102.629] lstrlenW (lpString=".jpg") returned 4
	[0102.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0102.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0102.630] lstrlenW (lpString=".doc") returned 4
	[0102.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.630] lstrlenW (lpString=".docx") returned 5
	[0102.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.630] lstrlenW (lpString=".pdf") returned 4
	[0102.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.630] lstrlenW (lpString=".xls") returned 4
	[0102.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.630] lstrlenW (lpString=".xlsx") returned 5
	[0102.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.630] lstrlenW (lpString=".ppt") returned 4
	[0102.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0102.630] lstrlenW (lpString=".zip") returned 4
	[0102.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.630] lstrlenW (lpString=".rar") returned 4
	[0102.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.630] lstrlenW (lpString=".bz2") returned 4
	[0102.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.630] lstrlenW (lpString=".7z") returned 3
	[0102.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0102.630] lstrlenW (lpString=".dbf") returned 4
	[0102.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0102.630] lstrlenW (lpString=".1cd") returned 4
	[0102.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0102.631] lstrlenW (lpString=".jpg") returned 4
	[0102.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.631] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.631] lstrlenW (lpString="DD00437_.WMF") returned 12
	[0102.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0102.650] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1932) returned 1
	[0102.650] CloseHandle (hObject=0x1bc) returned 1
	[0102.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x20
	[0102.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.673] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.673] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.679] GetLastError () returned 0x0
	[0102.679] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x78c, lpOverlapped=0x0) returned 1
	[0102.681] WriteFile (in: hFile=0x1d0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x790, lpOverlapped=0x0) returned 1
	[0102.682] ReadFile (in: hFile=0x1a8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.682] WriteFile (in: hFile=0x1d0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.682] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.683] CloseHandle (hObject=0x1d0) returned 1
	[0102.684] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.684] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.688] CloseHandle (hObject=0x1a8) returned 1
	[0102.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 1
	[0102.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0102.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0102.692] lstrlenW (lpString=".doc") returned 4
	[0102.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.692] lstrlenW (lpString=".docx") returned 5
	[0102.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.692] lstrlenW (lpString=".pdf") returned 4
	[0102.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.692] lstrlenW (lpString=".xls") returned 4
	[0102.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.692] lstrlenW (lpString=".xlsx") returned 5
	[0102.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.693] lstrlenW (lpString=".ppt") returned 4
	[0102.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0102.693] lstrlenW (lpString=".zip") returned 4
	[0102.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.693] lstrlenW (lpString=".rar") returned 4
	[0102.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.693] lstrlenW (lpString=".bz2") returned 4
	[0102.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.693] lstrlenW (lpString=".7z") returned 3
	[0102.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0102.693] lstrlenW (lpString=".dbf") returned 4
	[0102.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0102.693] lstrlenW (lpString=".1cd") returned 4
	[0102.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0102.693] lstrlenW (lpString=".jpg") returned 4
	[0102.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0102.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0102.693] lstrlenW (lpString=".doc") returned 4
	[0102.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.693] lstrlenW (lpString=".docx") returned 5
	[0102.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.694] lstrlenW (lpString=".pdf") returned 4
	[0102.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.694] lstrlenW (lpString=".xls") returned 4
	[0102.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.694] lstrlenW (lpString=".xlsx") returned 5
	[0102.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.694] lstrlenW (lpString=".ppt") returned 4
	[0102.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0102.694] lstrlenW (lpString=".zip") returned 4
	[0102.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.694] lstrlenW (lpString=".rar") returned 4
	[0102.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.694] lstrlenW (lpString=".bz2") returned 4
	[0102.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.694] lstrlenW (lpString=".7z") returned 3
	[0102.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0102.694] lstrlenW (lpString=".dbf") returned 4
	[0102.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0102.694] lstrlenW (lpString=".1cd") returned 4
	[0102.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0102.694] lstrlenW (lpString=".jpg") returned 4
	[0102.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.695] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.695] lstrlenW (lpString="DD00449_.WMF") returned 12
	[0102.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.705] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=9992) returned 1
	[0102.705] CloseHandle (hObject=0x1a8) returned 1
	[0102.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x20
	[0102.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.734] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.734] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0102.739] GetLastError () returned 0x0
	[0102.739] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2708, lpOverlapped=0x0) returned 1
	[0102.742] WriteFile (in: hFile=0x1bc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2710, lpOverlapped=0x0) returned 1
	[0102.744] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.744] WriteFile (in: hFile=0x1bc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.744] SetEndOfFile (hFile=0x1bc) returned 1
	[0102.745] CloseHandle (hObject=0x1bc) returned 1
	[0102.745] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.745] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.748] CloseHandle (hObject=0x1d8) returned 1
	[0102.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 1
	[0102.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0102.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0102.750] lstrlenW (lpString=".doc") returned 4
	[0102.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.750] lstrlenW (lpString=".docx") returned 5
	[0102.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.750] lstrlenW (lpString=".pdf") returned 4
	[0102.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.751] lstrlenW (lpString=".xls") returned 4
	[0102.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.751] lstrlenW (lpString=".xlsx") returned 5
	[0102.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.751] lstrlenW (lpString=".ppt") returned 4
	[0102.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0102.751] lstrlenW (lpString=".zip") returned 4
	[0102.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.751] lstrlenW (lpString=".rar") returned 4
	[0102.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.751] lstrlenW (lpString=".bz2") returned 4
	[0102.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.751] lstrlenW (lpString=".7z") returned 3
	[0102.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0102.751] lstrlenW (lpString=".dbf") returned 4
	[0102.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0102.751] lstrlenW (lpString=".1cd") returned 4
	[0102.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0102.751] lstrlenW (lpString=".jpg") returned 4
	[0102.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0102.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0102.752] lstrlenW (lpString=".doc") returned 4
	[0102.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.752] lstrlenW (lpString=".docx") returned 5
	[0102.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.752] lstrlenW (lpString=".pdf") returned 4
	[0102.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.752] lstrlenW (lpString=".xls") returned 4
	[0102.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.752] lstrlenW (lpString=".xlsx") returned 5
	[0102.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.752] lstrlenW (lpString=".ppt") returned 4
	[0102.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0102.752] lstrlenW (lpString=".zip") returned 4
	[0102.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.752] lstrlenW (lpString=".rar") returned 4
	[0102.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.752] lstrlenW (lpString=".bz2") returned 4
	[0102.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.752] lstrlenW (lpString=".7z") returned 3
	[0102.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0102.752] lstrlenW (lpString=".dbf") returned 4
	[0102.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0102.752] lstrlenW (lpString=".1cd") returned 4
	[0102.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0102.753] lstrlenW (lpString=".jpg") returned 4
	[0102.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.753] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.753] lstrlenW (lpString="DD00705_.WMF") returned 12
	[0102.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.770] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=24588) returned 1
	[0102.770] CloseHandle (hObject=0x1a8) returned 1
	[0102.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x20
	[0102.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.795] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.795] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.807] GetLastError () returned 0x0
	[0102.807] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x600c, lpOverlapped=0x0) returned 1
	[0102.810] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6010, lpOverlapped=0x0) returned 1
	[0102.812] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.812] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.812] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.814] CloseHandle (hObject=0x1a8) returned 1
	[0102.814] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.814] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.816] CloseHandle (hObject=0x1d8) returned 1
	[0102.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 1
	[0102.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0102.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0102.819] lstrlenW (lpString=".doc") returned 4
	[0102.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.819] lstrlenW (lpString=".docx") returned 5
	[0102.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.819] lstrlenW (lpString=".pdf") returned 4
	[0102.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.819] lstrlenW (lpString=".xls") returned 4
	[0102.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.820] lstrlenW (lpString=".xlsx") returned 5
	[0102.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.820] lstrlenW (lpString=".ppt") returned 4
	[0102.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0102.820] lstrlenW (lpString=".zip") returned 4
	[0102.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.820] lstrlenW (lpString=".rar") returned 4
	[0102.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.820] lstrlenW (lpString=".bz2") returned 4
	[0102.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.820] lstrlenW (lpString=".7z") returned 3
	[0102.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0102.820] lstrlenW (lpString=".dbf") returned 4
	[0102.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0102.820] lstrlenW (lpString=".1cd") returned 4
	[0102.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0102.820] lstrlenW (lpString=".jpg") returned 4
	[0102.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0102.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0102.820] lstrlenW (lpString=".doc") returned 4
	[0102.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.820] lstrlenW (lpString=".docx") returned 5
	[0102.820] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.820] lstrlenW (lpString=".pdf") returned 4
	[0102.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.821] lstrlenW (lpString=".xls") returned 4
	[0102.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.821] lstrlenW (lpString=".xlsx") returned 5
	[0102.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.821] lstrlenW (lpString=".ppt") returned 4
	[0102.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0102.821] lstrlenW (lpString=".zip") returned 4
	[0102.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.821] lstrlenW (lpString=".rar") returned 4
	[0102.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.821] lstrlenW (lpString=".bz2") returned 4
	[0102.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.821] lstrlenW (lpString=".7z") returned 3
	[0102.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0102.821] lstrlenW (lpString=".dbf") returned 4
	[0102.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0102.821] lstrlenW (lpString=".1cd") returned 4
	[0102.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0102.821] lstrlenW (lpString=".jpg") returned 4
	[0102.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.821] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.821] lstrlenW (lpString="DD01039_.WMF") returned 12
	[0102.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.836] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=14820) returned 1
	[0102.836] CloseHandle (hObject=0x1d8) returned 1
	[0102.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x20
	[0102.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.854] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.855] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.860] GetLastError () returned 0x0
	[0102.860] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x39e4, lpOverlapped=0x0) returned 1
	[0102.862] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x39f0, lpOverlapped=0x0) returned 1
	[0102.863] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.863] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.863] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.864] CloseHandle (hObject=0x1d8) returned 1
	[0102.864] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.865] SetEndOfFile (hFile=0x184) returned 1
	[0102.866] CloseHandle (hObject=0x184) returned 1
	[0102.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 1
	[0102.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0102.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0102.877] lstrlenW (lpString=".doc") returned 4
	[0102.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.877] lstrlenW (lpString=".docx") returned 5
	[0102.877] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.877] lstrlenW (lpString=".pdf") returned 4
	[0102.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.877] lstrlenW (lpString=".xls") returned 4
	[0102.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.877] lstrlenW (lpString=".xlsx") returned 5
	[0102.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.878] lstrlenW (lpString=".ppt") returned 4
	[0102.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0102.878] lstrlenW (lpString=".zip") returned 4
	[0102.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.878] lstrlenW (lpString=".rar") returned 4
	[0102.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.878] lstrlenW (lpString=".bz2") returned 4
	[0102.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.878] lstrlenW (lpString=".7z") returned 3
	[0102.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0102.878] lstrlenW (lpString=".dbf") returned 4
	[0102.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0102.878] lstrlenW (lpString=".1cd") returned 4
	[0102.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0102.878] lstrlenW (lpString=".jpg") returned 4
	[0102.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0102.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0102.878] lstrlenW (lpString=".doc") returned 4
	[0102.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.878] lstrlenW (lpString=".docx") returned 5
	[0102.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.878] lstrlenW (lpString=".pdf") returned 4
	[0102.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.878] lstrlenW (lpString=".xls") returned 4
	[0102.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.879] lstrlenW (lpString=".xlsx") returned 5
	[0102.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.879] lstrlenW (lpString=".ppt") returned 4
	[0102.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0102.879] lstrlenW (lpString=".zip") returned 4
	[0102.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.879] lstrlenW (lpString=".rar") returned 4
	[0102.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.879] lstrlenW (lpString=".bz2") returned 4
	[0102.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.879] lstrlenW (lpString=".7z") returned 3
	[0102.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0102.879] lstrlenW (lpString=".dbf") returned 4
	[0102.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0102.879] lstrlenW (lpString=".1cd") returned 4
	[0102.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0102.879] lstrlenW (lpString=".jpg") returned 4
	[0102.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.879] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.879] lstrlenW (lpString="DD01139_.WMF") returned 12
	[0102.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.896] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3632) returned 1
	[0102.896] CloseHandle (hObject=0x1d4) returned 1
	[0102.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x20
	[0102.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.928] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.929] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.934] GetLastError () returned 0x0
	[0102.934] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xe30, lpOverlapped=0x0) returned 1
	[0102.936] WriteFile (in: hFile=0x1d4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe40, lpOverlapped=0x0) returned 1
	[0102.937] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.937] WriteFile (in: hFile=0x1d4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.937] SetEndOfFile (hFile=0x1d4) returned 1
	[0102.938] CloseHandle (hObject=0x1d4) returned 1
	[0102.939] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.939] SetEndOfFile (hFile=0x184) returned 1
	[0102.941] CloseHandle (hObject=0x184) returned 1
	[0102.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 1
	[0102.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0102.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0102.949] lstrlenW (lpString=".doc") returned 4
	[0102.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.949] lstrlenW (lpString=".docx") returned 5
	[0102.949] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.949] lstrlenW (lpString=".pdf") returned 4
	[0102.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.949] lstrlenW (lpString=".xls") returned 4
	[0102.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.949] lstrlenW (lpString=".xlsx") returned 5
	[0102.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.949] lstrlenW (lpString=".ppt") returned 4
	[0102.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0102.949] lstrlenW (lpString=".zip") returned 4
	[0102.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.950] lstrlenW (lpString=".rar") returned 4
	[0102.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.950] lstrlenW (lpString=".bz2") returned 4
	[0102.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.950] lstrlenW (lpString=".7z") returned 3
	[0102.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0102.950] lstrlenW (lpString=".dbf") returned 4
	[0102.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0102.950] lstrlenW (lpString=".1cd") returned 4
	[0102.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0102.950] lstrlenW (lpString=".jpg") returned 4
	[0102.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0102.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0102.950] lstrlenW (lpString=".doc") returned 4
	[0102.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0102.950] lstrlenW (lpString=".docx") returned 5
	[0102.950] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0102.950] lstrlenW (lpString=".pdf") returned 4
	[0102.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0102.950] lstrlenW (lpString=".xls") returned 4
	[0102.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0102.951] lstrlenW (lpString=".xlsx") returned 5
	[0102.951] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0102.951] lstrlenW (lpString=".ppt") returned 4
	[0102.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0102.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0102.951] lstrlenW (lpString=".zip") returned 4
	[0102.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0102.951] lstrlenW (lpString=".rar") returned 4
	[0102.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0102.951] lstrlenW (lpString=".bz2") returned 4
	[0102.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0102.951] lstrlenW (lpString=".7z") returned 3
	[0102.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0102.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0102.951] lstrlenW (lpString=".dbf") returned 4
	[0102.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0102.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0102.951] lstrlenW (lpString=".1cd") returned 4
	[0102.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0102.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0102.951] lstrlenW (lpString=".jpg") returned 4
	[0102.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0102.951] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0102.952] lstrlenW (lpString="DD01143_.WMF") returned 12
	[0102.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.974] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2140) returned 1
	[0102.974] CloseHandle (hObject=0x184) returned 1
	[0102.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x20
	[0102.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.992] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.992] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.997] GetLastError () returned 0x0
	[0102.997] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x85c, lpOverlapped=0x0) returned 1
	[0102.999] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x860, lpOverlapped=0x0) returned 1
	[0103.000] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.001] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.001] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.002] CloseHandle (hObject=0x1a8) returned 1
	[0103.003] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.003] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.007] CloseHandle (hObject=0x1d8) returned 1
	[0103.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 1
	[0103.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0103.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0103.012] lstrlenW (lpString=".doc") returned 4
	[0103.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.012] lstrlenW (lpString=".docx") returned 5
	[0103.012] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.012] lstrlenW (lpString=".pdf") returned 4
	[0103.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.012] lstrlenW (lpString=".xls") returned 4
	[0103.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.012] lstrlenW (lpString=".xlsx") returned 5
	[0103.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.012] lstrlenW (lpString=".ppt") returned 4
	[0103.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0103.012] lstrlenW (lpString=".zip") returned 4
	[0103.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.012] lstrlenW (lpString=".rar") returned 4
	[0103.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.012] lstrlenW (lpString=".bz2") returned 4
	[0103.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.013] lstrlenW (lpString=".7z") returned 3
	[0103.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0103.013] lstrlenW (lpString=".dbf") returned 4
	[0103.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0103.013] lstrlenW (lpString=".1cd") returned 4
	[0103.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0103.013] lstrlenW (lpString=".jpg") returned 4
	[0103.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0103.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0103.013] lstrlenW (lpString=".doc") returned 4
	[0103.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.013] lstrlenW (lpString=".docx") returned 5
	[0103.013] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.013] lstrlenW (lpString=".pdf") returned 4
	[0103.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.013] lstrlenW (lpString=".xls") returned 4
	[0103.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.013] lstrlenW (lpString=".xlsx") returned 5
	[0103.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.013] lstrlenW (lpString=".ppt") returned 4
	[0103.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0103.014] lstrlenW (lpString=".zip") returned 4
	[0103.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.014] lstrlenW (lpString=".rar") returned 4
	[0103.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.014] lstrlenW (lpString=".bz2") returned 4
	[0103.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.014] lstrlenW (lpString=".7z") returned 3
	[0103.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0103.014] lstrlenW (lpString=".dbf") returned 4
	[0103.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0103.014] lstrlenW (lpString=".1cd") returned 4
	[0103.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0103.014] lstrlenW (lpString=".jpg") returned 4
	[0103.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.014] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.014] lstrlenW (lpString="DD01146_.WMF") returned 12
	[0103.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0103.061] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2796) returned 1
	[0103.062] CloseHandle (hObject=0x1dc) returned 1
	[0103.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x20
	[0103.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0103.211] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.211] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0103.331] GetLastError () returned 0x0
	[0103.331] ReadFile (in: hFile=0x1bc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xaec, lpOverlapped=0x0) returned 1
	[0103.347] WriteFile (in: hFile=0x1dc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xaf0, lpOverlapped=0x0) returned 1
	[0103.348] ReadFile (in: hFile=0x1bc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.348] WriteFile (in: hFile=0x1dc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.348] SetEndOfFile (hFile=0x1dc) returned 1
	[0103.348] CloseHandle (hObject=0x1dc) returned 1
	[0103.349] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.349] SetEndOfFile (hFile=0x1bc) returned 1
	[0103.349] CloseHandle (hObject=0x1bc) returned 1
	[0103.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 1
	[0103.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0103.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0103.350] lstrlenW (lpString=".doc") returned 4
	[0103.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.350] lstrlenW (lpString=".docx") returned 5
	[0103.350] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.350] lstrlenW (lpString=".pdf") returned 4
	[0103.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.350] lstrlenW (lpString=".xls") returned 4
	[0103.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.350] lstrlenW (lpString=".xlsx") returned 5
	[0103.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.350] lstrlenW (lpString=".ppt") returned 4
	[0103.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0103.350] lstrlenW (lpString=".zip") returned 4
	[0103.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.350] lstrlenW (lpString=".rar") returned 4
	[0103.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.351] lstrlenW (lpString=".bz2") returned 4
	[0103.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.351] lstrlenW (lpString=".7z") returned 3
	[0103.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0103.351] lstrlenW (lpString=".dbf") returned 4
	[0103.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0103.351] lstrlenW (lpString=".1cd") returned 4
	[0103.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0103.351] lstrlenW (lpString=".jpg") returned 4
	[0103.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0103.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0103.351] lstrlenW (lpString=".doc") returned 4
	[0103.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.351] lstrlenW (lpString=".docx") returned 5
	[0103.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.351] lstrlenW (lpString=".pdf") returned 4
	[0103.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.351] lstrlenW (lpString=".xls") returned 4
	[0103.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.351] lstrlenW (lpString=".xlsx") returned 5
	[0103.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.351] lstrlenW (lpString=".ppt") returned 4
	[0103.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0103.351] lstrlenW (lpString=".zip") returned 4
	[0103.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.351] lstrlenW (lpString=".rar") returned 4
	[0103.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.352] lstrlenW (lpString=".bz2") returned 4
	[0103.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.352] lstrlenW (lpString=".7z") returned 3
	[0103.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0103.352] lstrlenW (lpString=".dbf") returned 4
	[0103.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0103.352] lstrlenW (lpString=".1cd") returned 4
	[0103.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0103.352] lstrlenW (lpString=".jpg") returned 4
	[0103.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.352] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.352] lstrlenW (lpString="DD01152_.WMF") returned 12
	[0103.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0103.353] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2960) returned 1
	[0103.353] CloseHandle (hObject=0x1bc) returned 1
	[0103.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x20
	[0103.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0103.354] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.354] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0103.354] GetLastError () returned 0x0
	[0103.354] ReadFile (in: hFile=0x1bc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xb90, lpOverlapped=0x0) returned 1
	[0103.367] WriteFile (in: hFile=0x1dc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xba0, lpOverlapped=0x0) returned 1
	[0103.368] ReadFile (in: hFile=0x1bc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.368] WriteFile (in: hFile=0x1dc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.368] SetEndOfFile (hFile=0x1dc) returned 1
	[0103.368] CloseHandle (hObject=0x1dc) returned 1
	[0103.368] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.368] SetEndOfFile (hFile=0x1bc) returned 1
	[0103.369] CloseHandle (hObject=0x1bc) returned 1
	[0103.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 1
	[0103.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0103.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0103.423] lstrlenW (lpString=".doc") returned 4
	[0103.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.423] lstrlenW (lpString=".docx") returned 5
	[0103.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.423] lstrlenW (lpString=".pdf") returned 4
	[0103.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.423] lstrlenW (lpString=".xls") returned 4
	[0103.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.424] lstrlenW (lpString=".xlsx") returned 5
	[0103.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.424] lstrlenW (lpString=".ppt") returned 4
	[0103.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0103.424] lstrlenW (lpString=".zip") returned 4
	[0103.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.424] lstrlenW (lpString=".rar") returned 4
	[0103.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.424] lstrlenW (lpString=".bz2") returned 4
	[0103.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.424] lstrlenW (lpString=".7z") returned 3
	[0103.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0103.424] lstrlenW (lpString=".dbf") returned 4
	[0103.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0103.424] lstrlenW (lpString=".1cd") returned 4
	[0103.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0103.424] lstrlenW (lpString=".jpg") returned 4
	[0103.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0103.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0103.424] lstrlenW (lpString=".doc") returned 4
	[0103.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.424] lstrlenW (lpString=".docx") returned 5
	[0103.424] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.424] lstrlenW (lpString=".pdf") returned 4
	[0103.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.424] lstrlenW (lpString=".xls") returned 4
	[0103.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.424] lstrlenW (lpString=".xlsx") returned 5
	[0103.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.425] lstrlenW (lpString=".ppt") returned 4
	[0103.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0103.425] lstrlenW (lpString=".zip") returned 4
	[0103.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.425] lstrlenW (lpString=".rar") returned 4
	[0103.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.425] lstrlenW (lpString=".bz2") returned 4
	[0103.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.425] lstrlenW (lpString=".7z") returned 3
	[0103.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0103.425] lstrlenW (lpString=".dbf") returned 4
	[0103.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0103.425] lstrlenW (lpString=".1cd") returned 4
	[0103.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0103.425] lstrlenW (lpString=".jpg") returned 4
	[0103.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.425] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.425] lstrlenW (lpString="DD01160_.WMF") returned 12
	[0103.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.458] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2228) returned 1
	[0103.458] CloseHandle (hObject=0x1e4) returned 1
	[0103.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x20
	[0103.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0103.468] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.468] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.472] GetLastError () returned 0x0
	[0103.472] ReadFile (in: hFile=0x1bc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x8b4, lpOverlapped=0x0) returned 1
	[0103.483] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x8c0, lpOverlapped=0x0) returned 1
	[0103.484] ReadFile (in: hFile=0x1bc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.484] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.484] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.484] CloseHandle (hObject=0x1d8) returned 1
	[0103.484] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.484] SetEndOfFile (hFile=0x1bc) returned 1
	[0103.485] CloseHandle (hObject=0x1bc) returned 1
	[0103.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 1
	[0103.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0103.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0103.485] lstrlenW (lpString=".doc") returned 4
	[0103.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.486] lstrlenW (lpString=".docx") returned 5
	[0103.486] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.486] lstrlenW (lpString=".pdf") returned 4
	[0103.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.486] lstrlenW (lpString=".xls") returned 4
	[0103.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.486] lstrlenW (lpString=".xlsx") returned 5
	[0103.486] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.486] lstrlenW (lpString=".ppt") returned 4
	[0103.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0103.486] lstrlenW (lpString=".zip") returned 4
	[0103.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.486] lstrlenW (lpString=".rar") returned 4
	[0103.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.486] lstrlenW (lpString=".bz2") returned 4
	[0103.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.486] lstrlenW (lpString=".7z") returned 3
	[0103.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0103.486] lstrlenW (lpString=".dbf") returned 4
	[0103.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0103.486] lstrlenW (lpString=".1cd") returned 4
	[0103.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0103.486] lstrlenW (lpString=".jpg") returned 4
	[0103.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0103.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0103.487] lstrlenW (lpString=".doc") returned 4
	[0103.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.487] lstrlenW (lpString=".docx") returned 5
	[0103.487] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.487] lstrlenW (lpString=".pdf") returned 4
	[0103.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.487] lstrlenW (lpString=".xls") returned 4
	[0103.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.487] lstrlenW (lpString=".xlsx") returned 5
	[0103.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.487] lstrlenW (lpString=".ppt") returned 4
	[0103.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0103.487] lstrlenW (lpString=".zip") returned 4
	[0103.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.487] lstrlenW (lpString=".rar") returned 4
	[0103.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.487] lstrlenW (lpString=".bz2") returned 4
	[0103.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.487] lstrlenW (lpString=".7z") returned 3
	[0103.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0103.487] lstrlenW (lpString=".dbf") returned 4
	[0103.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0103.487] lstrlenW (lpString=".1cd") returned 4
	[0103.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0103.487] lstrlenW (lpString=".jpg") returned 4
	[0103.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.488] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.488] lstrlenW (lpString="DD01163_.WMF") returned 12
	[0103.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0103.488] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2300) returned 1
	[0103.488] CloseHandle (hObject=0x1bc) returned 1
	[0103.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x20
	[0103.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0103.489] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.489] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.490] GetLastError () returned 0x0
	[0103.490] ReadFile (in: hFile=0x1bc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x8fc, lpOverlapped=0x0) returned 1
	[0103.500] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x900, lpOverlapped=0x0) returned 1
	[0103.502] ReadFile (in: hFile=0x1bc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.502] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.502] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.502] CloseHandle (hObject=0x1d8) returned 1
	[0103.502] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.502] SetEndOfFile (hFile=0x1bc) returned 1
	[0103.503] CloseHandle (hObject=0x1bc) returned 1
	[0103.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 1
	[0103.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0103.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0103.517] lstrlenW (lpString=".doc") returned 4
	[0103.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.517] lstrlenW (lpString=".docx") returned 5
	[0103.517] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.517] lstrlenW (lpString=".pdf") returned 4
	[0103.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.517] lstrlenW (lpString=".xls") returned 4
	[0103.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.518] lstrlenW (lpString=".xlsx") returned 5
	[0103.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.518] lstrlenW (lpString=".ppt") returned 4
	[0103.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0103.518] lstrlenW (lpString=".zip") returned 4
	[0103.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.518] lstrlenW (lpString=".rar") returned 4
	[0103.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.518] lstrlenW (lpString=".bz2") returned 4
	[0103.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.518] lstrlenW (lpString=".7z") returned 3
	[0103.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0103.518] lstrlenW (lpString=".dbf") returned 4
	[0103.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0103.518] lstrlenW (lpString=".1cd") returned 4
	[0103.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0103.518] lstrlenW (lpString=".jpg") returned 4
	[0103.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0103.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0103.518] lstrlenW (lpString=".doc") returned 4
	[0103.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.518] lstrlenW (lpString=".docx") returned 5
	[0103.518] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.519] lstrlenW (lpString=".pdf") returned 4
	[0103.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.519] lstrlenW (lpString=".xls") returned 4
	[0103.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.519] lstrlenW (lpString=".xlsx") returned 5
	[0103.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.519] lstrlenW (lpString=".ppt") returned 4
	[0103.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0103.519] lstrlenW (lpString=".zip") returned 4
	[0103.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.519] lstrlenW (lpString=".rar") returned 4
	[0103.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.519] lstrlenW (lpString=".bz2") returned 4
	[0103.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.519] lstrlenW (lpString=".7z") returned 3
	[0103.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0103.519] lstrlenW (lpString=".dbf") returned 4
	[0103.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0103.519] lstrlenW (lpString=".1cd") returned 4
	[0103.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0103.519] lstrlenW (lpString=".jpg") returned 4
	[0103.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.519] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.520] lstrlenW (lpString="DD01167_.WMF") returned 12
	[0103.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.528] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2080) returned 1
	[0103.528] CloseHandle (hObject=0x1a8) returned 1
	[0103.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x20
	[0103.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.535] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.535] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.586] GetLastError () returned 0x0
	[0103.586] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x820, lpOverlapped=0x0) returned 1
	[0103.594] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x830, lpOverlapped=0x0) returned 1
	[0103.595] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.595] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.595] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.596] CloseHandle (hObject=0x1d8) returned 1
	[0103.596] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.596] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.597] CloseHandle (hObject=0x1e4) returned 1
	[0103.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 1
	[0103.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0103.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0103.597] lstrlenW (lpString=".doc") returned 4
	[0103.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.597] lstrlenW (lpString=".docx") returned 5
	[0103.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.597] lstrlenW (lpString=".pdf") returned 4
	[0103.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.597] lstrlenW (lpString=".xls") returned 4
	[0103.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.597] lstrlenW (lpString=".xlsx") returned 5
	[0103.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.597] lstrlenW (lpString=".ppt") returned 4
	[0103.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0103.597] lstrlenW (lpString=".zip") returned 4
	[0103.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.598] lstrlenW (lpString=".rar") returned 4
	[0103.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.598] lstrlenW (lpString=".bz2") returned 4
	[0103.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.598] lstrlenW (lpString=".7z") returned 3
	[0103.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0103.598] lstrlenW (lpString=".dbf") returned 4
	[0103.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0103.598] lstrlenW (lpString=".1cd") returned 4
	[0103.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0103.598] lstrlenW (lpString=".jpg") returned 4
	[0103.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0103.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0103.598] lstrlenW (lpString=".doc") returned 4
	[0103.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.598] lstrlenW (lpString=".docx") returned 5
	[0103.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.598] lstrlenW (lpString=".pdf") returned 4
	[0103.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.598] lstrlenW (lpString=".xls") returned 4
	[0103.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.598] lstrlenW (lpString=".xlsx") returned 5
	[0103.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.598] lstrlenW (lpString=".ppt") returned 4
	[0103.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0103.599] lstrlenW (lpString=".zip") returned 4
	[0103.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.599] lstrlenW (lpString=".rar") returned 4
	[0103.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.599] lstrlenW (lpString=".bz2") returned 4
	[0103.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.599] lstrlenW (lpString=".7z") returned 3
	[0103.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0103.599] lstrlenW (lpString=".dbf") returned 4
	[0103.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0103.599] lstrlenW (lpString=".1cd") returned 4
	[0103.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0103.599] lstrlenW (lpString=".jpg") returned 4
	[0103.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.599] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.599] lstrlenW (lpString="DD01169_.WMF") returned 12
	[0103.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.609] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2020) returned 1
	[0103.610] CloseHandle (hObject=0x1a8) returned 1
	[0103.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x20
	[0103.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.616] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.616] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.649] GetLastError () returned 0x0
	[0103.649] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x7e4, lpOverlapped=0x0) returned 1
	[0103.653] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7f0, lpOverlapped=0x0) returned 1
	[0103.654] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.654] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.654] SetEndOfFile (hFile=0x184) returned 1
	[0103.654] CloseHandle (hObject=0x184) returned 1
	[0103.654] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.655] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.656] CloseHandle (hObject=0x1e4) returned 1
	[0103.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 1
	[0103.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0103.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0103.658] lstrlenW (lpString=".doc") returned 4
	[0103.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.658] lstrlenW (lpString=".docx") returned 5
	[0103.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.658] lstrlenW (lpString=".pdf") returned 4
	[0103.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.659] lstrlenW (lpString=".xls") returned 4
	[0103.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.659] lstrlenW (lpString=".xlsx") returned 5
	[0103.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.659] lstrlenW (lpString=".ppt") returned 4
	[0103.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0103.659] lstrlenW (lpString=".zip") returned 4
	[0103.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.659] lstrlenW (lpString=".rar") returned 4
	[0103.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.659] lstrlenW (lpString=".bz2") returned 4
	[0103.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.659] lstrlenW (lpString=".7z") returned 3
	[0103.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0103.659] lstrlenW (lpString=".dbf") returned 4
	[0103.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0103.659] lstrlenW (lpString=".1cd") returned 4
	[0103.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0103.659] lstrlenW (lpString=".jpg") returned 4
	[0103.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0103.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0103.660] lstrlenW (lpString=".doc") returned 4
	[0103.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.660] lstrlenW (lpString=".docx") returned 5
	[0103.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.660] lstrlenW (lpString=".pdf") returned 4
	[0103.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.660] lstrlenW (lpString=".xls") returned 4
	[0103.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.660] lstrlenW (lpString=".xlsx") returned 5
	[0103.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.660] lstrlenW (lpString=".ppt") returned 4
	[0103.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0103.660] lstrlenW (lpString=".zip") returned 4
	[0103.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.660] lstrlenW (lpString=".rar") returned 4
	[0103.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.660] lstrlenW (lpString=".bz2") returned 4
	[0103.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.660] lstrlenW (lpString=".7z") returned 3
	[0103.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0103.661] lstrlenW (lpString=".dbf") returned 4
	[0103.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0103.661] lstrlenW (lpString=".1cd") returned 4
	[0103.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0103.661] lstrlenW (lpString=".jpg") returned 4
	[0103.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.661] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.661] lstrlenW (lpString="DD01171_.WMF") returned 12
	[0103.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.662] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2052) returned 1
	[0103.662] CloseHandle (hObject=0x1e4) returned 1
	[0103.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x20
	[0103.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.663] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.663] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.664] GetLastError () returned 0x0
	[0103.664] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x804, lpOverlapped=0x0) returned 1
	[0103.679] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x810, lpOverlapped=0x0) returned 1
	[0103.680] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.680] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.680] SetEndOfFile (hFile=0x184) returned 1
	[0103.680] CloseHandle (hObject=0x184) returned 1
	[0103.680] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.681] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.682] CloseHandle (hObject=0x1e4) returned 1
	[0103.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 1
	[0103.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0103.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0103.682] lstrlenW (lpString=".doc") returned 4
	[0103.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.683] lstrlenW (lpString=".docx") returned 5
	[0103.683] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.683] lstrlenW (lpString=".pdf") returned 4
	[0103.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.683] lstrlenW (lpString=".xls") returned 4
	[0103.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.683] lstrlenW (lpString=".xlsx") returned 5
	[0103.683] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.683] lstrlenW (lpString=".ppt") returned 4
	[0103.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0103.683] lstrlenW (lpString=".zip") returned 4
	[0103.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.684] lstrlenW (lpString=".rar") returned 4
	[0103.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.684] lstrlenW (lpString=".bz2") returned 4
	[0103.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.684] lstrlenW (lpString=".7z") returned 3
	[0103.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0103.684] lstrlenW (lpString=".dbf") returned 4
	[0103.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0103.684] lstrlenW (lpString=".1cd") returned 4
	[0103.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0103.684] lstrlenW (lpString=".jpg") returned 4
	[0103.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0103.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0103.685] lstrlenW (lpString=".doc") returned 4
	[0103.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.685] lstrlenW (lpString=".docx") returned 5
	[0103.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.685] lstrlenW (lpString=".pdf") returned 4
	[0103.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.685] lstrlenW (lpString=".xls") returned 4
	[0103.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.685] lstrlenW (lpString=".xlsx") returned 5
	[0103.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.686] lstrlenW (lpString=".ppt") returned 4
	[0103.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0103.686] lstrlenW (lpString=".zip") returned 4
	[0103.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.686] lstrlenW (lpString=".rar") returned 4
	[0103.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.686] lstrlenW (lpString=".bz2") returned 4
	[0103.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.686] lstrlenW (lpString=".7z") returned 3
	[0103.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0103.686] lstrlenW (lpString=".dbf") returned 4
	[0103.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0103.687] lstrlenW (lpString=".1cd") returned 4
	[0103.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0103.687] lstrlenW (lpString=".jpg") returned 4
	[0103.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.687] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.687] lstrlenW (lpString="DD01173_.WMF") returned 12
	[0103.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.700] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1804) returned 1
	[0103.700] CloseHandle (hObject=0x1e8) returned 1
	[0103.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x20
	[0103.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.708] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.708] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.737] GetLastError () returned 0x0
	[0103.737] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x70c, lpOverlapped=0x0) returned 1
	[0103.742] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x710, lpOverlapped=0x0) returned 1
	[0103.743] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.743] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.744] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.744] CloseHandle (hObject=0x1d8) returned 1
	[0103.744] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.744] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.745] CloseHandle (hObject=0x1e4) returned 1
	[0103.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 1
	[0103.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0103.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0103.746] lstrlenW (lpString=".doc") returned 4
	[0103.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.746] lstrlenW (lpString=".docx") returned 5
	[0103.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.746] lstrlenW (lpString=".pdf") returned 4
	[0103.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.746] lstrlenW (lpString=".xls") returned 4
	[0103.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.746] lstrlenW (lpString=".xlsx") returned 5
	[0103.746] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.746] lstrlenW (lpString=".ppt") returned 4
	[0103.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0103.746] lstrlenW (lpString=".zip") returned 4
	[0103.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.746] lstrlenW (lpString=".rar") returned 4
	[0103.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.747] lstrlenW (lpString=".bz2") returned 4
	[0103.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.747] lstrlenW (lpString=".7z") returned 3
	[0103.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0103.747] lstrlenW (lpString=".dbf") returned 4
	[0103.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0103.747] lstrlenW (lpString=".1cd") returned 4
	[0103.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0103.747] lstrlenW (lpString=".jpg") returned 4
	[0103.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0103.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0103.747] lstrlenW (lpString=".doc") returned 4
	[0103.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.747] lstrlenW (lpString=".docx") returned 5
	[0103.747] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.747] lstrlenW (lpString=".pdf") returned 4
	[0103.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.747] lstrlenW (lpString=".xls") returned 4
	[0103.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.748] lstrlenW (lpString=".xlsx") returned 5
	[0103.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.748] lstrlenW (lpString=".ppt") returned 4
	[0103.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0103.748] lstrlenW (lpString=".zip") returned 4
	[0103.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.748] lstrlenW (lpString=".rar") returned 4
	[0103.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.748] lstrlenW (lpString=".bz2") returned 4
	[0103.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.748] lstrlenW (lpString=".7z") returned 3
	[0103.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0103.748] lstrlenW (lpString=".dbf") returned 4
	[0103.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0103.748] lstrlenW (lpString=".1cd") returned 4
	[0103.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0103.748] lstrlenW (lpString=".jpg") returned 4
	[0103.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.749] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.749] lstrlenW (lpString="DD01178_.WMF") returned 12
	[0103.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.750] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3796) returned 1
	[0103.750] CloseHandle (hObject=0x1e4) returned 1
	[0103.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x20
	[0103.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.751] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.751] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.752] GetLastError () returned 0x0
	[0103.752] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xed4, lpOverlapped=0x0) returned 1
	[0103.765] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xee0, lpOverlapped=0x0) returned 1
	[0103.766] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.767] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.767] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.767] CloseHandle (hObject=0x1d8) returned 1
	[0103.767] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.767] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.768] CloseHandle (hObject=0x1e4) returned 1
	[0103.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 1
	[0103.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0103.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0103.768] lstrlenW (lpString=".doc") returned 4
	[0103.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.768] lstrlenW (lpString=".docx") returned 5
	[0103.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.768] lstrlenW (lpString=".pdf") returned 4
	[0103.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.768] lstrlenW (lpString=".xls") returned 4
	[0103.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.769] lstrlenW (lpString=".xlsx") returned 5
	[0103.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.769] lstrlenW (lpString=".ppt") returned 4
	[0103.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0103.769] lstrlenW (lpString=".zip") returned 4
	[0103.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.769] lstrlenW (lpString=".rar") returned 4
	[0103.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.769] lstrlenW (lpString=".bz2") returned 4
	[0103.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.769] lstrlenW (lpString=".7z") returned 3
	[0103.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0103.769] lstrlenW (lpString=".dbf") returned 4
	[0103.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0103.769] lstrlenW (lpString=".1cd") returned 4
	[0103.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0103.769] lstrlenW (lpString=".jpg") returned 4
	[0103.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0103.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0103.769] lstrlenW (lpString=".doc") returned 4
	[0103.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.769] lstrlenW (lpString=".docx") returned 5
	[0103.770] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.770] lstrlenW (lpString=".pdf") returned 4
	[0103.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.770] lstrlenW (lpString=".xls") returned 4
	[0103.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.770] lstrlenW (lpString=".xlsx") returned 5
	[0103.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.770] lstrlenW (lpString=".ppt") returned 4
	[0103.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0103.770] lstrlenW (lpString=".zip") returned 4
	[0103.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.770] lstrlenW (lpString=".rar") returned 4
	[0103.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.770] lstrlenW (lpString=".bz2") returned 4
	[0103.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.770] lstrlenW (lpString=".7z") returned 3
	[0103.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0103.770] lstrlenW (lpString=".dbf") returned 4
	[0103.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0103.770] lstrlenW (lpString=".1cd") returned 4
	[0103.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0103.770] lstrlenW (lpString=".jpg") returned 4
	[0103.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.771] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.771] lstrlenW (lpString="DD01180_.WMF") returned 12
	[0103.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.771] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2084) returned 1
	[0103.772] CloseHandle (hObject=0x1e4) returned 1
	[0103.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x20
	[0103.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.772] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.772] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.773] GetLastError () returned 0x0
	[0103.773] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x824, lpOverlapped=0x0) returned 1
	[0103.787] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x830, lpOverlapped=0x0) returned 1
	[0103.788] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.788] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.788] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.789] CloseHandle (hObject=0x1d8) returned 1
	[0103.789] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.789] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.790] CloseHandle (hObject=0x1e4) returned 1
	[0103.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 1
	[0103.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0103.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0103.791] lstrlenW (lpString=".doc") returned 4
	[0103.791] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.791] lstrlenW (lpString=".docx") returned 5
	[0103.791] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.791] lstrlenW (lpString=".pdf") returned 4
	[0103.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.791] lstrlenW (lpString=".xls") returned 4
	[0103.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.791] lstrlenW (lpString=".xlsx") returned 5
	[0103.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.791] lstrlenW (lpString=".ppt") returned 4
	[0103.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0103.792] lstrlenW (lpString=".zip") returned 4
	[0103.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.792] lstrlenW (lpString=".rar") returned 4
	[0103.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.792] lstrlenW (lpString=".bz2") returned 4
	[0103.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.792] lstrlenW (lpString=".7z") returned 3
	[0103.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0103.792] lstrlenW (lpString=".dbf") returned 4
	[0103.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0103.792] lstrlenW (lpString=".1cd") returned 4
	[0103.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0103.792] lstrlenW (lpString=".jpg") returned 4
	[0103.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0103.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0103.792] lstrlenW (lpString=".doc") returned 4
	[0103.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.792] lstrlenW (lpString=".docx") returned 5
	[0103.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.792] lstrlenW (lpString=".pdf") returned 4
	[0103.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.793] lstrlenW (lpString=".xls") returned 4
	[0103.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.793] lstrlenW (lpString=".xlsx") returned 5
	[0103.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.793] lstrlenW (lpString=".ppt") returned 4
	[0103.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0103.793] lstrlenW (lpString=".zip") returned 4
	[0103.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.793] lstrlenW (lpString=".rar") returned 4
	[0103.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.793] lstrlenW (lpString=".bz2") returned 4
	[0103.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.793] lstrlenW (lpString=".7z") returned 3
	[0103.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0103.793] lstrlenW (lpString=".dbf") returned 4
	[0103.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0103.793] lstrlenW (lpString=".1cd") returned 4
	[0103.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0103.793] lstrlenW (lpString=".jpg") returned 4
	[0103.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.794] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.794] lstrlenW (lpString="DD01182_.WMF") returned 12
	[0103.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.800] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2996) returned 1
	[0103.800] CloseHandle (hObject=0x1e4) returned 1
	[0103.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x20
	[0103.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.887] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.887] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.895] GetLastError () returned 0x0
	[0103.895] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xbb4, lpOverlapped=0x0) returned 1
	[0103.925] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xbc0, lpOverlapped=0x0) returned 1
	[0103.927] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.927] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.927] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.927] CloseHandle (hObject=0x1d8) returned 1
	[0103.927] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.927] SetEndOfFile (hFile=0x184) returned 1
	[0103.928] CloseHandle (hObject=0x184) returned 1
	[0103.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 1
	[0103.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0103.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0103.929] lstrlenW (lpString=".doc") returned 4
	[0103.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.929] lstrlenW (lpString=".docx") returned 5
	[0103.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.929] lstrlenW (lpString=".pdf") returned 4
	[0103.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.929] lstrlenW (lpString=".xls") returned 4
	[0103.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.929] lstrlenW (lpString=".xlsx") returned 5
	[0103.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.929] lstrlenW (lpString=".ppt") returned 4
	[0103.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0103.929] lstrlenW (lpString=".zip") returned 4
	[0103.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.929] lstrlenW (lpString=".rar") returned 4
	[0103.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.930] lstrlenW (lpString=".bz2") returned 4
	[0103.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.930] lstrlenW (lpString=".7z") returned 3
	[0103.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0103.930] lstrlenW (lpString=".dbf") returned 4
	[0103.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0103.930] lstrlenW (lpString=".1cd") returned 4
	[0103.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0103.930] lstrlenW (lpString=".jpg") returned 4
	[0103.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0103.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0103.930] lstrlenW (lpString=".doc") returned 4
	[0103.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.930] lstrlenW (lpString=".docx") returned 5
	[0103.930] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.930] lstrlenW (lpString=".pdf") returned 4
	[0103.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.931] lstrlenW (lpString=".xls") returned 4
	[0103.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.931] lstrlenW (lpString=".xlsx") returned 5
	[0103.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.931] lstrlenW (lpString=".ppt") returned 4
	[0103.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0103.931] lstrlenW (lpString=".zip") returned 4
	[0103.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.931] lstrlenW (lpString=".rar") returned 4
	[0103.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.931] lstrlenW (lpString=".bz2") returned 4
	[0103.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.931] lstrlenW (lpString=".7z") returned 3
	[0103.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0103.931] lstrlenW (lpString=".dbf") returned 4
	[0103.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0103.931] lstrlenW (lpString=".1cd") returned 4
	[0103.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0103.931] lstrlenW (lpString=".jpg") returned 4
	[0103.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.932] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.932] lstrlenW (lpString="DD01186_.WMF") returned 12
	[0103.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.933] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8564) returned 1
	[0103.933] CloseHandle (hObject=0x184) returned 1
	[0103.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x20
	[0103.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.934] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.934] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.935] GetLastError () returned 0x0
	[0103.935] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2174, lpOverlapped=0x0) returned 1
	[0103.946] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2180, lpOverlapped=0x0) returned 1
	[0103.948] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.949] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.949] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.949] CloseHandle (hObject=0x1d8) returned 1
	[0103.949] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.949] SetEndOfFile (hFile=0x184) returned 1
	[0103.950] CloseHandle (hObject=0x184) returned 1
	[0103.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 1
	[0103.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0103.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0103.952] lstrlenW (lpString=".doc") returned 4
	[0103.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.952] lstrlenW (lpString=".docx") returned 5
	[0103.952] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.953] lstrlenW (lpString=".pdf") returned 4
	[0103.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.953] lstrlenW (lpString=".xls") returned 4
	[0103.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.953] lstrlenW (lpString=".xlsx") returned 5
	[0103.953] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.953] lstrlenW (lpString=".ppt") returned 4
	[0103.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0103.953] lstrlenW (lpString=".zip") returned 4
	[0103.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.953] lstrlenW (lpString=".rar") returned 4
	[0103.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.953] lstrlenW (lpString=".bz2") returned 4
	[0103.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.953] lstrlenW (lpString=".7z") returned 3
	[0103.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0103.953] lstrlenW (lpString=".dbf") returned 4
	[0103.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0103.953] lstrlenW (lpString=".1cd") returned 4
	[0103.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0103.953] lstrlenW (lpString=".jpg") returned 4
	[0103.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0103.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0103.954] lstrlenW (lpString=".doc") returned 4
	[0103.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0103.954] lstrlenW (lpString=".docx") returned 5
	[0103.954] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0103.954] lstrlenW (lpString=".pdf") returned 4
	[0103.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0103.954] lstrlenW (lpString=".xls") returned 4
	[0103.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0103.954] lstrlenW (lpString=".xlsx") returned 5
	[0103.954] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0103.954] lstrlenW (lpString=".ppt") returned 4
	[0103.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0103.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0103.954] lstrlenW (lpString=".zip") returned 4
	[0103.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0103.954] lstrlenW (lpString=".rar") returned 4
	[0103.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0103.954] lstrlenW (lpString=".bz2") returned 4
	[0103.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0103.955] lstrlenW (lpString=".7z") returned 3
	[0103.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0103.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0103.955] lstrlenW (lpString=".dbf") returned 4
	[0103.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0103.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0103.955] lstrlenW (lpString=".1cd") returned 4
	[0103.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0103.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0103.955] lstrlenW (lpString=".jpg") returned 4
	[0103.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0103.955] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0103.955] lstrlenW (lpString="DD01434_.WMF") returned 12
	[0103.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.966] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=900) returned 1
	[0103.966] CloseHandle (hObject=0x184) returned 1
	[0103.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x20
	[0103.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.014] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.014] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0104.018] GetLastError () returned 0x0
	[0104.018] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x384, lpOverlapped=0x0) returned 1
	[0104.032] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x390, lpOverlapped=0x0) returned 1
	[0104.034] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.034] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.034] SetEndOfFile (hFile=0x184) returned 1
	[0104.034] CloseHandle (hObject=0x184) returned 1
	[0104.034] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.034] SetEndOfFile (hFile=0x1d8) returned 1
	[0104.036] CloseHandle (hObject=0x1d8) returned 1
	[0104.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 1
	[0104.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0104.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0104.038] lstrlenW (lpString=".doc") returned 4
	[0104.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.038] lstrlenW (lpString=".docx") returned 5
	[0104.038] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.038] lstrlenW (lpString=".pdf") returned 4
	[0104.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.038] lstrlenW (lpString=".xls") returned 4
	[0104.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.038] lstrlenW (lpString=".xlsx") returned 5
	[0104.038] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.038] lstrlenW (lpString=".ppt") returned 4
	[0104.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0104.038] lstrlenW (lpString=".zip") returned 4
	[0104.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.038] lstrlenW (lpString=".rar") returned 4
	[0104.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.038] lstrlenW (lpString=".bz2") returned 4
	[0104.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.038] lstrlenW (lpString=".7z") returned 3
	[0104.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0104.038] lstrlenW (lpString=".dbf") returned 4
	[0104.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0104.039] lstrlenW (lpString=".1cd") returned 4
	[0104.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0104.039] lstrlenW (lpString=".jpg") returned 4
	[0104.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0104.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0104.039] lstrlenW (lpString=".doc") returned 4
	[0104.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.039] lstrlenW (lpString=".docx") returned 5
	[0104.039] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.039] lstrlenW (lpString=".pdf") returned 4
	[0104.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.039] lstrlenW (lpString=".xls") returned 4
	[0104.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.039] lstrlenW (lpString=".xlsx") returned 5
	[0104.039] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.039] lstrlenW (lpString=".ppt") returned 4
	[0104.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0104.039] lstrlenW (lpString=".zip") returned 4
	[0104.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.039] lstrlenW (lpString=".rar") returned 4
	[0104.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.039] lstrlenW (lpString=".bz2") returned 4
	[0104.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.040] lstrlenW (lpString=".7z") returned 3
	[0104.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0104.040] lstrlenW (lpString=".dbf") returned 4
	[0104.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0104.040] lstrlenW (lpString=".1cd") returned 4
	[0104.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0104.040] lstrlenW (lpString=".jpg") returned 4
	[0104.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.040] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.040] lstrlenW (lpString="DD01586_.WMF") returned 12
	[0104.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.041] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2324) returned 1
	[0104.041] CloseHandle (hObject=0x1d8) returned 1
	[0104.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x20
	[0104.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.042] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.042] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0104.043] GetLastError () returned 0x0
	[0104.043] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x914, lpOverlapped=0x0) returned 1
	[0104.056] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x920, lpOverlapped=0x0) returned 1
	[0104.058] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.058] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.058] SetEndOfFile (hFile=0x184) returned 1
	[0104.058] CloseHandle (hObject=0x184) returned 1
	[0104.058] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.058] SetEndOfFile (hFile=0x1d8) returned 1
	[0104.059] CloseHandle (hObject=0x1d8) returned 1
	[0104.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 1
	[0104.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0104.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0104.060] lstrlenW (lpString=".doc") returned 4
	[0104.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.060] lstrlenW (lpString=".docx") returned 5
	[0104.060] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.060] lstrlenW (lpString=".pdf") returned 4
	[0104.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.060] lstrlenW (lpString=".xls") returned 4
	[0104.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.060] lstrlenW (lpString=".xlsx") returned 5
	[0104.060] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.061] lstrlenW (lpString=".ppt") returned 4
	[0104.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0104.061] lstrlenW (lpString=".zip") returned 4
	[0104.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.061] lstrlenW (lpString=".rar") returned 4
	[0104.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.061] lstrlenW (lpString=".bz2") returned 4
	[0104.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.061] lstrlenW (lpString=".7z") returned 3
	[0104.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0104.061] lstrlenW (lpString=".dbf") returned 4
	[0104.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0104.061] lstrlenW (lpString=".1cd") returned 4
	[0104.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0104.061] lstrlenW (lpString=".jpg") returned 4
	[0104.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0104.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0104.061] lstrlenW (lpString=".doc") returned 4
	[0104.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.062] lstrlenW (lpString=".docx") returned 5
	[0104.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.062] lstrlenW (lpString=".pdf") returned 4
	[0104.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.062] lstrlenW (lpString=".xls") returned 4
	[0104.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.062] lstrlenW (lpString=".xlsx") returned 5
	[0104.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.062] lstrlenW (lpString=".ppt") returned 4
	[0104.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0104.062] lstrlenW (lpString=".zip") returned 4
	[0104.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.062] lstrlenW (lpString=".rar") returned 4
	[0104.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.062] lstrlenW (lpString=".bz2") returned 4
	[0104.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.062] lstrlenW (lpString=".7z") returned 3
	[0104.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0104.062] lstrlenW (lpString=".dbf") returned 4
	[0104.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0104.062] lstrlenW (lpString=".1cd") returned 4
	[0104.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0104.063] lstrlenW (lpString=".jpg") returned 4
	[0104.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.063] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.063] lstrlenW (lpString="DD01629_.WMF") returned 12
	[0104.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.064] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=580) returned 1
	[0104.064] CloseHandle (hObject=0x1d8) returned 1
	[0104.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x20
	[0104.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.065] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.065] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0104.066] GetLastError () returned 0x0
	[0104.066] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x244, lpOverlapped=0x0) returned 1
	[0104.067] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x250, lpOverlapped=0x0) returned 1
	[0104.068] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.068] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.068] SetEndOfFile (hFile=0x184) returned 1
	[0104.069] CloseHandle (hObject=0x184) returned 1
	[0104.069] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.069] SetEndOfFile (hFile=0x1d8) returned 1
	[0104.070] CloseHandle (hObject=0x1d8) returned 1
	[0104.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 1
	[0104.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0104.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0104.073] lstrlenW (lpString=".doc") returned 4
	[0104.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.074] lstrlenW (lpString=".docx") returned 5
	[0104.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.074] lstrlenW (lpString=".pdf") returned 4
	[0104.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.074] lstrlenW (lpString=".xls") returned 4
	[0104.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.074] lstrlenW (lpString=".xlsx") returned 5
	[0104.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.074] lstrlenW (lpString=".ppt") returned 4
	[0104.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0104.074] lstrlenW (lpString=".zip") returned 4
	[0104.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.074] lstrlenW (lpString=".rar") returned 4
	[0104.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.074] lstrlenW (lpString=".bz2") returned 4
	[0104.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.074] lstrlenW (lpString=".7z") returned 3
	[0104.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0104.074] lstrlenW (lpString=".dbf") returned 4
	[0104.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0104.074] lstrlenW (lpString=".1cd") returned 4
	[0104.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0104.075] lstrlenW (lpString=".jpg") returned 4
	[0104.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0104.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0104.075] lstrlenW (lpString=".doc") returned 4
	[0104.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.075] lstrlenW (lpString=".docx") returned 5
	[0104.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.075] lstrlenW (lpString=".pdf") returned 4
	[0104.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.075] lstrlenW (lpString=".xls") returned 4
	[0104.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.075] lstrlenW (lpString=".xlsx") returned 5
	[0104.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.075] lstrlenW (lpString=".ppt") returned 4
	[0104.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0104.075] lstrlenW (lpString=".zip") returned 4
	[0104.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.075] lstrlenW (lpString=".rar") returned 4
	[0104.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.075] lstrlenW (lpString=".bz2") returned 4
	[0104.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.075] lstrlenW (lpString=".7z") returned 3
	[0104.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0104.076] lstrlenW (lpString=".dbf") returned 4
	[0104.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0104.076] lstrlenW (lpString=".1cd") returned 4
	[0104.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0104.076] lstrlenW (lpString=".jpg") returned 4
	[0104.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.076] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.076] lstrlenW (lpString="DD01630_.WMF") returned 12
	[0104.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.077] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=296) returned 1
	[0104.077] CloseHandle (hObject=0x1d8) returned 1
	[0104.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x20
	[0104.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.078] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.078] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0104.079] GetLastError () returned 0x0
	[0104.079] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x128, lpOverlapped=0x0) returned 1
	[0104.080] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x130, lpOverlapped=0x0) returned 1
	[0104.082] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.082] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.083] SetEndOfFile (hFile=0x184) returned 1
	[0104.083] CloseHandle (hObject=0x184) returned 1
	[0104.083] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.083] SetEndOfFile (hFile=0x1d8) returned 1
	[0104.084] CloseHandle (hObject=0x1d8) returned 1
	[0104.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 1
	[0104.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0104.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0104.085] lstrlenW (lpString=".doc") returned 4
	[0104.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.085] lstrlenW (lpString=".docx") returned 5
	[0104.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.085] lstrlenW (lpString=".pdf") returned 4
	[0104.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.085] lstrlenW (lpString=".xls") returned 4
	[0104.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.085] lstrlenW (lpString=".xlsx") returned 5
	[0104.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.085] lstrlenW (lpString=".ppt") returned 4
	[0104.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0104.085] lstrlenW (lpString=".zip") returned 4
	[0104.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.085] lstrlenW (lpString=".rar") returned 4
	[0104.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.085] lstrlenW (lpString=".bz2") returned 4
	[0104.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.085] lstrlenW (lpString=".7z") returned 3
	[0104.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0104.086] lstrlenW (lpString=".dbf") returned 4
	[0104.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0104.086] lstrlenW (lpString=".1cd") returned 4
	[0104.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0104.086] lstrlenW (lpString=".jpg") returned 4
	[0104.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0104.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0104.086] lstrlenW (lpString=".doc") returned 4
	[0104.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.086] lstrlenW (lpString=".docx") returned 5
	[0104.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.086] lstrlenW (lpString=".pdf") returned 4
	[0104.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.087] lstrlenW (lpString=".xls") returned 4
	[0104.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.087] lstrlenW (lpString=".xlsx") returned 5
	[0104.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.087] lstrlenW (lpString=".ppt") returned 4
	[0104.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0104.087] lstrlenW (lpString=".zip") returned 4
	[0104.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.087] lstrlenW (lpString=".rar") returned 4
	[0104.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.087] lstrlenW (lpString=".bz2") returned 4
	[0104.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.087] lstrlenW (lpString=".7z") returned 3
	[0104.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0104.087] lstrlenW (lpString=".dbf") returned 4
	[0104.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0104.087] lstrlenW (lpString=".1cd") returned 4
	[0104.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0104.087] lstrlenW (lpString=".jpg") returned 4
	[0104.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.088] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.088] lstrlenW (lpString="DD01631_.WMF") returned 12
	[0104.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.102] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=552) returned 1
	[0104.102] CloseHandle (hObject=0x1d8) returned 1
	[0104.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x20
	[0104.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.103] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.103] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0104.104] GetLastError () returned 0x0
	[0104.104] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x228, lpOverlapped=0x0) returned 1
	[0104.105] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x230, lpOverlapped=0x0) returned 1
	[0104.106] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.106] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.106] SetEndOfFile (hFile=0x184) returned 1
	[0104.106] CloseHandle (hObject=0x184) returned 1
	[0104.107] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.107] SetEndOfFile (hFile=0x1d8) returned 1
	[0104.108] CloseHandle (hObject=0x1d8) returned 1
	[0104.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 1
	[0104.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0104.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0104.109] lstrlenW (lpString=".doc") returned 4
	[0104.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.109] lstrlenW (lpString=".docx") returned 5
	[0104.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.109] lstrlenW (lpString=".pdf") returned 4
	[0104.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.109] lstrlenW (lpString=".xls") returned 4
	[0104.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.109] lstrlenW (lpString=".xlsx") returned 5
	[0104.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.109] lstrlenW (lpString=".ppt") returned 4
	[0104.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0104.109] lstrlenW (lpString=".zip") returned 4
	[0104.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.109] lstrlenW (lpString=".rar") returned 4
	[0104.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.109] lstrlenW (lpString=".bz2") returned 4
	[0104.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.109] lstrlenW (lpString=".7z") returned 3
	[0104.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0104.109] lstrlenW (lpString=".dbf") returned 4
	[0104.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0104.110] lstrlenW (lpString=".1cd") returned 4
	[0104.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0104.110] lstrlenW (lpString=".jpg") returned 4
	[0104.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0104.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0104.110] lstrlenW (lpString=".doc") returned 4
	[0104.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.110] lstrlenW (lpString=".docx") returned 5
	[0104.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.110] lstrlenW (lpString=".pdf") returned 4
	[0104.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.110] lstrlenW (lpString=".xls") returned 4
	[0104.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.110] lstrlenW (lpString=".xlsx") returned 5
	[0104.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.110] lstrlenW (lpString=".ppt") returned 4
	[0104.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0104.110] lstrlenW (lpString=".zip") returned 4
	[0104.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.110] lstrlenW (lpString=".rar") returned 4
	[0104.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.111] lstrlenW (lpString=".bz2") returned 4
	[0104.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.111] lstrlenW (lpString=".7z") returned 3
	[0104.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0104.111] lstrlenW (lpString=".dbf") returned 4
	[0104.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0104.111] lstrlenW (lpString=".1cd") returned 4
	[0104.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0104.111] lstrlenW (lpString=".jpg") returned 4
	[0104.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.111] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.111] lstrlenW (lpString="DD01772_.WMF") returned 12
	[0104.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.126] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2300) returned 1
	[0104.126] CloseHandle (hObject=0x1e8) returned 1
	[0104.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x20
	[0104.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0104.179] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.180] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0104.204] GetLastError () returned 0x0
	[0104.204] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x8fc, lpOverlapped=0x0) returned 1
	[0104.207] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x900, lpOverlapped=0x0) returned 1
	[0104.208] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.208] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.208] SetEndOfFile (hFile=0x1e4) returned 1
	[0104.209] CloseHandle (hObject=0x1e4) returned 1
	[0104.209] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.209] SetEndOfFile (hFile=0x184) returned 1
	[0104.209] CloseHandle (hObject=0x184) returned 1
	[0104.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 1
	[0104.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0104.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0104.210] lstrlenW (lpString=".doc") returned 4
	[0104.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.210] lstrlenW (lpString=".docx") returned 5
	[0104.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.210] lstrlenW (lpString=".pdf") returned 4
	[0104.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.210] lstrlenW (lpString=".xls") returned 4
	[0104.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.210] lstrlenW (lpString=".xlsx") returned 5
	[0104.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.210] lstrlenW (lpString=".ppt") returned 4
	[0104.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0104.211] lstrlenW (lpString=".zip") returned 4
	[0104.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.211] lstrlenW (lpString=".rar") returned 4
	[0104.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.211] lstrlenW (lpString=".bz2") returned 4
	[0104.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.211] lstrlenW (lpString=".7z") returned 3
	[0104.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0104.211] lstrlenW (lpString=".dbf") returned 4
	[0104.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0104.211] lstrlenW (lpString=".1cd") returned 4
	[0104.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0104.211] lstrlenW (lpString=".jpg") returned 4
	[0104.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0104.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0104.211] lstrlenW (lpString=".doc") returned 4
	[0104.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.211] lstrlenW (lpString=".docx") returned 5
	[0104.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.211] lstrlenW (lpString=".pdf") returned 4
	[0104.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.211] lstrlenW (lpString=".xls") returned 4
	[0104.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.211] lstrlenW (lpString=".xlsx") returned 5
	[0104.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.211] lstrlenW (lpString=".ppt") returned 4
	[0104.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0104.212] lstrlenW (lpString=".zip") returned 4
	[0104.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.212] lstrlenW (lpString=".rar") returned 4
	[0104.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.212] lstrlenW (lpString=".bz2") returned 4
	[0104.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.212] lstrlenW (lpString=".7z") returned 3
	[0104.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0104.212] lstrlenW (lpString=".dbf") returned 4
	[0104.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0104.212] lstrlenW (lpString=".1cd") returned 4
	[0104.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0104.212] lstrlenW (lpString=".jpg") returned 4
	[0104.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.212] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.212] lstrlenW (lpString="ED00010_.WMF") returned 12
	[0104.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0104.213] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1382) returned 1
	[0104.213] CloseHandle (hObject=0x184) returned 1
	[0104.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20
	[0104.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0104.214] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.214] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0104.215] GetLastError () returned 0x0
	[0104.215] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x566, lpOverlapped=0x0) returned 1
	[0104.231] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x570, lpOverlapped=0x0) returned 1
	[0104.232] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.232] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.232] SetEndOfFile (hFile=0x1e4) returned 1
	[0104.233] CloseHandle (hObject=0x1e4) returned 1
	[0104.233] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.233] SetEndOfFile (hFile=0x184) returned 1
	[0104.234] CloseHandle (hObject=0x184) returned 1
	[0104.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 1
	[0104.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0104.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0104.235] lstrlenW (lpString=".doc") returned 4
	[0104.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.235] lstrlenW (lpString=".docx") returned 5
	[0104.235] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.235] lstrlenW (lpString=".pdf") returned 4
	[0104.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.235] lstrlenW (lpString=".xls") returned 4
	[0104.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.235] lstrlenW (lpString=".xlsx") returned 5
	[0104.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.235] lstrlenW (lpString=".ppt") returned 4
	[0104.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0104.235] lstrlenW (lpString=".zip") returned 4
	[0104.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.235] lstrlenW (lpString=".rar") returned 4
	[0104.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.235] lstrlenW (lpString=".bz2") returned 4
	[0104.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.235] lstrlenW (lpString=".7z") returned 3
	[0104.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0104.235] lstrlenW (lpString=".dbf") returned 4
	[0104.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0104.235] lstrlenW (lpString=".1cd") returned 4
	[0104.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0104.235] lstrlenW (lpString=".jpg") returned 4
	[0104.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0104.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0104.236] lstrlenW (lpString=".doc") returned 4
	[0104.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.236] lstrlenW (lpString=".docx") returned 5
	[0104.236] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.236] lstrlenW (lpString=".pdf") returned 4
	[0104.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.236] lstrlenW (lpString=".xls") returned 4
	[0104.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.236] lstrlenW (lpString=".xlsx") returned 5
	[0104.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.236] lstrlenW (lpString=".ppt") returned 4
	[0104.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0104.236] lstrlenW (lpString=".zip") returned 4
	[0104.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.236] lstrlenW (lpString=".rar") returned 4
	[0104.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.236] lstrlenW (lpString=".bz2") returned 4
	[0104.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.236] lstrlenW (lpString=".7z") returned 3
	[0104.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0104.236] lstrlenW (lpString=".dbf") returned 4
	[0104.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0104.237] lstrlenW (lpString=".1cd") returned 4
	[0104.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0104.237] lstrlenW (lpString=".jpg") returned 4
	[0104.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.237] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.237] lstrlenW (lpString="ED00172_.WMF") returned 12
	[0104.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0104.238] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2700) returned 1
	[0104.238] CloseHandle (hObject=0x184) returned 1
	[0104.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x20
	[0104.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0104.239] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.239] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0104.239] GetLastError () returned 0x0
	[0104.239] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xa8c, lpOverlapped=0x0) returned 1
	[0104.256] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa90, lpOverlapped=0x0) returned 1
	[0104.257] ReadFile (in: hFile=0x184, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.257] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.257] SetEndOfFile (hFile=0x1e4) returned 1
	[0104.257] CloseHandle (hObject=0x1e4) returned 1
	[0104.257] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.257] SetEndOfFile (hFile=0x184) returned 1
	[0104.258] CloseHandle (hObject=0x184) returned 1
	[0104.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 1
	[0104.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0104.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0104.258] lstrlenW (lpString=".doc") returned 4
	[0104.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.258] lstrlenW (lpString=".docx") returned 5
	[0104.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.259] lstrlenW (lpString=".pdf") returned 4
	[0104.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.259] lstrlenW (lpString=".xls") returned 4
	[0104.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.259] lstrlenW (lpString=".xlsx") returned 5
	[0104.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.259] lstrlenW (lpString=".ppt") returned 4
	[0104.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0104.259] lstrlenW (lpString=".zip") returned 4
	[0104.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.259] lstrlenW (lpString=".rar") returned 4
	[0104.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.259] lstrlenW (lpString=".bz2") returned 4
	[0104.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.259] lstrlenW (lpString=".7z") returned 3
	[0104.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0104.259] lstrlenW (lpString=".dbf") returned 4
	[0104.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0104.259] lstrlenW (lpString=".1cd") returned 4
	[0104.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0104.259] lstrlenW (lpString=".jpg") returned 4
	[0104.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0104.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0104.259] lstrlenW (lpString=".doc") returned 4
	[0104.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.260] lstrlenW (lpString=".docx") returned 5
	[0104.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.260] lstrlenW (lpString=".pdf") returned 4
	[0104.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.260] lstrlenW (lpString=".xls") returned 4
	[0104.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.260] lstrlenW (lpString=".xlsx") returned 5
	[0104.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.260] lstrlenW (lpString=".ppt") returned 4
	[0104.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0104.260] lstrlenW (lpString=".zip") returned 4
	[0104.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.260] lstrlenW (lpString=".rar") returned 4
	[0104.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.260] lstrlenW (lpString=".bz2") returned 4
	[0104.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.260] lstrlenW (lpString=".7z") returned 3
	[0104.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0104.260] lstrlenW (lpString=".dbf") returned 4
	[0104.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0104.260] lstrlenW (lpString=".1cd") returned 4
	[0104.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0104.260] lstrlenW (lpString=".jpg") returned 4
	[0104.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.261] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.261] lstrlenW (lpString="EN00006_.WMF") returned 12
	[0104.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.275] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=13936) returned 1
	[0104.275] CloseHandle (hObject=0x1a8) returned 1
	[0104.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 0x20
	[0104.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.309] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.309] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.314] GetLastError () returned 0x0
	[0104.314] ReadFile (in: hFile=0x1e8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x3670, lpOverlapped=0x0) returned 1
	[0104.319] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3680, lpOverlapped=0x0) returned 1
	[0104.320] ReadFile (in: hFile=0x1e8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.320] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.320] SetEndOfFile (hFile=0x1a8) returned 1
	[0104.320] CloseHandle (hObject=0x1a8) returned 1
	[0104.320] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.320] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.321] CloseHandle (hObject=0x1e8) returned 1
	[0104.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 1
	[0104.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0104.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0104.322] lstrlenW (lpString=".doc") returned 4
	[0104.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.322] lstrlenW (lpString=".docx") returned 5
	[0104.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.322] lstrlenW (lpString=".pdf") returned 4
	[0104.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.322] lstrlenW (lpString=".xls") returned 4
	[0104.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.322] lstrlenW (lpString=".xlsx") returned 5
	[0104.322] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.322] lstrlenW (lpString=".ppt") returned 4
	[0104.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0104.322] lstrlenW (lpString=".zip") returned 4
	[0104.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.322] lstrlenW (lpString=".rar") returned 4
	[0104.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.322] lstrlenW (lpString=".bz2") returned 4
	[0104.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.322] lstrlenW (lpString=".7z") returned 3
	[0104.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0104.322] lstrlenW (lpString=".dbf") returned 4
	[0104.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0104.323] lstrlenW (lpString=".1cd") returned 4
	[0104.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0104.323] lstrlenW (lpString=".jpg") returned 4
	[0104.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0104.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0104.323] lstrlenW (lpString=".doc") returned 4
	[0104.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.323] lstrlenW (lpString=".docx") returned 5
	[0104.323] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.323] lstrlenW (lpString=".pdf") returned 4
	[0104.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.323] lstrlenW (lpString=".xls") returned 4
	[0104.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.323] lstrlenW (lpString=".xlsx") returned 5
	[0104.323] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.323] lstrlenW (lpString=".ppt") returned 4
	[0104.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0104.323] lstrlenW (lpString=".zip") returned 4
	[0104.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.323] lstrlenW (lpString=".rar") returned 4
	[0104.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.323] lstrlenW (lpString=".bz2") returned 4
	[0104.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.323] lstrlenW (lpString=".7z") returned 3
	[0104.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0104.324] lstrlenW (lpString=".dbf") returned 4
	[0104.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0104.324] lstrlenW (lpString=".1cd") returned 4
	[0104.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0104.324] lstrlenW (lpString=".jpg") returned 4
	[0104.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.324] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.324] lstrlenW (lpString="EN00222_.WMF") returned 12
	[0104.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.325] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=12356) returned 1
	[0104.325] CloseHandle (hObject=0x1e8) returned 1
	[0104.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 0x20
	[0104.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.326] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.326] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.327] GetLastError () returned 0x0
	[0104.327] ReadFile (in: hFile=0x1e8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x3044, lpOverlapped=0x0) returned 1
	[0104.338] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3050, lpOverlapped=0x0) returned 1
	[0104.340] ReadFile (in: hFile=0x1e8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.340] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.340] SetEndOfFile (hFile=0x1a8) returned 1
	[0104.340] CloseHandle (hObject=0x1a8) returned 1
	[0104.340] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.340] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.341] CloseHandle (hObject=0x1e8) returned 1
	[0104.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 1
	[0104.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0104.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0104.343] lstrlenW (lpString=".doc") returned 4
	[0104.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.343] lstrlenW (lpString=".docx") returned 5
	[0104.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.343] lstrlenW (lpString=".pdf") returned 4
	[0104.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.343] lstrlenW (lpString=".xls") returned 4
	[0104.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.343] lstrlenW (lpString=".xlsx") returned 5
	[0104.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.343] lstrlenW (lpString=".ppt") returned 4
	[0104.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0104.344] lstrlenW (lpString=".zip") returned 4
	[0104.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.344] lstrlenW (lpString=".rar") returned 4
	[0104.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.344] lstrlenW (lpString=".bz2") returned 4
	[0104.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.344] lstrlenW (lpString=".7z") returned 3
	[0104.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0104.344] lstrlenW (lpString=".dbf") returned 4
	[0104.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0104.344] lstrlenW (lpString=".1cd") returned 4
	[0104.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0104.344] lstrlenW (lpString=".jpg") returned 4
	[0104.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0104.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0104.344] lstrlenW (lpString=".doc") returned 4
	[0104.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.344] lstrlenW (lpString=".docx") returned 5
	[0104.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.345] lstrlenW (lpString=".pdf") returned 4
	[0104.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.345] lstrlenW (lpString=".xls") returned 4
	[0104.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.345] lstrlenW (lpString=".xlsx") returned 5
	[0104.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.345] lstrlenW (lpString=".ppt") returned 4
	[0104.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0104.345] lstrlenW (lpString=".zip") returned 4
	[0104.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.345] lstrlenW (lpString=".rar") returned 4
	[0104.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.345] lstrlenW (lpString=".bz2") returned 4
	[0104.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.345] lstrlenW (lpString=".7z") returned 3
	[0104.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0104.345] lstrlenW (lpString=".dbf") returned 4
	[0104.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0104.345] lstrlenW (lpString=".1cd") returned 4
	[0104.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0104.345] lstrlenW (lpString=".jpg") returned 4
	[0104.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.346] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.346] lstrlenW (lpString="EN00319_.WMF") returned 12
	[0104.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.353] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2280) returned 1
	[0104.353] CloseHandle (hObject=0x1a8) returned 1
	[0104.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 0x20
	[0104.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0104.397] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.397] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0104.405] GetLastError () returned 0x0
	[0104.405] ReadFile (in: hFile=0x1b8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x8e8, lpOverlapped=0x0) returned 1
	[0104.417] WriteFile (in: hFile=0x1d0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x8f0, lpOverlapped=0x0) returned 1
	[0104.418] ReadFile (in: hFile=0x1b8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.418] WriteFile (in: hFile=0x1d0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.418] SetEndOfFile (hFile=0x1d0) returned 1
	[0104.418] CloseHandle (hObject=0x1d0) returned 1
	[0104.418] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.418] SetEndOfFile (hFile=0x1b8) returned 1
	[0104.419] CloseHandle (hObject=0x1b8) returned 1
	[0104.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 1
	[0104.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0104.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0104.420] lstrlenW (lpString=".doc") returned 4
	[0104.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.420] lstrlenW (lpString=".docx") returned 5
	[0104.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.420] lstrlenW (lpString=".pdf") returned 4
	[0104.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.420] lstrlenW (lpString=".xls") returned 4
	[0104.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.420] lstrlenW (lpString=".xlsx") returned 5
	[0104.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.420] lstrlenW (lpString=".ppt") returned 4
	[0104.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0104.420] lstrlenW (lpString=".zip") returned 4
	[0104.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.420] lstrlenW (lpString=".rar") returned 4
	[0104.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.420] lstrlenW (lpString=".bz2") returned 4
	[0104.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.421] lstrlenW (lpString=".7z") returned 3
	[0104.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0104.421] lstrlenW (lpString=".dbf") returned 4
	[0104.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0104.421] lstrlenW (lpString=".1cd") returned 4
	[0104.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0104.421] lstrlenW (lpString=".jpg") returned 4
	[0104.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0104.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0104.421] lstrlenW (lpString=".doc") returned 4
	[0104.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.421] lstrlenW (lpString=".docx") returned 5
	[0104.421] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.421] lstrlenW (lpString=".pdf") returned 4
	[0104.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.421] lstrlenW (lpString=".xls") returned 4
	[0104.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.421] lstrlenW (lpString=".xlsx") returned 5
	[0104.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.421] lstrlenW (lpString=".ppt") returned 4
	[0104.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0104.421] lstrlenW (lpString=".zip") returned 4
	[0104.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.422] lstrlenW (lpString=".rar") returned 4
	[0104.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.422] lstrlenW (lpString=".bz2") returned 4
	[0104.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.422] lstrlenW (lpString=".7z") returned 3
	[0104.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0104.422] lstrlenW (lpString=".dbf") returned 4
	[0104.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0104.422] lstrlenW (lpString=".1cd") returned 4
	[0104.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0104.422] lstrlenW (lpString=".jpg") returned 4
	[0104.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.422] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.422] lstrlenW (lpString="EN00397_.WMF") returned 12
	[0104.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0104.423] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=17308) returned 1
	[0104.423] CloseHandle (hObject=0x1b8) returned 1
	[0104.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 0x20
	[0104.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0104.424] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.424] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0104.425] GetLastError () returned 0x0
	[0104.425] ReadFile (in: hFile=0x1b8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x439c, lpOverlapped=0x0) returned 1
	[0104.433] WriteFile (in: hFile=0x1d0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x43a0, lpOverlapped=0x0) returned 1
	[0104.435] ReadFile (in: hFile=0x1b8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.435] WriteFile (in: hFile=0x1d0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.435] SetEndOfFile (hFile=0x1d0) returned 1
	[0104.436] CloseHandle (hObject=0x1d0) returned 1
	[0104.436] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.436] SetEndOfFile (hFile=0x1b8) returned 1
	[0104.437] CloseHandle (hObject=0x1b8) returned 1
	[0104.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 1
	[0104.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0104.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0104.438] lstrlenW (lpString=".doc") returned 4
	[0104.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.438] lstrlenW (lpString=".docx") returned 5
	[0104.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.438] lstrlenW (lpString=".pdf") returned 4
	[0104.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.439] lstrlenW (lpString=".xls") returned 4
	[0104.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.439] lstrlenW (lpString=".xlsx") returned 5
	[0104.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.439] lstrlenW (lpString=".ppt") returned 4
	[0104.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0104.439] lstrlenW (lpString=".zip") returned 4
	[0104.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.439] lstrlenW (lpString=".rar") returned 4
	[0104.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.439] lstrlenW (lpString=".bz2") returned 4
	[0104.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.439] lstrlenW (lpString=".7z") returned 3
	[0104.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0104.439] lstrlenW (lpString=".dbf") returned 4
	[0104.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0104.439] lstrlenW (lpString=".1cd") returned 4
	[0104.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0104.439] lstrlenW (lpString=".jpg") returned 4
	[0104.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0104.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0104.440] lstrlenW (lpString=".doc") returned 4
	[0104.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.440] lstrlenW (lpString=".docx") returned 5
	[0104.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.440] lstrlenW (lpString=".pdf") returned 4
	[0104.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.440] lstrlenW (lpString=".xls") returned 4
	[0104.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.440] lstrlenW (lpString=".xlsx") returned 5
	[0104.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.440] lstrlenW (lpString=".ppt") returned 4
	[0104.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0104.440] lstrlenW (lpString=".zip") returned 4
	[0104.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.440] lstrlenW (lpString=".rar") returned 4
	[0104.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.440] lstrlenW (lpString=".bz2") returned 4
	[0104.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.440] lstrlenW (lpString=".7z") returned 3
	[0104.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0104.440] lstrlenW (lpString=".dbf") returned 4
	[0104.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0104.440] lstrlenW (lpString=".1cd") returned 4
	[0104.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0104.441] lstrlenW (lpString=".jpg") returned 4
	[0104.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.441] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.441] lstrlenW (lpString="FD00074_.WMF") returned 12
	[0104.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.454] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=17850) returned 1
	[0104.454] CloseHandle (hObject=0x1e8) returned 1
	[0104.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x20
	[0104.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.490] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.490] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0104.494] GetLastError () returned 0x0
	[0104.494] ReadFile (in: hFile=0x1c4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x45ba, lpOverlapped=0x0) returned 1
	[0104.508] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x45c0, lpOverlapped=0x0) returned 1
	[0104.510] ReadFile (in: hFile=0x1c4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.511] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.511] SetEndOfFile (hFile=0x1e0) returned 1
	[0104.511] CloseHandle (hObject=0x1e0) returned 1
	[0104.511] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.511] SetEndOfFile (hFile=0x1c4) returned 1
	[0104.512] CloseHandle (hObject=0x1c4) returned 1
	[0104.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 1
	[0104.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0104.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0104.513] lstrlenW (lpString=".doc") returned 4
	[0104.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.513] lstrlenW (lpString=".docx") returned 5
	[0104.513] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.513] lstrlenW (lpString=".pdf") returned 4
	[0104.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.513] lstrlenW (lpString=".xls") returned 4
	[0104.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.513] lstrlenW (lpString=".xlsx") returned 5
	[0104.513] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.513] lstrlenW (lpString=".ppt") returned 4
	[0104.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0104.513] lstrlenW (lpString=".zip") returned 4
	[0104.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.513] lstrlenW (lpString=".rar") returned 4
	[0104.514] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.514] lstrlenW (lpString=".bz2") returned 4
	[0104.514] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.514] lstrlenW (lpString=".7z") returned 3
	[0104.514] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0104.514] lstrlenW (lpString=".dbf") returned 4
	[0104.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0104.514] lstrlenW (lpString=".1cd") returned 4
	[0104.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0104.514] lstrlenW (lpString=".jpg") returned 4
	[0104.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0104.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0104.514] lstrlenW (lpString=".doc") returned 4
	[0104.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.514] lstrlenW (lpString=".docx") returned 5
	[0104.514] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.514] lstrlenW (lpString=".pdf") returned 4
	[0104.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.514] lstrlenW (lpString=".xls") returned 4
	[0104.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.515] lstrlenW (lpString=".xlsx") returned 5
	[0104.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.515] lstrlenW (lpString=".ppt") returned 4
	[0104.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0104.515] lstrlenW (lpString=".zip") returned 4
	[0104.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.515] lstrlenW (lpString=".rar") returned 4
	[0104.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.515] lstrlenW (lpString=".bz2") returned 4
	[0104.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.515] lstrlenW (lpString=".7z") returned 3
	[0104.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0104.515] lstrlenW (lpString=".dbf") returned 4
	[0104.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0104.515] lstrlenW (lpString=".1cd") returned 4
	[0104.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0104.515] lstrlenW (lpString=".jpg") returned 4
	[0104.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.515] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.516] lstrlenW (lpString="FD00077_.WMF") returned 12
	[0104.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.527] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=30240) returned 1
	[0104.527] CloseHandle (hObject=0x1e8) returned 1
	[0104.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x20
	[0104.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.731] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.731] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0104.752] GetLastError () returned 0x0
	[0104.752] ReadFile (in: hFile=0x1dc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x7620, lpOverlapped=0x0) returned 1
	[0104.794] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7630, lpOverlapped=0x0) returned 1
	[0104.795] ReadFile (in: hFile=0x1dc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.795] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.795] SetEndOfFile (hFile=0x1f0) returned 1
	[0104.796] CloseHandle (hObject=0x1f0) returned 1
	[0104.796] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.796] SetEndOfFile (hFile=0x1dc) returned 1
	[0104.797] CloseHandle (hObject=0x1dc) returned 1
	[0104.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 1
	[0104.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0104.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0104.798] lstrlenW (lpString=".doc") returned 4
	[0104.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.798] lstrlenW (lpString=".docx") returned 5
	[0104.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.798] lstrlenW (lpString=".pdf") returned 4
	[0104.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.798] lstrlenW (lpString=".xls") returned 4
	[0104.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.798] lstrlenW (lpString=".xlsx") returned 5
	[0104.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.798] lstrlenW (lpString=".ppt") returned 4
	[0104.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0104.798] lstrlenW (lpString=".zip") returned 4
	[0104.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.798] lstrlenW (lpString=".rar") returned 4
	[0104.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.798] lstrlenW (lpString=".bz2") returned 4
	[0104.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.799] lstrlenW (lpString=".7z") returned 3
	[0104.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0104.799] lstrlenW (lpString=".dbf") returned 4
	[0104.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0104.799] lstrlenW (lpString=".1cd") returned 4
	[0104.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0104.799] lstrlenW (lpString=".jpg") returned 4
	[0104.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0104.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0104.799] lstrlenW (lpString=".doc") returned 4
	[0104.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.799] lstrlenW (lpString=".docx") returned 5
	[0104.799] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.799] lstrlenW (lpString=".pdf") returned 4
	[0104.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.799] lstrlenW (lpString=".xls") returned 4
	[0104.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.799] lstrlenW (lpString=".xlsx") returned 5
	[0104.799] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.799] lstrlenW (lpString=".ppt") returned 4
	[0104.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0104.800] lstrlenW (lpString=".zip") returned 4
	[0104.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.800] lstrlenW (lpString=".rar") returned 4
	[0104.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.800] lstrlenW (lpString=".bz2") returned 4
	[0104.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.800] lstrlenW (lpString=".7z") returned 3
	[0104.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0104.800] lstrlenW (lpString=".dbf") returned 4
	[0104.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0104.800] lstrlenW (lpString=".1cd") returned 4
	[0104.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0104.800] lstrlenW (lpString=".jpg") returned 4
	[0104.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.800] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.801] lstrlenW (lpString="FD00090_.WMF") returned 12
	[0104.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.802] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=14194) returned 1
	[0104.802] CloseHandle (hObject=0x1dc) returned 1
	[0104.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x20
	[0104.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.802] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.803] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0104.804] GetLastError () returned 0x0
	[0104.804] ReadFile (in: hFile=0x1dc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x3772, lpOverlapped=0x0) returned 1
	[0104.806] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3780, lpOverlapped=0x0) returned 1
	[0104.807] ReadFile (in: hFile=0x1dc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.807] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.807] SetEndOfFile (hFile=0x1f0) returned 1
	[0104.808] CloseHandle (hObject=0x1f0) returned 1
	[0104.808] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.808] SetEndOfFile (hFile=0x1dc) returned 1
	[0104.809] CloseHandle (hObject=0x1dc) returned 1
	[0104.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 1
	[0104.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0104.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0104.809] lstrlenW (lpString=".doc") returned 4
	[0104.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.810] lstrlenW (lpString=".docx") returned 5
	[0104.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.810] lstrlenW (lpString=".pdf") returned 4
	[0104.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.810] lstrlenW (lpString=".xls") returned 4
	[0104.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.810] lstrlenW (lpString=".xlsx") returned 5
	[0104.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.810] lstrlenW (lpString=".ppt") returned 4
	[0104.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0104.810] lstrlenW (lpString=".zip") returned 4
	[0104.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.810] lstrlenW (lpString=".rar") returned 4
	[0104.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.810] lstrlenW (lpString=".bz2") returned 4
	[0104.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.810] lstrlenW (lpString=".7z") returned 3
	[0104.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0104.810] lstrlenW (lpString=".dbf") returned 4
	[0104.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0104.811] lstrlenW (lpString=".1cd") returned 4
	[0104.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0104.811] lstrlenW (lpString=".jpg") returned 4
	[0104.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0104.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0104.811] lstrlenW (lpString=".doc") returned 4
	[0104.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.811] lstrlenW (lpString=".docx") returned 5
	[0104.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.811] lstrlenW (lpString=".pdf") returned 4
	[0104.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.811] lstrlenW (lpString=".xls") returned 4
	[0104.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.812] lstrlenW (lpString=".xlsx") returned 5
	[0104.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.812] lstrlenW (lpString=".ppt") returned 4
	[0104.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0104.812] lstrlenW (lpString=".zip") returned 4
	[0104.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.812] lstrlenW (lpString=".rar") returned 4
	[0104.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.812] lstrlenW (lpString=".bz2") returned 4
	[0104.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.812] lstrlenW (lpString=".7z") returned 3
	[0104.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0104.812] lstrlenW (lpString=".dbf") returned 4
	[0104.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0104.812] lstrlenW (lpString=".1cd") returned 4
	[0104.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0104.812] lstrlenW (lpString=".jpg") returned 4
	[0104.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.813] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.813] lstrlenW (lpString="FD00096_.WMF") returned 12
	[0104.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.814] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=37390) returned 1
	[0104.814] CloseHandle (hObject=0x1dc) returned 1
	[0104.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x20
	[0104.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.815] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.815] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0104.816] GetLastError () returned 0x0
	[0104.816] ReadFile (in: hFile=0x1dc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x920e, lpOverlapped=0x0) returned 1
	[0104.818] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x9210, lpOverlapped=0x0) returned 1
	[0104.820] ReadFile (in: hFile=0x1dc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.820] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.820] SetEndOfFile (hFile=0x1f0) returned 1
	[0104.820] CloseHandle (hObject=0x1f0) returned 1
	[0104.821] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.821] SetEndOfFile (hFile=0x1dc) returned 1
	[0104.822] CloseHandle (hObject=0x1dc) returned 1
	[0104.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 1
	[0104.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0104.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0104.823] lstrlenW (lpString=".doc") returned 4
	[0104.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.823] lstrlenW (lpString=".docx") returned 5
	[0104.823] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.823] lstrlenW (lpString=".pdf") returned 4
	[0104.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.823] lstrlenW (lpString=".xls") returned 4
	[0104.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.823] lstrlenW (lpString=".xlsx") returned 5
	[0104.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.823] lstrlenW (lpString=".ppt") returned 4
	[0104.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0104.823] lstrlenW (lpString=".zip") returned 4
	[0104.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.823] lstrlenW (lpString=".rar") returned 4
	[0104.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.823] lstrlenW (lpString=".bz2") returned 4
	[0104.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.823] lstrlenW (lpString=".7z") returned 3
	[0104.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0104.824] lstrlenW (lpString=".dbf") returned 4
	[0104.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0104.824] lstrlenW (lpString=".1cd") returned 4
	[0104.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0104.824] lstrlenW (lpString=".jpg") returned 4
	[0104.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0104.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0104.824] lstrlenW (lpString=".doc") returned 4
	[0104.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.824] lstrlenW (lpString=".docx") returned 5
	[0104.824] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.824] lstrlenW (lpString=".pdf") returned 4
	[0104.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.824] lstrlenW (lpString=".xls") returned 4
	[0104.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.824] lstrlenW (lpString=".xlsx") returned 5
	[0104.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.824] lstrlenW (lpString=".ppt") returned 4
	[0104.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0104.825] lstrlenW (lpString=".zip") returned 4
	[0104.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.825] lstrlenW (lpString=".rar") returned 4
	[0104.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.825] lstrlenW (lpString=".bz2") returned 4
	[0104.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.825] lstrlenW (lpString=".7z") returned 3
	[0104.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0104.825] lstrlenW (lpString=".dbf") returned 4
	[0104.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0104.825] lstrlenW (lpString=".1cd") returned 4
	[0104.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0104.825] lstrlenW (lpString=".jpg") returned 4
	[0104.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.825] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.825] lstrlenW (lpString="FD00296_.WMF") returned 12
	[0104.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.826] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=15856) returned 1
	[0104.826] CloseHandle (hObject=0x1dc) returned 1
	[0104.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x20
	[0104.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.827] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.827] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0104.828] GetLastError () returned 0x0
	[0104.828] ReadFile (in: hFile=0x1dc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x3df0, lpOverlapped=0x0) returned 1
	[0104.891] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3e00, lpOverlapped=0x0) returned 1
	[0104.893] ReadFile (in: hFile=0x1dc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.893] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.893] SetEndOfFile (hFile=0x1f0) returned 1
	[0104.893] CloseHandle (hObject=0x1f0) returned 1
	[0104.893] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.893] SetEndOfFile (hFile=0x1dc) returned 1
	[0104.895] CloseHandle (hObject=0x1dc) returned 1
	[0104.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 1
	[0104.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0104.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0104.920] lstrlenW (lpString=".doc") returned 4
	[0104.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.920] lstrlenW (lpString=".docx") returned 5
	[0104.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.921] lstrlenW (lpString=".pdf") returned 4
	[0104.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.921] lstrlenW (lpString=".xls") returned 4
	[0104.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.921] lstrlenW (lpString=".xlsx") returned 5
	[0104.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.921] lstrlenW (lpString=".ppt") returned 4
	[0104.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0104.921] lstrlenW (lpString=".zip") returned 4
	[0104.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.921] lstrlenW (lpString=".rar") returned 4
	[0104.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.921] lstrlenW (lpString=".bz2") returned 4
	[0104.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.921] lstrlenW (lpString=".7z") returned 3
	[0104.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0104.921] lstrlenW (lpString=".dbf") returned 4
	[0104.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0104.921] lstrlenW (lpString=".1cd") returned 4
	[0104.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0104.921] lstrlenW (lpString=".jpg") returned 4
	[0104.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0104.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0104.922] lstrlenW (lpString=".doc") returned 4
	[0104.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.922] lstrlenW (lpString=".docx") returned 5
	[0104.922] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.922] lstrlenW (lpString=".pdf") returned 4
	[0104.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.922] lstrlenW (lpString=".xls") returned 4
	[0104.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.922] lstrlenW (lpString=".xlsx") returned 5
	[0104.922] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.922] lstrlenW (lpString=".ppt") returned 4
	[0104.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0104.922] lstrlenW (lpString=".zip") returned 4
	[0104.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.922] lstrlenW (lpString=".rar") returned 4
	[0104.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.923] lstrlenW (lpString=".bz2") returned 4
	[0104.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.923] lstrlenW (lpString=".7z") returned 3
	[0104.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0104.923] lstrlenW (lpString=".dbf") returned 4
	[0104.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0104.923] lstrlenW (lpString=".1cd") returned 4
	[0104.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0104.923] lstrlenW (lpString=".jpg") returned 4
	[0104.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.924] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.924] lstrlenW (lpString="FD00306_.WMF") returned 12
	[0104.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.932] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=46814) returned 1
	[0104.932] CloseHandle (hObject=0x1c4) returned 1
	[0104.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x20
	[0104.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.945] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.946] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0104.949] GetLastError () returned 0x0
	[0104.949] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xb6de, lpOverlapped=0x0) returned 1
	[0104.966] WriteFile (in: hFile=0x1f4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xb6e0, lpOverlapped=0x0) returned 1
	[0104.968] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.969] WriteFile (in: hFile=0x1f4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.969] SetEndOfFile (hFile=0x1f4) returned 1
	[0104.969] CloseHandle (hObject=0x1f4) returned 1
	[0104.969] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.969] SetEndOfFile (hFile=0x1d8) returned 1
	[0104.971] CloseHandle (hObject=0x1d8) returned 1
	[0104.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 1
	[0104.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0104.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0104.971] lstrlenW (lpString=".doc") returned 4
	[0104.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.971] lstrlenW (lpString=".docx") returned 5
	[0104.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.971] lstrlenW (lpString=".pdf") returned 4
	[0104.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.972] lstrlenW (lpString=".xls") returned 4
	[0104.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.972] lstrlenW (lpString=".xlsx") returned 5
	[0104.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.972] lstrlenW (lpString=".ppt") returned 4
	[0104.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0104.972] lstrlenW (lpString=".zip") returned 4
	[0104.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.972] lstrlenW (lpString=".rar") returned 4
	[0104.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.972] lstrlenW (lpString=".bz2") returned 4
	[0104.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.972] lstrlenW (lpString=".7z") returned 3
	[0104.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0104.972] lstrlenW (lpString=".dbf") returned 4
	[0104.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0104.972] lstrlenW (lpString=".1cd") returned 4
	[0104.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0104.972] lstrlenW (lpString=".jpg") returned 4
	[0104.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0104.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0104.973] lstrlenW (lpString=".doc") returned 4
	[0104.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.973] lstrlenW (lpString=".docx") returned 5
	[0104.973] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.973] lstrlenW (lpString=".pdf") returned 4
	[0104.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.973] lstrlenW (lpString=".xls") returned 4
	[0104.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.973] lstrlenW (lpString=".xlsx") returned 5
	[0104.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.973] lstrlenW (lpString=".ppt") returned 4
	[0104.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0104.973] lstrlenW (lpString=".zip") returned 4
	[0104.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.973] lstrlenW (lpString=".rar") returned 4
	[0104.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.973] lstrlenW (lpString=".bz2") returned 4
	[0104.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.973] lstrlenW (lpString=".7z") returned 3
	[0104.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0104.973] lstrlenW (lpString=".dbf") returned 4
	[0104.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0104.974] lstrlenW (lpString=".1cd") returned 4
	[0104.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0104.974] lstrlenW (lpString=".jpg") returned 4
	[0104.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.974] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0104.974] lstrlenW (lpString="FD00361_.WMF") returned 12
	[0104.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.975] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4074) returned 1
	[0104.975] CloseHandle (hObject=0x1d8) returned 1
	[0104.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x20
	[0104.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.976] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.976] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0104.977] GetLastError () returned 0x0
	[0104.977] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xfea, lpOverlapped=0x0) returned 1
	[0104.994] WriteFile (in: hFile=0x1f4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xff0, lpOverlapped=0x0) returned 1
	[0104.995] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.995] WriteFile (in: hFile=0x1f4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.996] SetEndOfFile (hFile=0x1f4) returned 1
	[0104.996] CloseHandle (hObject=0x1f4) returned 1
	[0104.996] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.996] SetEndOfFile (hFile=0x1d8) returned 1
	[0104.997] CloseHandle (hObject=0x1d8) returned 1
	[0104.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 1
	[0104.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0104.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0104.998] lstrlenW (lpString=".doc") returned 4
	[0104.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.998] lstrlenW (lpString=".docx") returned 5
	[0104.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.998] lstrlenW (lpString=".pdf") returned 4
	[0104.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.998] lstrlenW (lpString=".xls") returned 4
	[0104.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0104.998] lstrlenW (lpString=".xlsx") returned 5
	[0104.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0104.998] lstrlenW (lpString=".ppt") returned 4
	[0104.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0104.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0104.998] lstrlenW (lpString=".zip") returned 4
	[0104.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0104.998] lstrlenW (lpString=".rar") returned 4
	[0104.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0104.999] lstrlenW (lpString=".bz2") returned 4
	[0104.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0104.999] lstrlenW (lpString=".7z") returned 3
	[0104.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0104.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0104.999] lstrlenW (lpString=".dbf") returned 4
	[0104.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0104.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0104.999] lstrlenW (lpString=".1cd") returned 4
	[0104.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0104.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0104.999] lstrlenW (lpString=".jpg") returned 4
	[0104.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0104.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0104.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0104.999] lstrlenW (lpString=".doc") returned 4
	[0104.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0104.999] lstrlenW (lpString=".docx") returned 5
	[0104.999] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0104.999] lstrlenW (lpString=".pdf") returned 4
	[0104.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0104.999] lstrlenW (lpString=".xls") returned 4
	[0105.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.000] lstrlenW (lpString=".xlsx") returned 5
	[0105.000] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.000] lstrlenW (lpString=".ppt") returned 4
	[0105.000] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0105.000] lstrlenW (lpString=".zip") returned 4
	[0105.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.000] lstrlenW (lpString=".rar") returned 4
	[0105.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.000] lstrlenW (lpString=".bz2") returned 4
	[0105.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.000] lstrlenW (lpString=".7z") returned 3
	[0105.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0105.000] lstrlenW (lpString=".dbf") returned 4
	[0105.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0105.000] lstrlenW (lpString=".1cd") returned 4
	[0105.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0105.000] lstrlenW (lpString=".jpg") returned 4
	[0105.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.001] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.001] lstrlenW (lpString="FD00382_.WMF") returned 12
	[0105.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.002] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8424) returned 1
	[0105.002] CloseHandle (hObject=0x1d8) returned 1
	[0105.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x20
	[0105.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.003] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.003] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.004] GetLastError () returned 0x0
	[0105.004] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x20e8, lpOverlapped=0x0) returned 1
	[0105.069] WriteFile (in: hFile=0x1f4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x20f0, lpOverlapped=0x0) returned 1
	[0105.070] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.070] WriteFile (in: hFile=0x1f4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.070] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.071] CloseHandle (hObject=0x1f4) returned 1
	[0105.071] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.071] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.072] CloseHandle (hObject=0x1d8) returned 1
	[0105.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 1
	[0105.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0105.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0105.073] lstrlenW (lpString=".doc") returned 4
	[0105.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.073] lstrlenW (lpString=".docx") returned 5
	[0105.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.073] lstrlenW (lpString=".pdf") returned 4
	[0105.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.073] lstrlenW (lpString=".xls") returned 4
	[0105.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.073] lstrlenW (lpString=".xlsx") returned 5
	[0105.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.073] lstrlenW (lpString=".ppt") returned 4
	[0105.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0105.073] lstrlenW (lpString=".zip") returned 4
	[0105.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.073] lstrlenW (lpString=".rar") returned 4
	[0105.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.073] lstrlenW (lpString=".bz2") returned 4
	[0105.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.073] lstrlenW (lpString=".7z") returned 3
	[0105.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0105.073] lstrlenW (lpString=".dbf") returned 4
	[0105.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0105.073] lstrlenW (lpString=".1cd") returned 4
	[0105.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0105.074] lstrlenW (lpString=".jpg") returned 4
	[0105.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0105.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0105.074] lstrlenW (lpString=".doc") returned 4
	[0105.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.074] lstrlenW (lpString=".docx") returned 5
	[0105.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.074] lstrlenW (lpString=".pdf") returned 4
	[0105.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.074] lstrlenW (lpString=".xls") returned 4
	[0105.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.074] lstrlenW (lpString=".xlsx") returned 5
	[0105.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.074] lstrlenW (lpString=".ppt") returned 4
	[0105.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0105.074] lstrlenW (lpString=".zip") returned 4
	[0105.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.074] lstrlenW (lpString=".rar") returned 4
	[0105.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.074] lstrlenW (lpString=".bz2") returned 4
	[0105.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.075] lstrlenW (lpString=".7z") returned 3
	[0105.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0105.075] lstrlenW (lpString=".dbf") returned 4
	[0105.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0105.075] lstrlenW (lpString=".1cd") returned 4
	[0105.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0105.075] lstrlenW (lpString=".jpg") returned 4
	[0105.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.075] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.075] lstrlenW (lpString="FD00403_.WMF") returned 12
	[0105.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.076] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7878) returned 1
	[0105.076] CloseHandle (hObject=0x1d8) returned 1
	[0105.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x20
	[0105.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.077] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.077] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.079] GetLastError () returned 0x0
	[0105.080] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1ec6, lpOverlapped=0x0) returned 1
	[0105.109] WriteFile (in: hFile=0x1f4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1ed0, lpOverlapped=0x0) returned 1
	[0105.111] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.111] WriteFile (in: hFile=0x1f4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.111] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.111] CloseHandle (hObject=0x1f4) returned 1
	[0105.111] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.111] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.112] CloseHandle (hObject=0x1d8) returned 1
	[0105.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 1
	[0105.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0105.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0105.130] lstrlenW (lpString=".doc") returned 4
	[0105.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.130] lstrlenW (lpString=".docx") returned 5
	[0105.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.130] lstrlenW (lpString=".pdf") returned 4
	[0105.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.130] lstrlenW (lpString=".xls") returned 4
	[0105.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.130] lstrlenW (lpString=".xlsx") returned 5
	[0105.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.130] lstrlenW (lpString=".ppt") returned 4
	[0105.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0105.130] lstrlenW (lpString=".zip") returned 4
	[0105.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.130] lstrlenW (lpString=".rar") returned 4
	[0105.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.130] lstrlenW (lpString=".bz2") returned 4
	[0105.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.130] lstrlenW (lpString=".7z") returned 3
	[0105.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0105.131] lstrlenW (lpString=".dbf") returned 4
	[0105.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0105.131] lstrlenW (lpString=".1cd") returned 4
	[0105.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0105.131] lstrlenW (lpString=".jpg") returned 4
	[0105.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0105.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0105.131] lstrlenW (lpString=".doc") returned 4
	[0105.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.131] lstrlenW (lpString=".docx") returned 5
	[0105.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.131] lstrlenW (lpString=".pdf") returned 4
	[0105.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.131] lstrlenW (lpString=".xls") returned 4
	[0105.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.131] lstrlenW (lpString=".xlsx") returned 5
	[0105.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.131] lstrlenW (lpString=".ppt") returned 4
	[0105.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0105.131] lstrlenW (lpString=".zip") returned 4
	[0105.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.131] lstrlenW (lpString=".rar") returned 4
	[0105.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.132] lstrlenW (lpString=".bz2") returned 4
	[0105.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.132] lstrlenW (lpString=".7z") returned 3
	[0105.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0105.132] lstrlenW (lpString=".dbf") returned 4
	[0105.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0105.132] lstrlenW (lpString=".1cd") returned 4
	[0105.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0105.132] lstrlenW (lpString=".jpg") returned 4
	[0105.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.132] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.132] lstrlenW (lpString="FD00419_.WMF") returned 12
	[0105.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.159] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=16396) returned 1
	[0105.159] CloseHandle (hObject=0x1dc) returned 1
	[0105.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x20
	[0105.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.167] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.167] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.169] GetLastError () returned 0x0
	[0105.169] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x400c, lpOverlapped=0x0) returned 1
	[0105.180] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4010, lpOverlapped=0x0) returned 1
	[0105.181] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.181] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.181] SetEndOfFile (hFile=0x1e8) returned 1
	[0105.182] CloseHandle (hObject=0x1e8) returned 1
	[0105.182] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.182] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.183] CloseHandle (hObject=0x1d8) returned 1
	[0105.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 1
	[0105.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0105.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0105.183] lstrlenW (lpString=".doc") returned 4
	[0105.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.183] lstrlenW (lpString=".docx") returned 5
	[0105.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.183] lstrlenW (lpString=".pdf") returned 4
	[0105.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.183] lstrlenW (lpString=".xls") returned 4
	[0105.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.184] lstrlenW (lpString=".xlsx") returned 5
	[0105.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.184] lstrlenW (lpString=".ppt") returned 4
	[0105.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0105.184] lstrlenW (lpString=".zip") returned 4
	[0105.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.184] lstrlenW (lpString=".rar") returned 4
	[0105.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.184] lstrlenW (lpString=".bz2") returned 4
	[0105.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.184] lstrlenW (lpString=".7z") returned 3
	[0105.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0105.184] lstrlenW (lpString=".dbf") returned 4
	[0105.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0105.184] lstrlenW (lpString=".1cd") returned 4
	[0105.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0105.184] lstrlenW (lpString=".jpg") returned 4
	[0105.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0105.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0105.184] lstrlenW (lpString=".doc") returned 4
	[0105.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.185] lstrlenW (lpString=".docx") returned 5
	[0105.185] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.185] lstrlenW (lpString=".pdf") returned 4
	[0105.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.185] lstrlenW (lpString=".xls") returned 4
	[0105.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.185] lstrlenW (lpString=".xlsx") returned 5
	[0105.185] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.185] lstrlenW (lpString=".ppt") returned 4
	[0105.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0105.185] lstrlenW (lpString=".zip") returned 4
	[0105.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.185] lstrlenW (lpString=".rar") returned 4
	[0105.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.185] lstrlenW (lpString=".bz2") returned 4
	[0105.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.185] lstrlenW (lpString=".7z") returned 3
	[0105.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0105.185] lstrlenW (lpString=".dbf") returned 4
	[0105.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0105.185] lstrlenW (lpString=".1cd") returned 4
	[0105.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0105.185] lstrlenW (lpString=".jpg") returned 4
	[0105.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.186] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.186] lstrlenW (lpString="FD00435_.WMF") returned 12
	[0105.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.187] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2108) returned 1
	[0105.187] CloseHandle (hObject=0x1d8) returned 1
	[0105.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x20
	[0105.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.188] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.188] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.189] GetLastError () returned 0x0
	[0105.189] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x83c, lpOverlapped=0x0) returned 1
	[0105.206] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x840, lpOverlapped=0x0) returned 1
	[0105.208] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.208] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.208] SetEndOfFile (hFile=0x1e8) returned 1
	[0105.208] CloseHandle (hObject=0x1e8) returned 1
	[0105.208] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.208] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.209] CloseHandle (hObject=0x1d8) returned 1
	[0105.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 1
	[0105.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0105.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0105.210] lstrlenW (lpString=".doc") returned 4
	[0105.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.210] lstrlenW (lpString=".docx") returned 5
	[0105.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.210] lstrlenW (lpString=".pdf") returned 4
	[0105.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.210] lstrlenW (lpString=".xls") returned 4
	[0105.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.210] lstrlenW (lpString=".xlsx") returned 5
	[0105.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.210] lstrlenW (lpString=".ppt") returned 4
	[0105.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0105.210] lstrlenW (lpString=".zip") returned 4
	[0105.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.210] lstrlenW (lpString=".rar") returned 4
	[0105.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.211] lstrlenW (lpString=".bz2") returned 4
	[0105.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.211] lstrlenW (lpString=".7z") returned 3
	[0105.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0105.211] lstrlenW (lpString=".dbf") returned 4
	[0105.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0105.211] lstrlenW (lpString=".1cd") returned 4
	[0105.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0105.211] lstrlenW (lpString=".jpg") returned 4
	[0105.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0105.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0105.211] lstrlenW (lpString=".doc") returned 4
	[0105.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.211] lstrlenW (lpString=".docx") returned 5
	[0105.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.211] lstrlenW (lpString=".pdf") returned 4
	[0105.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.211] lstrlenW (lpString=".xls") returned 4
	[0105.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.211] lstrlenW (lpString=".xlsx") returned 5
	[0105.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.212] lstrlenW (lpString=".ppt") returned 4
	[0105.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0105.212] lstrlenW (lpString=".zip") returned 4
	[0105.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.212] lstrlenW (lpString=".rar") returned 4
	[0105.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.212] lstrlenW (lpString=".bz2") returned 4
	[0105.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.212] lstrlenW (lpString=".7z") returned 3
	[0105.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0105.212] lstrlenW (lpString=".dbf") returned 4
	[0105.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0105.212] lstrlenW (lpString=".1cd") returned 4
	[0105.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0105.212] lstrlenW (lpString=".jpg") returned 4
	[0105.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.213] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.213] lstrlenW (lpString="FD00455_.WMF") returned 12
	[0105.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.213] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8926) returned 1
	[0105.214] CloseHandle (hObject=0x1d8) returned 1
	[0105.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x20
	[0105.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.214] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.214] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.215] GetLastError () returned 0x0
	[0105.215] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x22de, lpOverlapped=0x0) returned 1
	[0105.245] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x22e0, lpOverlapped=0x0) returned 1
	[0105.246] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.246] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.246] SetEndOfFile (hFile=0x1e8) returned 1
	[0105.247] CloseHandle (hObject=0x1e8) returned 1
	[0105.247] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.247] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.248] CloseHandle (hObject=0x1d8) returned 1
	[0105.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 1
	[0105.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0105.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0105.248] lstrlenW (lpString=".doc") returned 4
	[0105.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.248] lstrlenW (lpString=".docx") returned 5
	[0105.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.248] lstrlenW (lpString=".pdf") returned 4
	[0105.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.248] lstrlenW (lpString=".xls") returned 4
	[0105.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.249] lstrlenW (lpString=".xlsx") returned 5
	[0105.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.249] lstrlenW (lpString=".ppt") returned 4
	[0105.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0105.249] lstrlenW (lpString=".zip") returned 4
	[0105.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.249] lstrlenW (lpString=".rar") returned 4
	[0105.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.249] lstrlenW (lpString=".bz2") returned 4
	[0105.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.249] lstrlenW (lpString=".7z") returned 3
	[0105.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0105.249] lstrlenW (lpString=".dbf") returned 4
	[0105.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0105.249] lstrlenW (lpString=".1cd") returned 4
	[0105.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0105.250] lstrlenW (lpString=".jpg") returned 4
	[0105.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0105.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0105.250] lstrlenW (lpString=".doc") returned 4
	[0105.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.250] lstrlenW (lpString=".docx") returned 5
	[0105.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.250] lstrlenW (lpString=".pdf") returned 4
	[0105.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.250] lstrlenW (lpString=".xls") returned 4
	[0105.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.250] lstrlenW (lpString=".xlsx") returned 5
	[0105.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.250] lstrlenW (lpString=".ppt") returned 4
	[0105.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0105.250] lstrlenW (lpString=".zip") returned 4
	[0105.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.250] lstrlenW (lpString=".rar") returned 4
	[0105.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.250] lstrlenW (lpString=".bz2") returned 4
	[0105.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.251] lstrlenW (lpString=".7z") returned 3
	[0105.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0105.251] lstrlenW (lpString=".dbf") returned 4
	[0105.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0105.251] lstrlenW (lpString=".1cd") returned 4
	[0105.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0105.251] lstrlenW (lpString=".jpg") returned 4
	[0105.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.251] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.251] lstrlenW (lpString="FD00543_.WMF") returned 12
	[0105.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.252] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1472) returned 1
	[0105.252] CloseHandle (hObject=0x1d8) returned 1
	[0105.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x20
	[0105.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.253] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.253] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.254] GetLastError () returned 0x0
	[0105.254] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x5c0, lpOverlapped=0x0) returned 1
	[0105.257] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5d0, lpOverlapped=0x0) returned 1
	[0105.259] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.259] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.259] SetEndOfFile (hFile=0x1e8) returned 1
	[0105.259] CloseHandle (hObject=0x1e8) returned 1
	[0105.259] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.259] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.260] CloseHandle (hObject=0x1d8) returned 1
	[0105.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 1
	[0105.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0105.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0105.261] lstrlenW (lpString=".doc") returned 4
	[0105.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.261] lstrlenW (lpString=".docx") returned 5
	[0105.261] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.261] lstrlenW (lpString=".pdf") returned 4
	[0105.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.261] lstrlenW (lpString=".xls") returned 4
	[0105.261] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.261] lstrlenW (lpString=".xlsx") returned 5
	[0105.261] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.262] lstrlenW (lpString=".ppt") returned 4
	[0105.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0105.262] lstrlenW (lpString=".zip") returned 4
	[0105.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.262] lstrlenW (lpString=".rar") returned 4
	[0105.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.262] lstrlenW (lpString=".bz2") returned 4
	[0105.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.262] lstrlenW (lpString=".7z") returned 3
	[0105.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0105.262] lstrlenW (lpString=".dbf") returned 4
	[0105.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0105.262] lstrlenW (lpString=".1cd") returned 4
	[0105.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0105.263] lstrlenW (lpString=".jpg") returned 4
	[0105.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0105.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0105.263] lstrlenW (lpString=".doc") returned 4
	[0105.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.263] lstrlenW (lpString=".docx") returned 5
	[0105.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.263] lstrlenW (lpString=".pdf") returned 4
	[0105.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.263] lstrlenW (lpString=".xls") returned 4
	[0105.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.263] lstrlenW (lpString=".xlsx") returned 5
	[0105.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.263] lstrlenW (lpString=".ppt") returned 4
	[0105.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0105.264] lstrlenW (lpString=".zip") returned 4
	[0105.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.264] lstrlenW (lpString=".rar") returned 4
	[0105.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.264] lstrlenW (lpString=".bz2") returned 4
	[0105.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.264] lstrlenW (lpString=".7z") returned 3
	[0105.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0105.264] lstrlenW (lpString=".dbf") returned 4
	[0105.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0105.264] lstrlenW (lpString=".1cd") returned 4
	[0105.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0105.264] lstrlenW (lpString=".jpg") returned 4
	[0105.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.265] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.265] lstrlenW (lpString="FD00544_.WMF") returned 12
	[0105.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.266] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5260) returned 1
	[0105.267] CloseHandle (hObject=0x1d8) returned 1
	[0105.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x20
	[0105.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.267] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.267] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.270] GetLastError () returned 0x0
	[0105.270] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x148c, lpOverlapped=0x0) returned 1
	[0105.303] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1490, lpOverlapped=0x0) returned 1
	[0105.304] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.304] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.304] SetEndOfFile (hFile=0x1e8) returned 1
	[0105.304] CloseHandle (hObject=0x1e8) returned 1
	[0105.304] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.304] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.305] CloseHandle (hObject=0x1d8) returned 1
	[0105.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 1
	[0105.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0105.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0105.306] lstrlenW (lpString=".doc") returned 4
	[0105.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.306] lstrlenW (lpString=".docx") returned 5
	[0105.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.306] lstrlenW (lpString=".pdf") returned 4
	[0105.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.306] lstrlenW (lpString=".xls") returned 4
	[0105.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.306] lstrlenW (lpString=".xlsx") returned 5
	[0105.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.306] lstrlenW (lpString=".ppt") returned 4
	[0105.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0105.306] lstrlenW (lpString=".zip") returned 4
	[0105.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.307] lstrlenW (lpString=".rar") returned 4
	[0105.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.307] lstrlenW (lpString=".bz2") returned 4
	[0105.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.307] lstrlenW (lpString=".7z") returned 3
	[0105.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0105.307] lstrlenW (lpString=".dbf") returned 4
	[0105.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0105.307] lstrlenW (lpString=".1cd") returned 4
	[0105.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0105.307] lstrlenW (lpString=".jpg") returned 4
	[0105.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0105.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0105.307] lstrlenW (lpString=".doc") returned 4
	[0105.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.307] lstrlenW (lpString=".docx") returned 5
	[0105.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.307] lstrlenW (lpString=".pdf") returned 4
	[0105.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.307] lstrlenW (lpString=".xls") returned 4
	[0105.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.308] lstrlenW (lpString=".xlsx") returned 5
	[0105.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.308] lstrlenW (lpString=".ppt") returned 4
	[0105.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0105.308] lstrlenW (lpString=".zip") returned 4
	[0105.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.308] lstrlenW (lpString=".rar") returned 4
	[0105.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.308] lstrlenW (lpString=".bz2") returned 4
	[0105.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.308] lstrlenW (lpString=".7z") returned 3
	[0105.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0105.308] lstrlenW (lpString=".dbf") returned 4
	[0105.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0105.308] lstrlenW (lpString=".1cd") returned 4
	[0105.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0105.308] lstrlenW (lpString=".jpg") returned 4
	[0105.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.308] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.309] lstrlenW (lpString="FD00586_.WMF") returned 12
	[0105.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.309] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=752) returned 1
	[0105.309] CloseHandle (hObject=0x1d8) returned 1
	[0105.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x20
	[0105.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.310] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.310] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.311] GetLastError () returned 0x0
	[0105.311] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2f0, lpOverlapped=0x0) returned 1
	[0105.333] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x300, lpOverlapped=0x0) returned 1
	[0105.335] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.335] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.335] SetEndOfFile (hFile=0x1e8) returned 1
	[0105.335] CloseHandle (hObject=0x1e8) returned 1
	[0105.335] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.335] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.336] CloseHandle (hObject=0x1d8) returned 1
	[0105.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 1
	[0105.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0105.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0105.337] lstrlenW (lpString=".doc") returned 4
	[0105.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.337] lstrlenW (lpString=".docx") returned 5
	[0105.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.337] lstrlenW (lpString=".pdf") returned 4
	[0105.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.337] lstrlenW (lpString=".xls") returned 4
	[0105.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.337] lstrlenW (lpString=".xlsx") returned 5
	[0105.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.337] lstrlenW (lpString=".ppt") returned 4
	[0105.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0105.337] lstrlenW (lpString=".zip") returned 4
	[0105.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.338] lstrlenW (lpString=".rar") returned 4
	[0105.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.338] lstrlenW (lpString=".bz2") returned 4
	[0105.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.338] lstrlenW (lpString=".7z") returned 3
	[0105.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0105.338] lstrlenW (lpString=".dbf") returned 4
	[0105.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0105.338] lstrlenW (lpString=".1cd") returned 4
	[0105.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0105.338] lstrlenW (lpString=".jpg") returned 4
	[0105.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0105.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0105.338] lstrlenW (lpString=".doc") returned 4
	[0105.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.338] lstrlenW (lpString=".docx") returned 5
	[0105.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.338] lstrlenW (lpString=".pdf") returned 4
	[0105.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.338] lstrlenW (lpString=".xls") returned 4
	[0105.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.339] lstrlenW (lpString=".xlsx") returned 5
	[0105.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.339] lstrlenW (lpString=".ppt") returned 4
	[0105.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0105.339] lstrlenW (lpString=".zip") returned 4
	[0105.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.339] lstrlenW (lpString=".rar") returned 4
	[0105.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.339] lstrlenW (lpString=".bz2") returned 4
	[0105.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.339] lstrlenW (lpString=".7z") returned 3
	[0105.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0105.339] lstrlenW (lpString=".dbf") returned 4
	[0105.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0105.339] lstrlenW (lpString=".1cd") returned 4
	[0105.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0105.339] lstrlenW (lpString=".jpg") returned 4
	[0105.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.339] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.340] lstrlenW (lpString="FD00779_.WMF") returned 12
	[0105.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.359] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=9010) returned 1
	[0105.359] CloseHandle (hObject=0x1dc) returned 1
	[0105.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x20
	[0105.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.367] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.367] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.373] GetLastError () returned 0x0
	[0105.373] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2332, lpOverlapped=0x0) returned 1
	[0105.391] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2340, lpOverlapped=0x0) returned 1
	[0105.392] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.392] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.392] SetEndOfFile (hFile=0x1e8) returned 1
	[0105.392] CloseHandle (hObject=0x1e8) returned 1
	[0105.392] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.392] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.393] CloseHandle (hObject=0x1f4) returned 1
	[0105.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 1
	[0105.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0105.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0105.394] lstrlenW (lpString=".doc") returned 4
	[0105.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.394] lstrlenW (lpString=".docx") returned 5
	[0105.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.394] lstrlenW (lpString=".pdf") returned 4
	[0105.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.394] lstrlenW (lpString=".xls") returned 4
	[0105.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.394] lstrlenW (lpString=".xlsx") returned 5
	[0105.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.394] lstrlenW (lpString=".ppt") returned 4
	[0105.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0105.395] lstrlenW (lpString=".zip") returned 4
	[0105.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.395] lstrlenW (lpString=".rar") returned 4
	[0105.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.395] lstrlenW (lpString=".bz2") returned 4
	[0105.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.395] lstrlenW (lpString=".7z") returned 3
	[0105.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0105.395] lstrlenW (lpString=".dbf") returned 4
	[0105.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0105.395] lstrlenW (lpString=".1cd") returned 4
	[0105.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0105.395] lstrlenW (lpString=".jpg") returned 4
	[0105.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0105.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0105.395] lstrlenW (lpString=".doc") returned 4
	[0105.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.395] lstrlenW (lpString=".docx") returned 5
	[0105.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.395] lstrlenW (lpString=".pdf") returned 4
	[0105.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.396] lstrlenW (lpString=".xls") returned 4
	[0105.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.396] lstrlenW (lpString=".xlsx") returned 5
	[0105.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.396] lstrlenW (lpString=".ppt") returned 4
	[0105.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0105.396] lstrlenW (lpString=".zip") returned 4
	[0105.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.396] lstrlenW (lpString=".rar") returned 4
	[0105.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.396] lstrlenW (lpString=".bz2") returned 4
	[0105.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.396] lstrlenW (lpString=".7z") returned 3
	[0105.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0105.396] lstrlenW (lpString=".dbf") returned 4
	[0105.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0105.396] lstrlenW (lpString=".1cd") returned 4
	[0105.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0105.396] lstrlenW (lpString=".jpg") returned 4
	[0105.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.397] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.397] lstrlenW (lpString="FD00814_.WMF") returned 12
	[0105.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.398] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=42704) returned 1
	[0105.398] CloseHandle (hObject=0x1f4) returned 1
	[0105.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x20
	[0105.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.398] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.398] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.399] GetLastError () returned 0x0
	[0105.399] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xa6d0, lpOverlapped=0x0) returned 1
	[0105.425] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa6e0, lpOverlapped=0x0) returned 1
	[0105.427] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.427] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.427] SetEndOfFile (hFile=0x1e8) returned 1
	[0105.428] CloseHandle (hObject=0x1e8) returned 1
	[0105.428] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.428] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.430] CloseHandle (hObject=0x1f4) returned 1
	[0105.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 1
	[0105.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0105.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0105.434] lstrlenW (lpString=".doc") returned 4
	[0105.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.434] lstrlenW (lpString=".docx") returned 5
	[0105.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.434] lstrlenW (lpString=".pdf") returned 4
	[0105.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.435] lstrlenW (lpString=".xls") returned 4
	[0105.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.435] lstrlenW (lpString=".xlsx") returned 5
	[0105.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.435] lstrlenW (lpString=".ppt") returned 4
	[0105.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0105.435] lstrlenW (lpString=".zip") returned 4
	[0105.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.435] lstrlenW (lpString=".rar") returned 4
	[0105.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.435] lstrlenW (lpString=".bz2") returned 4
	[0105.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.435] lstrlenW (lpString=".7z") returned 3
	[0105.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0105.435] lstrlenW (lpString=".dbf") returned 4
	[0105.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0105.435] lstrlenW (lpString=".1cd") returned 4
	[0105.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0105.435] lstrlenW (lpString=".jpg") returned 4
	[0105.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0105.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0105.436] lstrlenW (lpString=".doc") returned 4
	[0105.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.436] lstrlenW (lpString=".docx") returned 5
	[0105.436] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.436] lstrlenW (lpString=".pdf") returned 4
	[0105.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.436] lstrlenW (lpString=".xls") returned 4
	[0105.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.436] lstrlenW (lpString=".xlsx") returned 5
	[0105.436] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.436] lstrlenW (lpString=".ppt") returned 4
	[0105.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0105.436] lstrlenW (lpString=".zip") returned 4
	[0105.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.436] lstrlenW (lpString=".rar") returned 4
	[0105.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.436] lstrlenW (lpString=".bz2") returned 4
	[0105.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.436] lstrlenW (lpString=".7z") returned 3
	[0105.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0105.436] lstrlenW (lpString=".dbf") returned 4
	[0105.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0105.436] lstrlenW (lpString=".1cd") returned 4
	[0105.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0105.437] lstrlenW (lpString=".jpg") returned 4
	[0105.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.437] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.437] lstrlenW (lpString="FD01074_.WMF") returned 12
	[0105.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.442] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4634) returned 1
	[0105.442] CloseHandle (hObject=0x1f4) returned 1
	[0105.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x20
	[0105.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.453] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.453] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.478] GetLastError () returned 0x0
	[0105.478] ReadFile (in: hFile=0x1dc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x121a, lpOverlapped=0x0) returned 1
	[0105.493] WriteFile (in: hFile=0x1f4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1220, lpOverlapped=0x0) returned 1
	[0105.494] ReadFile (in: hFile=0x1dc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.494] WriteFile (in: hFile=0x1f4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.494] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.495] CloseHandle (hObject=0x1f4) returned 1
	[0105.495] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.495] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.496] CloseHandle (hObject=0x1dc) returned 1
	[0105.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 1
	[0105.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0105.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0105.496] lstrlenW (lpString=".doc") returned 4
	[0105.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.496] lstrlenW (lpString=".docx") returned 5
	[0105.496] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.497] lstrlenW (lpString=".pdf") returned 4
	[0105.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.497] lstrlenW (lpString=".xls") returned 4
	[0105.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.497] lstrlenW (lpString=".xlsx") returned 5
	[0105.497] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.497] lstrlenW (lpString=".ppt") returned 4
	[0105.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0105.497] lstrlenW (lpString=".zip") returned 4
	[0105.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.497] lstrlenW (lpString=".rar") returned 4
	[0105.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.497] lstrlenW (lpString=".bz2") returned 4
	[0105.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.497] lstrlenW (lpString=".7z") returned 3
	[0105.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0105.497] lstrlenW (lpString=".dbf") returned 4
	[0105.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0105.497] lstrlenW (lpString=".1cd") returned 4
	[0105.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0105.497] lstrlenW (lpString=".jpg") returned 4
	[0105.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0105.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0105.498] lstrlenW (lpString=".doc") returned 4
	[0105.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.498] lstrlenW (lpString=".docx") returned 5
	[0105.498] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.498] lstrlenW (lpString=".pdf") returned 4
	[0105.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.498] lstrlenW (lpString=".xls") returned 4
	[0105.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.498] lstrlenW (lpString=".xlsx") returned 5
	[0105.498] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.498] lstrlenW (lpString=".ppt") returned 4
	[0105.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0105.498] lstrlenW (lpString=".zip") returned 4
	[0105.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.498] lstrlenW (lpString=".rar") returned 4
	[0105.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.498] lstrlenW (lpString=".bz2") returned 4
	[0105.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.498] lstrlenW (lpString=".7z") returned 3
	[0105.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0105.498] lstrlenW (lpString=".dbf") returned 4
	[0105.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0105.498] lstrlenW (lpString=".1cd") returned 4
	[0105.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0105.499] lstrlenW (lpString=".jpg") returned 4
	[0105.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.499] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.499] lstrlenW (lpString="FD01176_.WMF") returned 12
	[0105.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.500] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4984) returned 1
	[0105.500] CloseHandle (hObject=0x1dc) returned 1
	[0105.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x20
	[0105.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.500] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.500] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.501] GetLastError () returned 0x0
	[0105.501] ReadFile (in: hFile=0x1dc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1378, lpOverlapped=0x0) returned 1
	[0105.513] WriteFile (in: hFile=0x1f4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1380, lpOverlapped=0x0) returned 1
	[0105.515] ReadFile (in: hFile=0x1dc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.515] WriteFile (in: hFile=0x1f4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.515] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.515] CloseHandle (hObject=0x1f4) returned 1
	[0105.515] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.515] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.516] CloseHandle (hObject=0x1dc) returned 1
	[0105.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 1
	[0105.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0105.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0105.518] lstrlenW (lpString=".doc") returned 4
	[0105.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.518] lstrlenW (lpString=".docx") returned 5
	[0105.518] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.518] lstrlenW (lpString=".pdf") returned 4
	[0105.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.518] lstrlenW (lpString=".xls") returned 4
	[0105.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.518] lstrlenW (lpString=".xlsx") returned 5
	[0105.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.518] lstrlenW (lpString=".ppt") returned 4
	[0105.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0105.518] lstrlenW (lpString=".zip") returned 4
	[0105.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.518] lstrlenW (lpString=".rar") returned 4
	[0105.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.518] lstrlenW (lpString=".bz2") returned 4
	[0105.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.518] lstrlenW (lpString=".7z") returned 3
	[0105.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0105.518] lstrlenW (lpString=".dbf") returned 4
	[0105.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0105.518] lstrlenW (lpString=".1cd") returned 4
	[0105.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0105.519] lstrlenW (lpString=".jpg") returned 4
	[0105.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0105.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0105.519] lstrlenW (lpString=".doc") returned 4
	[0105.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.519] lstrlenW (lpString=".docx") returned 5
	[0105.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.519] lstrlenW (lpString=".pdf") returned 4
	[0105.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.519] lstrlenW (lpString=".xls") returned 4
	[0105.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.519] lstrlenW (lpString=".xlsx") returned 5
	[0105.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.519] lstrlenW (lpString=".ppt") returned 4
	[0105.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0105.519] lstrlenW (lpString=".zip") returned 4
	[0105.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.519] lstrlenW (lpString=".rar") returned 4
	[0105.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.519] lstrlenW (lpString=".bz2") returned 4
	[0105.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.519] lstrlenW (lpString=".7z") returned 3
	[0105.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0105.519] lstrlenW (lpString=".dbf") returned 4
	[0105.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0105.519] lstrlenW (lpString=".1cd") returned 4
	[0105.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0105.520] lstrlenW (lpString=".jpg") returned 4
	[0105.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.520] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.520] lstrlenW (lpString="FD01193_.WMF") returned 12
	[0105.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.525] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1160) returned 1
	[0105.525] CloseHandle (hObject=0x1dc) returned 1
	[0105.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x20
	[0105.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0105.532] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.532] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.547] GetLastError () returned 0x0
	[0105.547] ReadFile (in: hFile=0x1e0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x488, lpOverlapped=0x0) returned 1
	[0105.567] WriteFile (in: hFile=0x1dc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x490, lpOverlapped=0x0) returned 1
	[0105.568] ReadFile (in: hFile=0x1e0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.568] WriteFile (in: hFile=0x1dc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.568] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.568] CloseHandle (hObject=0x1dc) returned 1
	[0105.568] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.568] SetEndOfFile (hFile=0x1e0) returned 1
	[0105.569] CloseHandle (hObject=0x1e0) returned 1
	[0105.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 1
	[0105.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0105.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0105.570] lstrlenW (lpString=".doc") returned 4
	[0105.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.570] lstrlenW (lpString=".docx") returned 5
	[0105.570] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.570] lstrlenW (lpString=".pdf") returned 4
	[0105.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.570] lstrlenW (lpString=".xls") returned 4
	[0105.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.570] lstrlenW (lpString=".xlsx") returned 5
	[0105.570] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.570] lstrlenW (lpString=".ppt") returned 4
	[0105.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0105.570] lstrlenW (lpString=".zip") returned 4
	[0105.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.570] lstrlenW (lpString=".rar") returned 4
	[0105.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.570] lstrlenW (lpString=".bz2") returned 4
	[0105.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.570] lstrlenW (lpString=".7z") returned 3
	[0105.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0105.571] lstrlenW (lpString=".dbf") returned 4
	[0105.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0105.571] lstrlenW (lpString=".1cd") returned 4
	[0105.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0105.571] lstrlenW (lpString=".jpg") returned 4
	[0105.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0105.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0105.571] lstrlenW (lpString=".doc") returned 4
	[0105.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.571] lstrlenW (lpString=".docx") returned 5
	[0105.571] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.571] lstrlenW (lpString=".pdf") returned 4
	[0105.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.571] lstrlenW (lpString=".xls") returned 4
	[0105.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.571] lstrlenW (lpString=".xlsx") returned 5
	[0105.571] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.571] lstrlenW (lpString=".ppt") returned 4
	[0105.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0105.571] lstrlenW (lpString=".zip") returned 4
	[0105.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.571] lstrlenW (lpString=".rar") returned 4
	[0105.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.572] lstrlenW (lpString=".bz2") returned 4
	[0105.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.572] lstrlenW (lpString=".7z") returned 3
	[0105.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0105.572] lstrlenW (lpString=".dbf") returned 4
	[0105.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0105.572] lstrlenW (lpString=".1cd") returned 4
	[0105.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0105.572] lstrlenW (lpString=".jpg") returned 4
	[0105.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.572] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.572] lstrlenW (lpString="FD01548_.WMF") returned 12
	[0105.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0105.573] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=10316) returned 1
	[0105.573] CloseHandle (hObject=0x1e0) returned 1
	[0105.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x20
	[0105.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0105.574] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.574] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.575] GetLastError () returned 0x0
	[0105.575] ReadFile (in: hFile=0x1e0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x284c, lpOverlapped=0x0) returned 1
	[0105.592] WriteFile (in: hFile=0x1dc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2850, lpOverlapped=0x0) returned 1
	[0105.594] ReadFile (in: hFile=0x1e0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.594] WriteFile (in: hFile=0x1dc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.594] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.594] CloseHandle (hObject=0x1dc) returned 1
	[0105.594] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.594] SetEndOfFile (hFile=0x1e0) returned 1
	[0105.595] CloseHandle (hObject=0x1e0) returned 1
	[0105.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 1
	[0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0105.596] lstrlenW (lpString=".doc") returned 4
	[0105.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.596] lstrlenW (lpString=".docx") returned 5
	[0105.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.596] lstrlenW (lpString=".pdf") returned 4
	[0105.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.596] lstrlenW (lpString=".xls") returned 4
	[0105.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.596] lstrlenW (lpString=".xlsx") returned 5
	[0105.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.596] lstrlenW (lpString=".ppt") returned 4
	[0105.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0105.597] lstrlenW (lpString=".zip") returned 4
	[0105.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.597] lstrlenW (lpString=".rar") returned 4
	[0105.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.597] lstrlenW (lpString=".bz2") returned 4
	[0105.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.597] lstrlenW (lpString=".7z") returned 3
	[0105.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0105.597] lstrlenW (lpString=".dbf") returned 4
	[0105.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0105.597] lstrlenW (lpString=".1cd") returned 4
	[0105.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0105.597] lstrlenW (lpString=".jpg") returned 4
	[0105.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0105.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0105.597] lstrlenW (lpString=".doc") returned 4
	[0105.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0105.597] lstrlenW (lpString=".docx") returned 5
	[0105.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0105.597] lstrlenW (lpString=".pdf") returned 4
	[0105.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0105.597] lstrlenW (lpString=".xls") returned 4
	[0105.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0105.598] lstrlenW (lpString=".xlsx") returned 5
	[0105.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0105.598] lstrlenW (lpString=".ppt") returned 4
	[0105.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0105.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0105.598] lstrlenW (lpString=".zip") returned 4
	[0105.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0105.598] lstrlenW (lpString=".rar") returned 4
	[0105.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0105.598] lstrlenW (lpString=".bz2") returned 4
	[0105.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0105.598] lstrlenW (lpString=".7z") returned 3
	[0105.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0105.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0105.598] lstrlenW (lpString=".dbf") returned 4
	[0105.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0105.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0105.598] lstrlenW (lpString=".1cd") returned 4
	[0105.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0105.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0105.598] lstrlenW (lpString=".jpg") returned 4
	[0105.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0105.599] lstrcmpiW (lpString1=".WMF", lpString2=".adobe") returned 1
	[0105.599] lstrlenW (lpString="FD01658_.WMF") returned 12
	[0105.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.612] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=17924) returned 1
	[0105.613] CloseHandle (hObject=0x1f4) returned 1
	[0105.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x20
	[0105.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0105.620] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.620] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.664] GetLastError () returned 0x0
	[0105.664] ReadFile (hFile=0x1e0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0) 

Thread:
	id = 59
	os_tid = 0xb9c

	[0073.179] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x3780480
	[0073.179] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x3790488
	[0073.179] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6309e0
	[0073.179] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x6c0680
	[0073.179] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6309f8
	[0073.180] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3a70020
	[0073.180] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630a10
	[0073.180] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630a10, Size=0x20) returned 0x6162b0
	[0073.180] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630a10
	[0073.180] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630a10, Size=0x20) returned 0x6162d8
	[0073.180] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0073.180] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0073.180] Wow64DisableWow64FsRedirection (in: OldValue=0x305ff58 | out: OldValue=0x305ff58*=0x0) returned 1
	[0073.180] lstrlenW (lpString="kernel32.dll") returned 12
	[0073.180] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162b0 | out: hHeap=0x5e0000) returned 1
	[0073.180] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0073.180] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162d8 | out: hHeap=0x5e0000) returned 1
	[0073.180] Sleep (dwMilliseconds=0x64) 
	[0073.724] Sleep (dwMilliseconds=0x64) 
	[0074.273] lstrcmpiW (lpString1=".ttf", lpString2=".adobe") returned 1
	[0074.273] lstrlenW (lpString="kor_boot.ttf") returned 12
	[0074.273] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0074.466] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2371360) returned 1
	[0074.466] CloseHandle (hObject=0x160) returned 1
	[0074.466] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20
	[0074.467] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.467] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0074.467] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0074.467] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0074.467] lstrlenW (lpString=".doc") returned 4
	[0074.467] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0074.467] lstrlenW (lpString=".docx") returned 5
	[0074.467] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0074.467] lstrlenW (lpString=".pdf") returned 4
	[0074.467] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0074.467] lstrlenW (lpString=".xls") returned 4
	[0074.467] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0074.467] lstrlenW (lpString=".xlsx") returned 5
	[0074.467] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0074.467] lstrlenW (lpString=".ppt") returned 4
	[0074.467] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0074.467] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0074.467] lstrlenW (lpString=".zip") returned 4
	[0074.467] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0074.467] lstrlenW (lpString=".rar") returned 4
	[0074.467] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0074.467] lstrlenW (lpString=".bz2") returned 4
	[0074.467] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0074.467] lstrlenW (lpString=".7z") returned 3
	[0074.467] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0074.467] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0074.467] lstrlenW (lpString=".dbf") returned 4
	[0074.467] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0074.467] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0074.468] lstrlenW (lpString=".1cd") returned 4
	[0074.468] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0074.468] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0074.468] lstrlenW (lpString=".jpg") returned 4
	[0074.468] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0074.468] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0074.468] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0074.468] lstrlenW (lpString=".doc") returned 4
	[0074.468] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0074.468] lstrlenW (lpString=".docx") returned 5
	[0074.468] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0074.468] lstrlenW (lpString=".pdf") returned 4
	[0074.468] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0074.468] lstrlenW (lpString=".xls") returned 4
	[0074.468] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0074.468] lstrlenW (lpString=".xlsx") returned 5
	[0074.468] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0074.468] lstrlenW (lpString=".ppt") returned 4
	[0074.468] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0074.468] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0074.468] lstrlenW (lpString=".zip") returned 4
	[0074.468] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0074.468] lstrlenW (lpString=".rar") returned 4
	[0074.468] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0074.468] lstrlenW (lpString=".bz2") returned 4
	[0074.468] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0074.468] lstrlenW (lpString=".7z") returned 3
	[0074.468] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0074.468] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0074.468] lstrlenW (lpString=".dbf") returned 4
	[0074.468] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0074.468] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0074.468] lstrlenW (lpString=".1cd") returned 4
	[0074.469] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0074.469] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0074.469] lstrlenW (lpString=".jpg") returned 4
	[0074.469] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0074.469] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0074.469] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0074.469] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0074.469] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=93248) returned 1
	[0074.469] CloseHandle (hObject=0x160) returned 1
	[0074.469] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20
	[0074.469] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.469] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.469] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0074.469] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0074.469] lstrlenW (lpString=".doc") returned 4
	[0074.469] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.470] lstrlenW (lpString=".docx") returned 5
	[0074.470] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.470] lstrlenW (lpString=".pdf") returned 4
	[0074.470] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.470] lstrlenW (lpString=".xls") returned 4
	[0074.470] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.470] lstrlenW (lpString=".xlsx") returned 5
	[0074.470] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.470] lstrlenW (lpString=".ppt") returned 4
	[0074.470] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.470] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0074.470] lstrlenW (lpString=".zip") returned 4
	[0074.470] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.470] lstrlenW (lpString=".rar") returned 4
	[0074.470] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.470] lstrlenW (lpString=".bz2") returned 4
	[0074.470] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.470] lstrlenW (lpString=".7z") returned 3
	[0074.470] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.470] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0074.470] lstrlenW (lpString=".dbf") returned 4
	[0074.470] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.470] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0074.470] lstrlenW (lpString=".1cd") returned 4
	[0074.470] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.470] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0074.470] lstrlenW (lpString=".jpg") returned 4
	[0074.470] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.470] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0074.470] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0074.470] lstrlenW (lpString=".doc") returned 4
	[0074.470] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.471] lstrlenW (lpString=".docx") returned 5
	[0074.471] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.471] lstrlenW (lpString=".pdf") returned 4
	[0074.471] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.471] lstrlenW (lpString=".xls") returned 4
	[0074.471] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.471] lstrlenW (lpString=".xlsx") returned 5
	[0074.471] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.471] lstrlenW (lpString=".ppt") returned 4
	[0074.471] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.471] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0074.471] lstrlenW (lpString=".zip") returned 4
	[0074.471] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.471] lstrlenW (lpString=".rar") returned 4
	[0074.471] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.471] lstrlenW (lpString=".bz2") returned 4
	[0074.471] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.471] lstrlenW (lpString=".7z") returned 3
	[0074.471] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.471] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0074.471] lstrlenW (lpString=".dbf") returned 4
	[0074.471] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.471] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0074.471] lstrlenW (lpString=".1cd") returned 4
	[0074.471] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.471] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0074.471] lstrlenW (lpString=".jpg") returned 4
	[0074.471] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.472] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0074.472] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0074.472] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0074.472] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=90688) returned 1
	[0074.472] CloseHandle (hObject=0x160) returned 1
	[0074.472] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20
	[0074.472] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.472] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.473] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0074.473] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0074.473] lstrlenW (lpString=".doc") returned 4
	[0074.473] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.473] lstrlenW (lpString=".docx") returned 5
	[0074.473] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.473] lstrlenW (lpString=".pdf") returned 4
	[0074.473] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.473] lstrlenW (lpString=".xls") returned 4
	[0074.473] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.473] lstrlenW (lpString=".xlsx") returned 5
	[0074.473] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.473] lstrlenW (lpString=".ppt") returned 4
	[0074.473] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.473] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0074.473] lstrlenW (lpString=".zip") returned 4
	[0074.473] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.473] lstrlenW (lpString=".rar") returned 4
	[0074.473] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.473] lstrlenW (lpString=".bz2") returned 4
	[0074.473] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.473] lstrlenW (lpString=".7z") returned 3
	[0074.473] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.473] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0074.473] lstrlenW (lpString=".dbf") returned 4
	[0074.473] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.473] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0074.474] lstrlenW (lpString=".1cd") returned 4
	[0074.474] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.474] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0074.474] lstrlenW (lpString=".jpg") returned 4
	[0074.474] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.474] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0074.474] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0074.474] lstrlenW (lpString=".doc") returned 4
	[0074.474] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.474] lstrlenW (lpString=".docx") returned 5
	[0074.474] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.474] lstrlenW (lpString=".pdf") returned 4
	[0074.474] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.474] lstrlenW (lpString=".xls") returned 4
	[0074.474] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.474] lstrlenW (lpString=".xlsx") returned 5
	[0074.474] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.474] lstrlenW (lpString=".ppt") returned 4
	[0074.474] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.474] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0074.474] lstrlenW (lpString=".zip") returned 4
	[0074.474] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.474] lstrlenW (lpString=".rar") returned 4
	[0074.474] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.474] lstrlenW (lpString=".bz2") returned 4
	[0074.474] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.474] lstrlenW (lpString=".7z") returned 3
	[0074.474] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.474] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0074.474] lstrlenW (lpString=".dbf") returned 4
	[0074.474] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.474] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0074.475] lstrlenW (lpString=".1cd") returned 4
	[0074.475] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.475] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0074.475] lstrlenW (lpString=".jpg") returned 4
	[0074.475] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.475] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0074.475] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0074.475] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0074.475] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=90704) returned 1
	[0074.475] CloseHandle (hObject=0x160) returned 1
	[0074.475] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20
	[0074.475] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.475] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.475] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0074.475] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0074.476] lstrlenW (lpString=".doc") returned 4
	[0074.476] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.476] lstrlenW (lpString=".docx") returned 5
	[0074.476] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.476] lstrlenW (lpString=".pdf") returned 4
	[0074.476] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.476] lstrlenW (lpString=".xls") returned 4
	[0074.476] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.476] lstrlenW (lpString=".xlsx") returned 5
	[0074.476] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.476] lstrlenW (lpString=".ppt") returned 4
	[0074.476] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.476] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0074.476] lstrlenW (lpString=".zip") returned 4
	[0074.476] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.476] lstrlenW (lpString=".rar") returned 4
	[0074.476] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.476] lstrlenW (lpString=".bz2") returned 4
	[0074.476] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.476] lstrlenW (lpString=".7z") returned 3
	[0074.476] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.476] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0074.476] lstrlenW (lpString=".dbf") returned 4
	[0074.476] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.476] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0074.476] lstrlenW (lpString=".1cd") returned 4
	[0074.476] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.476] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0074.476] lstrlenW (lpString=".jpg") returned 4
	[0074.476] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.476] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0074.476] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0074.476] lstrlenW (lpString=".doc") returned 4
	[0074.476] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.477] lstrlenW (lpString=".docx") returned 5
	[0074.477] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.477] lstrlenW (lpString=".pdf") returned 4
	[0074.477] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.477] lstrlenW (lpString=".xls") returned 4
	[0074.477] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.477] lstrlenW (lpString=".xlsx") returned 5
	[0074.477] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.477] lstrlenW (lpString=".ppt") returned 4
	[0074.477] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.477] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0074.477] lstrlenW (lpString=".zip") returned 4
	[0074.477] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.477] lstrlenW (lpString=".rar") returned 4
	[0074.477] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.477] lstrlenW (lpString=".bz2") returned 4
	[0074.477] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.477] lstrlenW (lpString=".7z") returned 3
	[0074.477] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.477] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0074.477] lstrlenW (lpString=".dbf") returned 4
	[0074.477] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.477] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0074.477] lstrlenW (lpString=".1cd") returned 4
	[0074.477] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.477] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0074.477] lstrlenW (lpString=".jpg") returned 4
	[0074.477] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.477] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0074.477] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0074.478] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0074.478] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=76352) returned 1
	[0074.478] CloseHandle (hObject=0x160) returned 1
	[0074.478] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20
	[0074.478] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.478] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.478] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0074.478] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0074.478] lstrlenW (lpString=".doc") returned 4
	[0074.478] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.478] lstrlenW (lpString=".docx") returned 5
	[0074.478] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.478] lstrlenW (lpString=".pdf") returned 4
	[0074.478] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.478] lstrlenW (lpString=".xls") returned 4
	[0074.478] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.478] lstrlenW (lpString=".xlsx") returned 5
	[0074.478] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.478] lstrlenW (lpString=".ppt") returned 4
	[0074.478] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.478] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0074.478] lstrlenW (lpString=".zip") returned 4
	[0074.478] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.479] lstrlenW (lpString=".rar") returned 4
	[0074.479] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.479] lstrlenW (lpString=".bz2") returned 4
	[0074.479] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.479] lstrlenW (lpString=".7z") returned 3
	[0074.479] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.479] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0074.479] lstrlenW (lpString=".dbf") returned 4
	[0074.479] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.479] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0074.479] lstrlenW (lpString=".1cd") returned 4
	[0074.479] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.479] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0074.479] lstrlenW (lpString=".jpg") returned 4
	[0074.479] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.479] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0074.479] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0074.479] lstrlenW (lpString=".doc") returned 4
	[0074.479] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.479] lstrlenW (lpString=".docx") returned 5
	[0074.479] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.479] lstrlenW (lpString=".pdf") returned 4
	[0074.479] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.479] lstrlenW (lpString=".xls") returned 4
	[0074.479] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.479] lstrlenW (lpString=".xlsx") returned 5
	[0074.479] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.479] lstrlenW (lpString=".ppt") returned 4
	[0074.486] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.486] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0074.486] lstrlenW (lpString=".zip") returned 4
	[0074.486] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.486] lstrlenW (lpString=".rar") returned 4
	[0074.486] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.486] lstrlenW (lpString=".bz2") returned 4
	[0074.486] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.486] lstrlenW (lpString=".7z") returned 3
	[0074.486] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.486] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0074.486] lstrlenW (lpString=".dbf") returned 4
	[0074.486] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.486] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0074.486] lstrlenW (lpString=".1cd") returned 4
	[0074.486] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.486] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0074.486] lstrlenW (lpString=".jpg") returned 4
	[0074.486] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.486] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0074.486] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0074.486] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0074.487] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=75344) returned 1
	[0074.487] CloseHandle (hObject=0x160) returned 1
	[0074.487] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20
	[0074.487] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.487] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.487] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0074.487] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0074.487] lstrlenW (lpString=".doc") returned 4
	[0074.487] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.487] lstrlenW (lpString=".docx") returned 5
	[0074.487] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.487] lstrlenW (lpString=".pdf") returned 4
	[0074.487] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.487] lstrlenW (lpString=".xls") returned 4
	[0074.487] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.487] lstrlenW (lpString=".xlsx") returned 5
	[0074.487] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.487] lstrlenW (lpString=".ppt") returned 4
	[0074.487] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.487] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0074.487] lstrlenW (lpString=".zip") returned 4
	[0074.487] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.487] lstrlenW (lpString=".rar") returned 4
	[0074.487] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.488] lstrlenW (lpString=".bz2") returned 4
	[0074.488] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.488] lstrlenW (lpString=".7z") returned 3
	[0074.488] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.488] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0074.488] lstrlenW (lpString=".dbf") returned 4
	[0074.488] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.488] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0074.488] lstrlenW (lpString=".1cd") returned 4
	[0074.488] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.488] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0074.488] lstrlenW (lpString=".jpg") returned 4
	[0074.488] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.488] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0074.488] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0074.488] lstrlenW (lpString=".doc") returned 4
	[0074.488] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.488] lstrlenW (lpString=".docx") returned 5
	[0074.488] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.488] lstrlenW (lpString=".pdf") returned 4
	[0074.488] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.488] lstrlenW (lpString=".xls") returned 4
	[0074.488] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.488] lstrlenW (lpString=".xlsx") returned 5
	[0074.488] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.488] lstrlenW (lpString=".ppt") returned 4
	[0074.488] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.488] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0074.488] lstrlenW (lpString=".zip") returned 4
	[0074.488] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.488] lstrlenW (lpString=".rar") returned 4
	[0074.488] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.488] lstrlenW (lpString=".bz2") returned 4
	[0074.488] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.488] lstrlenW (lpString=".7z") returned 3
	[0074.488] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.489] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0074.489] lstrlenW (lpString=".dbf") returned 4
	[0074.489] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.489] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0074.489] lstrlenW (lpString=".1cd") returned 4
	[0074.489] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.489] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0074.489] lstrlenW (lpString=".jpg") returned 4
	[0074.489] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.489] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0074.489] lstrlenW (lpString="memtest.exe") returned 11
	[0074.489] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0074.489] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=485760) returned 1
	[0074.489] CloseHandle (hObject=0x160) returned 1
	[0074.489] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20
	[0074.489] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.489] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.490] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0074.490] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0074.490] lstrlenW (lpString=".doc") returned 4
	[0074.490] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0074.490] lstrlenW (lpString=".docx") returned 5
	[0074.490] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0074.490] lstrlenW (lpString=".pdf") returned 4
	[0074.490] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0074.490] lstrlenW (lpString=".xls") returned 4
	[0074.490] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0074.490] lstrlenW (lpString=".xlsx") returned 5
	[0074.490] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0074.490] lstrlenW (lpString=".ppt") returned 4
	[0074.490] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0074.490] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0074.490] lstrlenW (lpString=".zip") returned 4
	[0074.490] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0074.490] lstrlenW (lpString=".rar") returned 4
	[0074.490] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0074.490] lstrlenW (lpString=".bz2") returned 4
	[0074.490] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0074.490] lstrlenW (lpString=".7z") returned 3
	[0074.490] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0074.490] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0075.733] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0075.894] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0076.040] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0076.040] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0076.040] ReadFile (in: hFile=0x198, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0076.135] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0076.135] ReadFile (in: hFile=0x198, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0076.159] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0076.159] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0076.160] ReadFile (in: hFile=0x198, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0076.202] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.202] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0076.291] SetEndOfFile (hFile=0x198) returned 1
	[0076.291] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f70078
	[0076.295] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0076.295] WriteFile (in: hFile=0x198, lpBuffer=0x3f70078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f70078*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0076.297] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0076.297] WriteFile (in: hFile=0x198, lpBuffer=0x3f70078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f70078*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0076.298] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0076.299] WriteFile (in: hFile=0x198, lpBuffer=0x3f70078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f70078*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0076.300] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f70078 | out: hHeap=0x5e0000) returned 1
	[0076.300] CloseHandle (hObject=0x198) returned 1
	[0077.569] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0077.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0077.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0077.569] lstrlenW (lpString=".doc") returned 4
	[0077.569] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0077.569] lstrlenW (lpString=".docx") returned 5
	[0077.569] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0077.569] lstrlenW (lpString=".pdf") returned 4
	[0077.569] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0077.570] lstrlenW (lpString=".xls") returned 4
	[0077.570] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0077.570] lstrlenW (lpString=".xlsx") returned 5
	[0077.570] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0077.570] lstrlenW (lpString=".ppt") returned 4
	[0077.570] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0077.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0077.570] lstrlenW (lpString=".zip") returned 4
	[0077.570] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0077.570] lstrlenW (lpString=".rar") returned 4
	[0077.570] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0077.570] lstrlenW (lpString=".bz2") returned 4
	[0077.570] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0077.570] lstrlenW (lpString=".7z") returned 3
	[0077.570] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0077.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0077.570] lstrlenW (lpString=".dbf") returned 4
	[0077.570] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0077.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0077.570] lstrlenW (lpString=".1cd") returned 4
	[0077.571] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0077.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0077.571] lstrlenW (lpString=".jpg") returned 4
	[0077.571] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0077.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0077.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0077.571] lstrlenW (lpString=".doc") returned 4
	[0077.571] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0077.571] lstrlenW (lpString=".docx") returned 5
	[0077.571] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0077.571] lstrlenW (lpString=".pdf") returned 4
	[0077.571] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0077.571] lstrlenW (lpString=".xls") returned 4
	[0077.571] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0077.571] lstrlenW (lpString=".xlsx") returned 5
	[0077.571] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0077.571] lstrlenW (lpString=".ppt") returned 4
	[0077.571] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0077.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0077.572] lstrlenW (lpString=".zip") returned 4
	[0077.572] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0077.572] lstrlenW (lpString=".rar") returned 4
	[0077.572] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0077.572] lstrlenW (lpString=".bz2") returned 4
	[0077.572] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0077.572] lstrlenW (lpString=".7z") returned 3
	[0077.572] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0077.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0077.572] lstrlenW (lpString=".dbf") returned 4
	[0077.572] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0077.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0077.572] lstrlenW (lpString=".1cd") returned 4
	[0077.572] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0077.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0077.572] lstrlenW (lpString=".jpg") returned 4
	[0077.572] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0077.572] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0077.572] lstrlenW (lpString="WordLR.cab") returned 10
	[0077.573] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0077.573] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=43806141) returned 1
	[0077.573] CloseHandle (hObject=0x198) returned 1
	[0077.573] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020
	[0077.574] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0077.574] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0077.575] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0077.575] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0077.575] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.575] ReadFile (in: hFile=0x198, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0077.579] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.579] ReadFile (in: hFile=0x198, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0077.714] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0077.714] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.714] ReadFile (in: hFile=0x198, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0077.943] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.943] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0077.963] SetEndOfFile (hFile=0x198) returned 1
	[0077.963] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f40078
	[0077.964] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0077.964] WriteFile (in: hFile=0x198, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0077.965] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0077.965] WriteFile (in: hFile=0x198, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0077.968] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0077.968] WriteFile (in: hFile=0x198, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0077.971] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f40078 | out: hHeap=0x5e0000) returned 1
	[0077.971] CloseHandle (hObject=0x198) returned 1
	[0078.686] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0078.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0078.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0078.686] lstrlenW (lpString=".doc") returned 4
	[0078.686] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0078.686] lstrlenW (lpString=".docx") returned 5
	[0078.686] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0078.686] lstrlenW (lpString=".pdf") returned 4
	[0078.687] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0078.687] lstrlenW (lpString=".xls") returned 4
	[0078.687] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0078.687] lstrlenW (lpString=".xlsx") returned 5
	[0078.687] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0078.687] lstrlenW (lpString=".ppt") returned 4
	[0078.687] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0078.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0078.687] lstrlenW (lpString=".zip") returned 4
	[0078.687] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0078.687] lstrlenW (lpString=".rar") returned 4
	[0078.687] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0078.687] lstrlenW (lpString=".bz2") returned 4
	[0078.687] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0078.687] lstrlenW (lpString=".7z") returned 3
	[0078.687] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0078.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0078.687] lstrlenW (lpString=".dbf") returned 4
	[0078.687] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0078.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0078.687] lstrlenW (lpString=".1cd") returned 4
	[0078.687] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0078.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0078.687] lstrlenW (lpString=".jpg") returned 4
	[0078.687] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0078.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0078.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0078.688] lstrlenW (lpString=".doc") returned 4
	[0078.688] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0078.688] lstrlenW (lpString=".docx") returned 5
	[0078.688] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0078.688] lstrlenW (lpString=".pdf") returned 4
	[0078.688] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0078.688] lstrlenW (lpString=".xls") returned 4
	[0078.688] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0078.688] lstrlenW (lpString=".xlsx") returned 5
	[0078.688] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0078.688] lstrlenW (lpString=".ppt") returned 4
	[0078.688] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0078.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0078.688] lstrlenW (lpString=".zip") returned 4
	[0078.688] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0078.688] lstrlenW (lpString=".rar") returned 4
	[0078.688] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0078.688] lstrlenW (lpString=".bz2") returned 4
	[0078.688] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0078.688] lstrlenW (lpString=".7z") returned 3
	[0078.688] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0078.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0078.688] lstrlenW (lpString=".dbf") returned 4
	[0078.688] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0078.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0078.688] lstrlenW (lpString=".1cd") returned 4
	[0078.688] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0078.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0078.689] lstrlenW (lpString=".jpg") returned 4
	[0078.689] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0078.689] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0078.689] lstrlenW (lpString="Proof.msi") returned 9
	[0078.689] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0078.697] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=881152) returned 1
	[0078.697] CloseHandle (hObject=0x198) returned 1
	[0078.697] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020
	[0078.879] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0079.035] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0079.862] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.862] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.862] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0080.331] GetLastError () returned 0x0
	[0080.332] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xd7200, lpOverlapped=0x0) returned 1
	[0080.695] WriteFile (in: hFile=0x194, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xd7210, lpOverlapped=0x0) returned 1
	[0080.760] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0080.760] WriteFile (in: hFile=0x194, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0080.760] SetEndOfFile (hFile=0x194) returned 1
	[0080.760] CloseHandle (hObject=0x194) returned 1
	[0080.760] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.761] SetEndOfFile (hFile=0x19c) returned 1
	[0080.769] CloseHandle (hObject=0x19c) returned 1
	[0080.769] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0080.769] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1
	[0080.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0080.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0080.769] lstrlenW (lpString=".doc") returned 4
	[0080.769] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0080.769] lstrlenW (lpString=".docx") returned 5
	[0080.769] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0080.769] lstrlenW (lpString=".pdf") returned 4
	[0080.769] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0080.769] lstrlenW (lpString=".xls") returned 4
	[0080.769] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0080.769] lstrlenW (lpString=".xlsx") returned 5
	[0080.770] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0080.770] lstrlenW (lpString=".ppt") returned 4
	[0080.770] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0080.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0080.770] lstrlenW (lpString=".zip") returned 4
	[0080.770] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0080.770] lstrlenW (lpString=".rar") returned 4
	[0080.770] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0080.770] lstrlenW (lpString=".bz2") returned 4
	[0080.770] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0080.770] lstrlenW (lpString=".7z") returned 3
	[0080.770] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0080.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0080.770] lstrlenW (lpString=".dbf") returned 4
	[0080.770] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0080.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0080.770] lstrlenW (lpString=".1cd") returned 4
	[0080.770] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0080.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0080.770] lstrlenW (lpString=".jpg") returned 4
	[0080.770] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0080.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0080.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0080.770] lstrlenW (lpString=".doc") returned 4
	[0080.770] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0080.770] lstrlenW (lpString=".docx") returned 5
	[0080.770] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0080.770] lstrlenW (lpString=".pdf") returned 4
	[0080.770] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0080.770] lstrlenW (lpString=".xls") returned 4
	[0080.771] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0080.771] lstrlenW (lpString=".xlsx") returned 5
	[0080.771] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0080.771] lstrlenW (lpString=".ppt") returned 4
	[0080.771] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0080.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0080.771] lstrlenW (lpString=".zip") returned 4
	[0080.771] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0080.771] lstrlenW (lpString=".rar") returned 4
	[0080.771] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0080.771] lstrlenW (lpString=".bz2") returned 4
	[0080.771] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0080.771] lstrlenW (lpString=".7z") returned 3
	[0080.771] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0080.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0080.771] lstrlenW (lpString=".dbf") returned 4
	[0080.771] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0080.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0080.771] lstrlenW (lpString=".1cd") returned 4
	[0080.771] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0080.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0080.771] lstrlenW (lpString=".jpg") returned 4
	[0080.771] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0080.771] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0080.771] lstrlenW (lpString="OneNoteMUI.msi") returned 14
	[0080.771] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0080.772] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2503680) returned 1
	[0080.772] CloseHandle (hObject=0x19c) returned 1
	[0080.772] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020
	[0080.772] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0080.772] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0080.773] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0080.773] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0080.773] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.773] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.776] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.776] ReadFile (in: hFile=0x19c, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.870] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0080.870] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.870] ReadFile (in: hFile=0x19c, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.962] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.962] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0080.982] SetEndOfFile (hFile=0x19c) returned 1
	[0080.982] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f40078
	[0080.982] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.983] WriteFile (in: hFile=0x19c, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.984] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.985] WriteFile (in: hFile=0x19c, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.059] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.059] WriteFile (in: hFile=0x19c, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.063] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f40078 | out: hHeap=0x5e0000) returned 1
	[0081.063] CloseHandle (hObject=0x19c) returned 1
	[0081.063] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0081.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0081.063] lstrlenW (lpString=".doc") returned 4
	[0081.063] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0081.063] lstrlenW (lpString=".docx") returned 5
	[0081.063] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0081.064] lstrlenW (lpString=".pdf") returned 4
	[0081.064] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0081.064] lstrlenW (lpString=".xls") returned 4
	[0081.064] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0081.064] lstrlenW (lpString=".xlsx") returned 5
	[0081.064] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0081.064] lstrlenW (lpString=".ppt") returned 4
	[0081.064] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0081.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0081.064] lstrlenW (lpString=".zip") returned 4
	[0081.064] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0081.064] lstrlenW (lpString=".rar") returned 4
	[0081.064] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0081.064] lstrlenW (lpString=".bz2") returned 4
	[0081.064] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0081.064] lstrlenW (lpString=".7z") returned 3
	[0081.064] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0081.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0081.064] lstrlenW (lpString=".dbf") returned 4
	[0081.064] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0081.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0081.064] lstrlenW (lpString=".1cd") returned 4
	[0081.064] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0081.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0081.065] lstrlenW (lpString=".jpg") returned 4
	[0081.065] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0081.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0081.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0081.065] lstrlenW (lpString=".doc") returned 4
	[0081.065] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0081.065] lstrlenW (lpString=".docx") returned 5
	[0081.065] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0081.065] lstrlenW (lpString=".pdf") returned 4
	[0081.065] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0081.065] lstrlenW (lpString=".xls") returned 4
	[0081.065] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0081.065] lstrlenW (lpString=".xlsx") returned 5
	[0081.065] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0081.065] lstrlenW (lpString=".ppt") returned 4
	[0081.065] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0081.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0081.065] lstrlenW (lpString=".zip") returned 4
	[0081.065] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0081.065] lstrlenW (lpString=".rar") returned 4
	[0081.065] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0081.065] lstrlenW (lpString=".bz2") returned 4
	[0081.065] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0081.065] lstrlenW (lpString=".7z") returned 3
	[0081.065] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0081.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0081.066] lstrlenW (lpString=".dbf") returned 4
	[0081.066] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0081.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0081.066] lstrlenW (lpString=".1cd") returned 4
	[0081.066] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0081.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0081.066] lstrlenW (lpString=".jpg") returned 4
	[0081.066] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0081.066] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0081.066] lstrlenW (lpString="ProjLR.cab") returned 10
	[0081.066] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0081.067] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=8265165) returned 1
	[0081.067] CloseHandle (hObject=0x19c) returned 1
	[0081.067] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020
	[0081.068] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.068] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0081.068] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0081.069] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0081.069] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0081.069] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0081.071] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0081.071] ReadFile (in: hFile=0x19c, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0081.075] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0081.075] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0081.075] ReadFile (in: hFile=0x19c, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0081.130] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.130] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0081.152] SetEndOfFile (hFile=0x19c) returned 1
	[0081.152] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f40078
	[0081.205] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.205] WriteFile (in: hFile=0x19c, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.314] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.314] WriteFile (in: hFile=0x19c, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.316] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.316] WriteFile (in: hFile=0x19c, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.318] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f40078 | out: hHeap=0x5e0000) returned 1
	[0081.318] CloseHandle (hObject=0x19c) returned 1
	[0081.319] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0081.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0081.319] lstrlenW (lpString=".doc") returned 4
	[0081.319] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0081.319] lstrlenW (lpString=".docx") returned 5
	[0081.319] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0081.319] lstrlenW (lpString=".pdf") returned 4
	[0081.319] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0081.319] lstrlenW (lpString=".xls") returned 4
	[0081.319] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0081.319] lstrlenW (lpString=".xlsx") returned 5
	[0081.319] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0081.319] lstrlenW (lpString=".ppt") returned 4
	[0081.319] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0081.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0081.319] lstrlenW (lpString=".zip") returned 4
	[0081.319] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0081.320] lstrlenW (lpString=".rar") returned 4
	[0081.320] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0081.320] lstrlenW (lpString=".bz2") returned 4
	[0081.320] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0081.320] lstrlenW (lpString=".7z") returned 3
	[0081.320] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0081.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0081.320] lstrlenW (lpString=".dbf") returned 4
	[0081.320] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0081.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0081.320] lstrlenW (lpString=".1cd") returned 4
	[0081.320] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0081.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0081.320] lstrlenW (lpString=".jpg") returned 4
	[0081.320] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0081.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0081.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0081.320] lstrlenW (lpString=".doc") returned 4
	[0081.320] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0081.320] lstrlenW (lpString=".docx") returned 5
	[0081.320] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0081.320] lstrlenW (lpString=".pdf") returned 4
	[0081.320] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0081.320] lstrlenW (lpString=".xls") returned 4
	[0081.320] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0081.320] lstrlenW (lpString=".xlsx") returned 5
	[0081.320] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0081.320] lstrlenW (lpString=".ppt") returned 4
	[0081.320] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0081.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0081.320] lstrlenW (lpString=".zip") returned 4
	[0081.321] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0081.321] lstrlenW (lpString=".rar") returned 4
	[0081.321] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0081.321] lstrlenW (lpString=".bz2") returned 4
	[0081.321] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0081.321] lstrlenW (lpString=".7z") returned 3
	[0081.321] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0081.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0081.321] lstrlenW (lpString=".dbf") returned 4
	[0081.321] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0081.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0081.321] lstrlenW (lpString=".1cd") returned 4
	[0081.321] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0081.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0081.321] lstrlenW (lpString=".jpg") returned 4
	[0081.321] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0081.321] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0081.321] lstrlenW (lpString="dwintl20.dll") returned 12
	[0081.321] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0081.322] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=107912) returned 1
	[0081.322] CloseHandle (hObject=0x19c) returned 1
	[0081.322] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020
	[0081.322] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0081.322] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.322] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.391] GetLastError () returned 0x0
	[0081.391] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x1a588, lpOverlapped=0x0) returned 1
	[0081.419] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x1a590, lpOverlapped=0x0) returned 1
	[0081.422] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.422] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0081.422] SetEndOfFile (hFile=0x198) returned 1
	[0081.422] CloseHandle (hObject=0x198) returned 1
	[0081.423] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.423] SetEndOfFile (hFile=0x19c) returned 1
	[0081.424] CloseHandle (hObject=0x19c) returned 1
	[0081.425] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.425] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1
	[0081.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0081.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0081.425] lstrlenW (lpString=".doc") returned 4
	[0081.425] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.425] lstrlenW (lpString=".docx") returned 5
	[0081.425] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0081.426] lstrlenW (lpString=".pdf") returned 4
	[0081.426] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.426] lstrlenW (lpString=".xls") returned 4
	[0081.426] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.426] lstrlenW (lpString=".xlsx") returned 5
	[0081.426] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0081.426] lstrlenW (lpString=".ppt") returned 4
	[0081.426] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0081.426] lstrlenW (lpString=".zip") returned 4
	[0081.426] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.426] lstrlenW (lpString=".rar") returned 4
	[0081.426] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.426] lstrlenW (lpString=".bz2") returned 4
	[0081.426] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.426] lstrlenW (lpString=".7z") returned 3
	[0081.426] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0081.426] lstrlenW (lpString=".dbf") returned 4
	[0081.426] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0081.426] lstrlenW (lpString=".1cd") returned 4
	[0081.426] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0081.426] lstrlenW (lpString=".jpg") returned 4
	[0081.426] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0081.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0081.427] lstrlenW (lpString=".doc") returned 4
	[0081.427] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.427] lstrlenW (lpString=".docx") returned 5
	[0081.427] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0081.427] lstrlenW (lpString=".pdf") returned 4
	[0081.427] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.427] lstrlenW (lpString=".xls") returned 4
	[0081.427] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.427] lstrlenW (lpString=".xlsx") returned 5
	[0081.427] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0081.427] lstrlenW (lpString=".ppt") returned 4
	[0081.427] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0081.427] lstrlenW (lpString=".zip") returned 4
	[0081.427] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.427] lstrlenW (lpString=".rar") returned 4
	[0081.427] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.427] lstrlenW (lpString=".bz2") returned 4
	[0081.427] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.427] lstrlenW (lpString=".7z") returned 3
	[0081.427] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0081.427] lstrlenW (lpString=".dbf") returned 4
	[0081.427] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0081.427] lstrlenW (lpString=".1cd") returned 4
	[0081.427] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0081.427] lstrlenW (lpString=".jpg") returned 4
	[0081.427] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.428] lstrcmpiW (lpString1=".manifest", lpString2=".adobe") returned 1
	[0081.428] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27
	[0081.428] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0081.480] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1857) returned 1
	[0081.480] CloseHandle (hObject=0x19c) returned 1
	[0081.480] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020
	[0081.496] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.496] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0081.578] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.578] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.578] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0081.714] GetLastError () returned 0x0
	[0081.714] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x741, lpOverlapped=0x0) returned 1
	[0081.724] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x750, lpOverlapped=0x0) returned 1
	[0081.725] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.725] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x10a, lpOverlapped=0x0) returned 1
	[0081.725] SetEndOfFile (hFile=0x1b0) returned 1
	[0081.839] CloseHandle (hObject=0x1b0) returned 1
	[0081.843] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.843] SetEndOfFile (hFile=0x19c) returned 1
	[0081.849] CloseHandle (hObject=0x19c) returned 1
	[0081.868] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.874] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1
	[0081.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0081.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0081.882] lstrlenW (lpString=".doc") returned 4
	[0081.882] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0081.882] lstrlenW (lpString=".docx") returned 5
	[0081.882] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0081.882] lstrlenW (lpString=".pdf") returned 4
	[0081.882] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0081.882] lstrlenW (lpString=".xls") returned 4
	[0081.882] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0081.882] lstrlenW (lpString=".xlsx") returned 5
	[0081.882] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0081.882] lstrlenW (lpString=".ppt") returned 4
	[0081.882] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0081.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0081.882] lstrlenW (lpString=".zip") returned 4
	[0081.882] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0081.882] lstrlenW (lpString=".rar") returned 4
	[0081.883] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0081.883] lstrlenW (lpString=".bz2") returned 4
	[0081.883] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0081.883] lstrlenW (lpString=".7z") returned 3
	[0081.883] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0081.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0081.883] lstrlenW (lpString=".dbf") returned 4
	[0081.883] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0081.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0081.883] lstrlenW (lpString=".1cd") returned 4
	[0081.883] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0081.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0081.883] lstrlenW (lpString=".jpg") returned 4
	[0081.883] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0081.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0081.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0081.883] lstrlenW (lpString=".doc") returned 4
	[0081.883] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0081.883] lstrlenW (lpString=".docx") returned 5
	[0081.883] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0081.883] lstrlenW (lpString=".pdf") returned 4
	[0081.883] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0081.883] lstrlenW (lpString=".xls") returned 4
	[0081.883] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0081.883] lstrlenW (lpString=".xlsx") returned 5
	[0081.883] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0081.884] lstrlenW (lpString=".ppt") returned 4
	[0081.884] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0081.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0081.884] lstrlenW (lpString=".zip") returned 4
	[0081.884] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0081.884] lstrlenW (lpString=".rar") returned 4
	[0081.884] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0081.884] lstrlenW (lpString=".bz2") returned 4
	[0081.884] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0081.884] lstrlenW (lpString=".7z") returned 3
	[0081.884] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0081.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0081.884] lstrlenW (lpString=".dbf") returned 4
	[0081.884] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0081.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0081.884] lstrlenW (lpString=".1cd") returned 4
	[0081.884] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0081.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0081.884] lstrlenW (lpString=".jpg") returned 4
	[0081.884] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0081.884] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0081.884] lstrlenW (lpString="OfficeMUI.msi") returned 13
	[0081.885] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.964] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=3702272) returned 1
	[0081.964] CloseHandle (hObject=0x184) returned 1
	[0081.964] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020
	[0081.971] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.972] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0082.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0082.118] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0082.118] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.118] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0082.121] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.121] ReadFile (in: hFile=0x1b0, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0082.132] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0082.132] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.132] ReadFile (in: hFile=0x1b0, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0082.152] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.152] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0106, lpOverlapped=0x0) returned 1
	[0082.183] SetEndOfFile (hFile=0x1b0) returned 1
	[0082.193] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f38078
	[0082.198] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0082.198] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f38078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f38078*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0082.206] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0082.206] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f38078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f38078*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0082.211] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0082.211] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f38078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f38078*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0082.214] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f38078 | out: hHeap=0x5e0000) returned 1
	[0082.217] CloseHandle (hObject=0x1b0) returned 1
	[0082.283] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0082.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0082.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0082.291] lstrlenW (lpString=".doc") returned 4
	[0082.291] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0082.291] lstrlenW (lpString=".docx") returned 5
	[0082.291] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0082.291] lstrlenW (lpString=".pdf") returned 4
	[0082.291] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0082.291] lstrlenW (lpString=".xls") returned 4
	[0082.291] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0082.291] lstrlenW (lpString=".xlsx") returned 5
	[0082.291] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0082.291] lstrlenW (lpString=".ppt") returned 4
	[0082.292] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0082.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0082.292] lstrlenW (lpString=".zip") returned 4
	[0082.292] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0082.292] lstrlenW (lpString=".rar") returned 4
	[0082.292] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0082.292] lstrlenW (lpString=".bz2") returned 4
	[0082.292] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0082.292] lstrlenW (lpString=".7z") returned 3
	[0082.292] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0082.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0082.292] lstrlenW (lpString=".dbf") returned 4
	[0082.292] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0082.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0082.292] lstrlenW (lpString=".1cd") returned 4
	[0082.292] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0082.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0082.292] lstrlenW (lpString=".jpg") returned 4
	[0082.292] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0082.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0082.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0082.292] lstrlenW (lpString=".doc") returned 4
	[0082.292] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0082.292] lstrlenW (lpString=".docx") returned 5
	[0082.292] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0082.292] lstrlenW (lpString=".pdf") returned 4
	[0082.292] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0082.292] lstrlenW (lpString=".xls") returned 4
	[0082.292] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0082.292] lstrlenW (lpString=".xlsx") returned 5
	[0082.292] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0082.293] lstrlenW (lpString=".ppt") returned 4
	[0082.293] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0082.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0082.293] lstrlenW (lpString=".zip") returned 4
	[0082.293] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0082.293] lstrlenW (lpString=".rar") returned 4
	[0082.293] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0082.293] lstrlenW (lpString=".bz2") returned 4
	[0082.293] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0082.293] lstrlenW (lpString=".7z") returned 3
	[0082.293] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0082.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0082.293] lstrlenW (lpString=".dbf") returned 4
	[0082.293] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0082.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0082.293] lstrlenW (lpString=".1cd") returned 4
	[0082.293] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0082.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0082.293] lstrlenW (lpString=".jpg") returned 4
	[0082.293] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0082.293] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0082.293] lstrlenW (lpString="AccessMUI.msi") returned 13
	[0082.293] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0082.299] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2517504) returned 1
	[0082.299] CloseHandle (hObject=0x174) returned 1
	[0082.299] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020
	[0082.299] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.299] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0082.300] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0082.300] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0082.300] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.300] ReadFile (in: hFile=0x174, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0082.308] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.308] ReadFile (in: hFile=0x174, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0082.332] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0082.332] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.332] ReadFile (in: hFile=0x174, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0082.351] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.351] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0106, lpOverlapped=0x0) returned 1
	[0082.373] SetEndOfFile (hFile=0x174) returned 1
	[0082.376] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f28070
	[0082.380] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0082.380] WriteFile (in: hFile=0x174, lpBuffer=0x3f28070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f28070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0082.382] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0082.382] WriteFile (in: hFile=0x174, lpBuffer=0x3f28070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f28070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0082.388] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0082.388] WriteFile (in: hFile=0x174, lpBuffer=0x3f28070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f28070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0082.391] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f28070 | out: hHeap=0x5e0000) returned 1
	[0082.391] CloseHandle (hObject=0x174) returned 1
	[0082.392] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0082.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0082.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0082.392] lstrlenW (lpString=".doc") returned 4
	[0082.392] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0082.392] lstrlenW (lpString=".docx") returned 5
	[0082.392] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0082.392] lstrlenW (lpString=".pdf") returned 4
	[0082.392] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0082.392] lstrlenW (lpString=".xls") returned 4
	[0082.392] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0082.392] lstrlenW (lpString=".xlsx") returned 5
	[0082.393] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0082.393] lstrlenW (lpString=".ppt") returned 4
	[0082.393] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0082.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0082.393] lstrlenW (lpString=".zip") returned 4
	[0082.393] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0082.393] lstrlenW (lpString=".rar") returned 4
	[0082.393] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0082.393] lstrlenW (lpString=".bz2") returned 4
	[0082.393] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0082.393] lstrlenW (lpString=".7z") returned 3
	[0082.393] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0082.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0082.393] lstrlenW (lpString=".dbf") returned 4
	[0082.393] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0082.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0082.393] lstrlenW (lpString=".1cd") returned 4
	[0082.393] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0082.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0082.393] lstrlenW (lpString=".jpg") returned 4
	[0082.393] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0082.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0082.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0082.393] lstrlenW (lpString=".doc") returned 4
	[0082.393] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0082.394] lstrlenW (lpString=".docx") returned 5
	[0082.394] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0082.394] lstrlenW (lpString=".pdf") returned 4
	[0082.394] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0082.394] lstrlenW (lpString=".xls") returned 4
	[0082.394] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0082.394] lstrlenW (lpString=".xlsx") returned 5
	[0082.394] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0082.394] lstrlenW (lpString=".ppt") returned 4
	[0082.394] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0082.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0082.394] lstrlenW (lpString=".zip") returned 4
	[0082.394] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0082.394] lstrlenW (lpString=".rar") returned 4
	[0082.394] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0082.394] lstrlenW (lpString=".bz2") returned 4
	[0082.394] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0082.394] lstrlenW (lpString=".7z") returned 3
	[0082.394] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0082.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0082.394] lstrlenW (lpString=".dbf") returned 4
	[0082.394] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0082.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0082.395] lstrlenW (lpString=".1cd") returned 4
	[0082.395] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0082.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0082.395] lstrlenW (lpString=".jpg") returned 4
	[0082.395] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0082.395] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0082.395] lstrlenW (lpString="AccLR.cab") returned 9
	[0082.395] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0082.396] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=28016276) returned 1
	[0082.396] CloseHandle (hObject=0x174) returned 1
	[0082.396] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020
	[0082.396] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.396] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0082.397] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0082.397] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0082.397] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.397] ReadFile (in: hFile=0x174, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0082.418] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.418] ReadFile (in: hFile=0x174, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0082.424] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0082.424] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.424] ReadFile (in: hFile=0x174, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0082.486] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.487] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0082.511] SetEndOfFile (hFile=0x174) returned 1
	[0082.512] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f28070
	[0082.542] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0082.542] WriteFile (in: hFile=0x174, lpBuffer=0x3f28070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f28070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0082.543] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0082.543] WriteFile (in: hFile=0x174, lpBuffer=0x3f28070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f28070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0082.546] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0082.546] WriteFile (in: hFile=0x174, lpBuffer=0x3f28070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f28070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0082.549] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f28070 | out: hHeap=0x5e0000) returned 1
	[0082.608] CloseHandle (hObject=0x174) returned 1
	[0082.608] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0082.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0082.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0082.608] lstrlenW (lpString=".doc") returned 4
	[0082.608] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0082.609] lstrlenW (lpString=".docx") returned 5
	[0082.609] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0082.609] lstrlenW (lpString=".pdf") returned 4
	[0082.609] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0082.609] lstrlenW (lpString=".xls") returned 4
	[0082.609] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0082.609] lstrlenW (lpString=".xlsx") returned 5
	[0082.609] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0082.609] lstrlenW (lpString=".ppt") returned 4
	[0082.609] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0082.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0082.609] lstrlenW (lpString=".zip") returned 4
	[0082.609] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0082.609] lstrlenW (lpString=".rar") returned 4
	[0082.609] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0082.609] lstrlenW (lpString=".bz2") returned 4
	[0082.609] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0082.609] lstrlenW (lpString=".7z") returned 3
	[0082.609] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0082.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0082.609] lstrlenW (lpString=".dbf") returned 4
	[0082.609] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0082.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0082.609] lstrlenW (lpString=".1cd") returned 4
	[0082.609] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0082.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0082.610] lstrlenW (lpString=".jpg") returned 4
	[0082.610] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0082.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0082.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0082.610] lstrlenW (lpString=".doc") returned 4
	[0082.610] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0082.610] lstrlenW (lpString=".docx") returned 5
	[0082.610] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0082.610] lstrlenW (lpString=".pdf") returned 4
	[0082.610] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0082.610] lstrlenW (lpString=".xls") returned 4
	[0082.610] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0082.610] lstrlenW (lpString=".xlsx") returned 5
	[0082.610] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0082.610] lstrlenW (lpString=".ppt") returned 4
	[0082.610] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0082.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0082.610] lstrlenW (lpString=".zip") returned 4
	[0082.610] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0082.610] lstrlenW (lpString=".rar") returned 4
	[0082.610] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0082.610] lstrlenW (lpString=".bz2") returned 4
	[0082.611] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0082.611] lstrlenW (lpString=".7z") returned 3
	[0082.611] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0082.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0082.611] lstrlenW (lpString=".dbf") returned 4
	[0082.611] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0082.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0082.611] lstrlenW (lpString=".1cd") returned 4
	[0082.611] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0082.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0082.611] lstrlenW (lpString=".jpg") returned 4
	[0082.611] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0082.611] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0082.611] lstrlenW (lpString="ose.exe") returned 7
	[0082.611] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0082.665] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=174440) returned 1
	[0082.665] CloseHandle (hObject=0x19c) returned 1
	[0082.665] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020
	[0082.665] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.665] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0082.665] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.666] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.666] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0082.666] GetLastError () returned 0x0
	[0082.666] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x2a968, lpOverlapped=0x0) returned 1
	[0082.702] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x2a970, lpOverlapped=0x0) returned 1
	[0082.708] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0082.708] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0082.708] SetEndOfFile (hFile=0x174) returned 1
	[0082.708] CloseHandle (hObject=0x174) returned 1
	[0082.708] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.708] SetEndOfFile (hFile=0x19c) returned 1
	[0082.710] CloseHandle (hObject=0x19c) returned 1
	[0082.711] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0082.711] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1
	[0082.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0082.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0082.713] lstrlenW (lpString=".doc") returned 4
	[0082.713] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0082.713] lstrlenW (lpString=".docx") returned 5
	[0082.713] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0082.713] lstrlenW (lpString=".pdf") returned 4
	[0082.713] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0082.713] lstrlenW (lpString=".xls") returned 4
	[0082.713] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0082.713] lstrlenW (lpString=".xlsx") returned 5
	[0082.713] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0082.713] lstrlenW (lpString=".ppt") returned 4
	[0082.713] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0082.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0082.713] lstrlenW (lpString=".zip") returned 4
	[0082.713] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0082.713] lstrlenW (lpString=".rar") returned 4
	[0082.713] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0082.713] lstrlenW (lpString=".bz2") returned 4
	[0082.713] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0082.714] lstrlenW (lpString=".7z") returned 3
	[0082.714] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0082.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0082.714] lstrlenW (lpString=".dbf") returned 4
	[0082.714] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0082.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0082.714] lstrlenW (lpString=".1cd") returned 4
	[0082.714] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0082.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0082.714] lstrlenW (lpString=".jpg") returned 4
	[0082.714] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0082.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0082.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0082.714] lstrlenW (lpString=".doc") returned 4
	[0082.714] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0082.714] lstrlenW (lpString=".docx") returned 5
	[0082.714] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0082.714] lstrlenW (lpString=".pdf") returned 4
	[0082.714] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0082.714] lstrlenW (lpString=".xls") returned 4
	[0082.714] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0082.714] lstrlenW (lpString=".xlsx") returned 5
	[0082.714] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0082.714] lstrlenW (lpString=".ppt") returned 4
	[0082.714] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0082.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0082.714] lstrlenW (lpString=".zip") returned 4
	[0082.714] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0082.714] lstrlenW (lpString=".rar") returned 4
	[0082.714] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0082.715] lstrlenW (lpString=".bz2") returned 4
	[0082.715] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0082.715] lstrlenW (lpString=".7z") returned 3
	[0082.715] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0082.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0082.715] lstrlenW (lpString=".dbf") returned 4
	[0082.715] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0082.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0082.715] lstrlenW (lpString=".1cd") returned 4
	[0082.715] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0082.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0082.715] lstrlenW (lpString=".jpg") returned 4
	[0082.715] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0082.715] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0082.715] lstrlenW (lpString="OWOW32WW.cab") returned 12
	[0082.715] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0082.738] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=36233052) returned 1
	[0082.738] CloseHandle (hObject=0x1a4) returned 1
	[0082.739] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020
	[0082.808] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.808] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0083.003] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0083.142] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0083.143] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.143] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.161] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.161] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.168] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0083.168] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.168] ReadFile (in: hFile=0x1a4, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.203] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.203] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0083.225] SetEndOfFile (hFile=0x1a4) returned 1
	[0083.237] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0083.243] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.243] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.244] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.244] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.245] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.245] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.248] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0083.248] CloseHandle (hObject=0x1a4) returned 1
	[0083.252] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0083.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0083.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0083.253] lstrlenW (lpString=".doc") returned 4
	[0083.253] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0083.253] lstrlenW (lpString=".docx") returned 5
	[0083.253] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0083.253] lstrlenW (lpString=".pdf") returned 4
	[0083.253] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0083.253] lstrlenW (lpString=".xls") returned 4
	[0083.253] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0083.253] lstrlenW (lpString=".xlsx") returned 5
	[0083.253] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0083.253] lstrlenW (lpString=".ppt") returned 4
	[0083.254] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0083.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0083.254] lstrlenW (lpString=".zip") returned 4
	[0083.254] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0083.254] lstrlenW (lpString=".rar") returned 4
	[0083.254] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0083.254] lstrlenW (lpString=".bz2") returned 4
	[0083.254] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0083.254] lstrlenW (lpString=".7z") returned 3
	[0083.254] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0083.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0083.254] lstrlenW (lpString=".dbf") returned 4
	[0083.254] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0083.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0083.254] lstrlenW (lpString=".1cd") returned 4
	[0083.254] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0083.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0083.254] lstrlenW (lpString=".jpg") returned 4
	[0083.254] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0083.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0083.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0083.254] lstrlenW (lpString=".doc") returned 4
	[0083.254] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0083.254] lstrlenW (lpString=".docx") returned 5
	[0083.255] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0083.255] lstrlenW (lpString=".pdf") returned 4
	[0083.255] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0083.255] lstrlenW (lpString=".xls") returned 4
	[0083.255] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0083.255] lstrlenW (lpString=".xlsx") returned 5
	[0083.255] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0083.255] lstrlenW (lpString=".ppt") returned 4
	[0083.255] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0083.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0083.255] lstrlenW (lpString=".zip") returned 4
	[0083.255] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0083.255] lstrlenW (lpString=".rar") returned 4
	[0083.255] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0083.255] lstrlenW (lpString=".bz2") returned 4
	[0083.255] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0083.255] lstrlenW (lpString=".7z") returned 3
	[0083.255] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0083.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0083.255] lstrlenW (lpString=".dbf") returned 4
	[0083.255] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0083.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0083.255] lstrlenW (lpString=".1cd") returned 4
	[0083.255] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0083.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0083.256] lstrlenW (lpString=".jpg") returned 4
	[0083.256] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0083.256] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0083.256] lstrlenW (lpString="ProPrWW2.cab") returned 12
	[0083.256] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0083.272] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=222948913) returned 1
	[0083.272] CloseHandle (hObject=0x1a4) returned 1
	[0083.272] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020
	[0083.283] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.284] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0083.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0083.560] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0083.560] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.560] ReadFile (in: hFile=0x160, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.616] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.616] ReadFile (in: hFile=0x160, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.621] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0083.621] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.621] ReadFile (in: hFile=0x160, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.696] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.697] WriteFile (in: hFile=0x160, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0083.737] SetEndOfFile (hFile=0x160) returned 1
	[0083.737] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0083.737] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.738] WriteFile (in: hFile=0x160, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.739] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.739] WriteFile (in: hFile=0x160, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.742] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.742] WriteFile (in: hFile=0x160, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.745] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0083.745] CloseHandle (hObject=0x160) returned 1
	[0083.745] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0083.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0083.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0083.746] lstrlenW (lpString=".doc") returned 4
	[0083.746] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0083.746] lstrlenW (lpString=".docx") returned 5
	[0083.746] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1
	[0083.746] lstrlenW (lpString=".pdf") returned 4
	[0083.746] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0083.746] lstrlenW (lpString=".xls") returned 4
	[0083.746] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0083.746] lstrlenW (lpString=".xlsx") returned 5
	[0083.746] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1
	[0083.746] lstrlenW (lpString=".ppt") returned 4
	[0083.746] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0083.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0083.746] lstrlenW (lpString=".zip") returned 4
	[0083.746] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0083.746] lstrlenW (lpString=".rar") returned 4
	[0083.746] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0083.746] lstrlenW (lpString=".bz2") returned 4
	[0083.746] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0083.746] lstrlenW (lpString=".7z") returned 3
	[0083.746] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0083.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0083.747] lstrlenW (lpString=".dbf") returned 4
	[0083.747] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0083.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0083.747] lstrlenW (lpString=".1cd") returned 4
	[0083.747] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0083.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0083.747] lstrlenW (lpString=".jpg") returned 4
	[0083.747] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0083.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0083.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0083.747] lstrlenW (lpString=".doc") returned 4
	[0083.747] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0083.747] lstrlenW (lpString=".docx") returned 5
	[0083.747] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1
	[0083.747] lstrlenW (lpString=".pdf") returned 4
	[0083.747] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0083.747] lstrlenW (lpString=".xls") returned 4
	[0083.747] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0083.747] lstrlenW (lpString=".xlsx") returned 5
	[0083.747] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1
	[0083.747] lstrlenW (lpString=".ppt") returned 4
	[0083.747] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0083.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0083.747] lstrlenW (lpString=".zip") returned 4
	[0083.748] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0083.748] lstrlenW (lpString=".rar") returned 4
	[0083.748] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0083.748] lstrlenW (lpString=".bz2") returned 4
	[0083.748] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0083.748] lstrlenW (lpString=".7z") returned 3
	[0083.748] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0083.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0083.748] lstrlenW (lpString=".dbf") returned 4
	[0083.748] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0083.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0083.748] lstrlenW (lpString=".1cd") returned 4
	[0083.748] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0083.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0083.748] lstrlenW (lpString=".jpg") returned 4
	[0083.748] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0083.748] lstrcmpiW (lpString1=".xrm-ms", lpString2=".adobe") returned 1
	[0083.748] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24
	[0083.748] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.851] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=715834) returned 1
	[0083.851] CloseHandle (hObject=0x1a8) returned 1
	[0083.851] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020
	[0083.856] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.858] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.897] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.897] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.897] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0083.902] GetLastError () returned 0x0
	[0083.902] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xaec3a, lpOverlapped=0x0) returned 1
	[0083.920] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xaec40, lpOverlapped=0x0) returned 1
	[0083.935] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0083.935] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x104, lpOverlapped=0x0) returned 1
	[0083.935] SetEndOfFile (hFile=0x1ac) returned 1
	[0083.937] CloseHandle (hObject=0x1ac) returned 1
	[0083.938] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.938] SetEndOfFile (hFile=0x1a8) returned 1
	[0083.980] CloseHandle (hObject=0x1a8) returned 1
	[0084.039] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0084.042] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1
	[0084.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0084.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0084.050] lstrlenW (lpString=".doc") returned 4
	[0084.050] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0084.050] lstrlenW (lpString=".docx") returned 5
	[0084.050] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0084.051] lstrlenW (lpString=".pdf") returned 4
	[0084.051] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0084.051] lstrlenW (lpString=".xls") returned 4
	[0084.051] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0084.051] lstrlenW (lpString=".xlsx") returned 5
	[0084.051] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0084.051] lstrlenW (lpString=".ppt") returned 4
	[0084.051] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0084.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0084.051] lstrlenW (lpString=".zip") returned 4
	[0084.051] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0084.051] lstrlenW (lpString=".rar") returned 4
	[0084.051] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0084.051] lstrlenW (lpString=".bz2") returned 4
	[0084.051] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0084.051] lstrlenW (lpString=".7z") returned 3
	[0084.051] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0084.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0084.051] lstrlenW (lpString=".dbf") returned 4
	[0084.051] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0084.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0084.051] lstrlenW (lpString=".1cd") returned 4
	[0084.051] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0084.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0084.051] lstrlenW (lpString=".jpg") returned 4
	[0084.051] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0084.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0084.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0084.052] lstrlenW (lpString=".doc") returned 4
	[0084.052] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0084.052] lstrlenW (lpString=".docx") returned 5
	[0084.052] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0084.052] lstrlenW (lpString=".pdf") returned 4
	[0084.052] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0084.052] lstrlenW (lpString=".xls") returned 4
	[0084.052] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0084.052] lstrlenW (lpString=".xlsx") returned 5
	[0084.052] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0084.052] lstrlenW (lpString=".ppt") returned 4
	[0084.052] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0084.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0084.052] lstrlenW (lpString=".zip") returned 4
	[0084.052] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0084.052] lstrlenW (lpString=".rar") returned 4
	[0084.052] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0084.052] lstrlenW (lpString=".bz2") returned 4
	[0084.052] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0084.052] lstrlenW (lpString=".7z") returned 3
	[0084.052] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0084.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0084.053] lstrlenW (lpString=".dbf") returned 4
	[0084.053] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0084.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0084.053] lstrlenW (lpString=".1cd") returned 4
	[0084.053] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0084.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0084.053] lstrlenW (lpString=".jpg") returned 4
	[0084.053] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0084.053] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0084.053] lstrlenW (lpString="PrjPrrWW.cab") returned 12
	[0084.053] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0084.072] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=162970271) returned 1
	[0084.072] CloseHandle (hObject=0x1a4) returned 1
	[0084.072] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020
	[0084.183] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.184] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0084.337] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0084.375] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0084.375] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.375] ReadFile (in: hFile=0x160, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.384] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.384] ReadFile (in: hFile=0x160, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.394] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0084.394] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.394] ReadFile (in: hFile=0x160, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.467] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.467] WriteFile (in: hFile=0x160, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0084.493] SetEndOfFile (hFile=0x160) returned 1
	[0084.493] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0084.522] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0084.522] WriteFile (in: hFile=0x160, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0084.523] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0084.524] WriteFile (in: hFile=0x160, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0084.528] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0084.528] WriteFile (in: hFile=0x160, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0084.530] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0084.534] CloseHandle (hObject=0x160) returned 1
	[0084.534] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0084.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0084.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0084.534] lstrlenW (lpString=".doc") returned 4
	[0084.534] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0084.535] lstrlenW (lpString=".docx") returned 5
	[0084.535] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0084.535] lstrlenW (lpString=".pdf") returned 4
	[0084.535] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0084.535] lstrlenW (lpString=".xls") returned 4
	[0084.535] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0084.535] lstrlenW (lpString=".xlsx") returned 5
	[0084.535] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0084.535] lstrlenW (lpString=".ppt") returned 4
	[0084.535] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0084.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0084.535] lstrlenW (lpString=".zip") returned 4
	[0084.535] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0084.535] lstrlenW (lpString=".rar") returned 4
	[0084.535] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0084.535] lstrlenW (lpString=".bz2") returned 4
	[0084.535] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0084.535] lstrlenW (lpString=".7z") returned 3
	[0084.535] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0084.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0084.536] lstrlenW (lpString=".dbf") returned 4
	[0084.536] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0084.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0084.536] lstrlenW (lpString=".1cd") returned 4
	[0084.536] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0084.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0084.536] lstrlenW (lpString=".jpg") returned 4
	[0084.536] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0084.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0084.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0084.536] lstrlenW (lpString=".doc") returned 4
	[0084.536] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0084.536] lstrlenW (lpString=".docx") returned 5
	[0084.536] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0084.536] lstrlenW (lpString=".pdf") returned 4
	[0084.536] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0084.536] lstrlenW (lpString=".xls") returned 4
	[0084.536] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0084.537] lstrlenW (lpString=".xlsx") returned 5
	[0084.537] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0084.537] lstrlenW (lpString=".ppt") returned 4
	[0084.537] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0084.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0084.537] lstrlenW (lpString=".zip") returned 4
	[0084.537] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0084.537] lstrlenW (lpString=".rar") returned 4
	[0084.537] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0084.537] lstrlenW (lpString=".bz2") returned 4
	[0084.537] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0084.537] lstrlenW (lpString=".7z") returned 3
	[0084.537] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0084.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0084.537] lstrlenW (lpString=".dbf") returned 4
	[0084.537] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0084.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0084.537] lstrlenW (lpString=".1cd") returned 4
	[0084.537] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0084.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0084.538] lstrlenW (lpString=".jpg") returned 4
	[0084.538] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0084.538] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0084.538] lstrlenW (lpString="OWOW32WW.cab") returned 12
	[0084.538] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.611] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=36233052) returned 1
	[0084.612] CloseHandle (hObject=0x1b0) returned 1
	[0084.612] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020
	[0084.794] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.829] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0085.310] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.502] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0085.502] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0085.502] ReadFile (in: hFile=0x198, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0085.506] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0085.506] ReadFile (in: hFile=0x198, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0085.510] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0085.510] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0085.510] ReadFile (in: hFile=0x198, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0085.533] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.533] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0085.571] SetEndOfFile (hFile=0x198) returned 1
	[0085.588] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0085.593] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0085.593] WriteFile (in: hFile=0x198, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0085.594] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0085.594] WriteFile (in: hFile=0x198, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0085.595] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0085.595] WriteFile (in: hFile=0x198, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0085.598] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0085.598] CloseHandle (hObject=0x198) returned 1
	[0085.600] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0085.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0085.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0085.602] lstrlenW (lpString=".doc") returned 4
	[0085.602] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0085.602] lstrlenW (lpString=".docx") returned 5
	[0085.602] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0085.602] lstrlenW (lpString=".pdf") returned 4
	[0085.602] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0085.602] lstrlenW (lpString=".xls") returned 4
	[0085.602] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0085.602] lstrlenW (lpString=".xlsx") returned 5
	[0085.602] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0085.602] lstrlenW (lpString=".ppt") returned 4
	[0085.602] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0085.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0085.603] lstrlenW (lpString=".zip") returned 4
	[0085.603] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0085.603] lstrlenW (lpString=".rar") returned 4
	[0085.603] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0085.603] lstrlenW (lpString=".bz2") returned 4
	[0085.603] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0085.603] lstrlenW (lpString=".7z") returned 3
	[0085.603] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0085.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0085.603] lstrlenW (lpString=".dbf") returned 4
	[0085.603] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0085.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0085.603] lstrlenW (lpString=".1cd") returned 4
	[0085.603] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0085.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0085.603] lstrlenW (lpString=".jpg") returned 4
	[0085.603] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0085.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0085.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0085.603] lstrlenW (lpString=".doc") returned 4
	[0085.603] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0085.603] lstrlenW (lpString=".docx") returned 5
	[0085.603] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0085.603] lstrlenW (lpString=".pdf") returned 4
	[0085.604] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0085.604] lstrlenW (lpString=".xls") returned 4
	[0085.604] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0085.604] lstrlenW (lpString=".xlsx") returned 5
	[0085.604] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0085.604] lstrlenW (lpString=".ppt") returned 4
	[0085.604] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0085.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0085.604] lstrlenW (lpString=".zip") returned 4
	[0085.604] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0085.604] lstrlenW (lpString=".rar") returned 4
	[0085.604] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0085.604] lstrlenW (lpString=".bz2") returned 4
	[0085.604] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0085.604] lstrlenW (lpString=".7z") returned 3
	[0085.604] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0085.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0085.604] lstrlenW (lpString=".dbf") returned 4
	[0085.604] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0085.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0085.604] lstrlenW (lpString=".1cd") returned 4
	[0085.604] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0085.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0085.604] lstrlenW (lpString=".jpg") returned 4
	[0085.604] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0085.605] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0085.605] lstrlenW (lpString="VisiorWW.msi") returned 12
	[0085.605] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0085.884] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=12060672) returned 1
	[0085.884] CloseHandle (hObject=0x184) returned 1
	[0085.884] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020
	[0086.017] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.028] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0086.072] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.073] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0086.073] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0086.073] ReadFile (in: hFile=0x174, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0086.079] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0086.080] ReadFile (in: hFile=0x174, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0086.124] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0086.124] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0086.124] ReadFile (in: hFile=0x174, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0086.145] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.145] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0086.202] SetEndOfFile (hFile=0x174) returned 1
	[0086.202] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0086.202] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.202] WriteFile (in: hFile=0x174, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.204] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.204] WriteFile (in: hFile=0x174, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.211] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.211] WriteFile (in: hFile=0x174, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.214] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0086.214] CloseHandle (hObject=0x174) returned 1
	[0086.214] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0086.214] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0086.214] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0086.215] lstrlenW (lpString=".doc") returned 4
	[0086.215] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0086.215] lstrlenW (lpString=".docx") returned 5
	[0086.215] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0086.215] lstrlenW (lpString=".pdf") returned 4
	[0086.215] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0086.215] lstrlenW (lpString=".xls") returned 4
	[0086.215] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0086.215] lstrlenW (lpString=".xlsx") returned 5
	[0086.215] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0086.215] lstrlenW (lpString=".ppt") returned 4
	[0086.215] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0086.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0086.215] lstrlenW (lpString=".zip") returned 4
	[0086.215] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0086.215] lstrlenW (lpString=".rar") returned 4
	[0086.215] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0086.215] lstrlenW (lpString=".bz2") returned 4
	[0086.215] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0086.215] lstrlenW (lpString=".7z") returned 3
	[0086.215] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0086.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0086.215] lstrlenW (lpString=".dbf") returned 4
	[0086.215] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0086.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0086.215] lstrlenW (lpString=".1cd") returned 4
	[0086.215] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0086.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0086.216] lstrlenW (lpString=".jpg") returned 4
	[0086.216] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0086.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0086.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0086.216] lstrlenW (lpString=".doc") returned 4
	[0086.216] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0086.216] lstrlenW (lpString=".docx") returned 5
	[0086.216] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0086.216] lstrlenW (lpString=".pdf") returned 4
	[0086.216] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0086.216] lstrlenW (lpString=".xls") returned 4
	[0086.216] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0086.216] lstrlenW (lpString=".xlsx") returned 5
	[0086.216] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0086.216] lstrlenW (lpString=".ppt") returned 4
	[0086.216] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0086.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0086.216] lstrlenW (lpString=".zip") returned 4
	[0086.216] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0086.216] lstrlenW (lpString=".rar") returned 4
	[0086.216] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0086.216] lstrlenW (lpString=".bz2") returned 4
	[0086.216] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0086.216] lstrlenW (lpString=".7z") returned 3
	[0086.217] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0086.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0086.217] lstrlenW (lpString=".dbf") returned 4
	[0086.217] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0086.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0086.217] lstrlenW (lpString=".1cd") returned 4
	[0086.217] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0086.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0086.217] lstrlenW (lpString=".jpg") returned 4
	[0086.217] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0086.217] lstrcmpiW (lpString1=".TTF", lpString2=".adobe") returned 1
	[0086.217] lstrlenW (lpString="MTEXTRA.TTF") returned 11
	[0086.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0086.271] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=7656) returned 1
	[0086.272] CloseHandle (hObject=0x1a4) returned 1
	[0086.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20
	[0086.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.504] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.504] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0086.748] GetLastError () returned 0x0
	[0086.748] ReadFile (in: hFile=0x174, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x1de8, lpOverlapped=0x0) returned 1
	[0086.750] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x1df0, lpOverlapped=0x0) returned 1
	[0086.751] ReadFile (in: hFile=0x174, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.751] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0086.751] SetEndOfFile (hFile=0x1ac) returned 1
	[0086.752] CloseHandle (hObject=0x1ac) returned 1
	[0086.752] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.752] SetEndOfFile (hFile=0x174) returned 1
	[0086.753] CloseHandle (hObject=0x174) returned 1
	[0086.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.753] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1
	[0086.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0086.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0086.754] lstrlenW (lpString=".doc") returned 4
	[0086.754] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1
	[0086.754] lstrlenW (lpString=".docx") returned 5
	[0086.754] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1
	[0086.754] lstrlenW (lpString=".pdf") returned 4
	[0086.754] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1
	[0086.754] lstrlenW (lpString=".xls") returned 4
	[0086.754] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1
	[0086.754] lstrlenW (lpString=".xlsx") returned 5
	[0086.754] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1
	[0086.754] lstrlenW (lpString=".ppt") returned 4
	[0086.754] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1
	[0086.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0086.754] lstrlenW (lpString=".zip") returned 4
	[0086.754] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1
	[0086.754] lstrlenW (lpString=".rar") returned 4
	[0086.754] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1
	[0086.754] lstrlenW (lpString=".bz2") returned 4
	[0086.754] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1
	[0086.754] lstrlenW (lpString=".7z") returned 3
	[0086.754] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1
	[0086.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0086.754] lstrlenW (lpString=".dbf") returned 4
	[0086.754] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1
	[0086.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0086.755] lstrlenW (lpString=".1cd") returned 4
	[0086.755] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1
	[0086.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0086.755] lstrlenW (lpString=".jpg") returned 4
	[0086.755] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1
	[0086.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0086.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0086.755] lstrlenW (lpString=".doc") returned 4
	[0086.755] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1
	[0086.755] lstrlenW (lpString=".docx") returned 5
	[0086.755] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1
	[0086.755] lstrlenW (lpString=".pdf") returned 4
	[0086.755] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1
	[0086.755] lstrlenW (lpString=".xls") returned 4
	[0086.755] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1
	[0086.755] lstrlenW (lpString=".xlsx") returned 5
	[0086.755] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1
	[0086.755] lstrlenW (lpString=".ppt") returned 4
	[0086.755] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1
	[0086.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0086.755] lstrlenW (lpString=".zip") returned 4
	[0086.755] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1
	[0086.755] lstrlenW (lpString=".rar") returned 4
	[0086.755] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1
	[0086.756] lstrlenW (lpString=".bz2") returned 4
	[0086.756] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1
	[0086.756] lstrlenW (lpString=".7z") returned 3
	[0086.756] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1
	[0086.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0086.756] lstrlenW (lpString=".dbf") returned 4
	[0086.756] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1
	[0086.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0086.756] lstrlenW (lpString=".1cd") returned 4
	[0086.756] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1
	[0086.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0086.756] lstrlenW (lpString=".jpg") returned 4
	[0086.756] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1
	[0086.756] lstrcmpiW (lpString1=".FLT", lpString2=".adobe") returned 1
	[0086.756] lstrlenW (lpString="GIFIMP32.FLT") returned 12
	[0086.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.789] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=320384) returned 1
	[0086.789] CloseHandle (hObject=0x174) returned 1
	[0086.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20
	[0087.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0087.121] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.121] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.184] GetLastError () returned 0x0
	[0087.184] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x4e380, lpOverlapped=0x0) returned 1
	[0087.199] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x4e390, lpOverlapped=0x0) returned 1
	[0087.208] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.208] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0087.208] SetEndOfFile (hFile=0x174) returned 1
	[0087.220] CloseHandle (hObject=0x174) returned 1
	[0087.222] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.222] SetEndOfFile (hFile=0x19c) returned 1
	[0087.235] CloseHandle (hObject=0x19c) returned 1
	[0087.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0087.246] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1
	[0087.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67
	[0087.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67
	[0087.255] lstrlenW (lpString=".doc") returned 4
	[0087.255] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0087.255] lstrlenW (lpString=".docx") returned 5
	[0087.255] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0087.255] lstrlenW (lpString=".pdf") returned 4
	[0087.255] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0087.255] lstrlenW (lpString=".xls") returned 4
	[0087.255] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0087.255] lstrlenW (lpString=".xlsx") returned 5
	[0087.255] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0087.255] lstrlenW (lpString=".ppt") returned 4
	[0087.255] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0087.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67
	[0087.256] lstrlenW (lpString=".zip") returned 4
	[0087.256] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0087.256] lstrlenW (lpString=".rar") returned 4
	[0087.256] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0087.256] lstrlenW (lpString=".bz2") returned 4
	[0087.256] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0087.256] lstrlenW (lpString=".7z") returned 3
	[0087.256] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0087.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67
	[0087.256] lstrlenW (lpString=".dbf") returned 4
	[0087.256] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0087.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67
	[0087.256] lstrlenW (lpString=".1cd") returned 4
	[0087.256] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0087.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67
	[0087.256] lstrlenW (lpString=".jpg") returned 4
	[0087.256] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0087.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67
	[0087.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67
	[0087.256] lstrlenW (lpString=".doc") returned 4
	[0087.256] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0087.256] lstrlenW (lpString=".docx") returned 5
	[0087.257] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0087.257] lstrlenW (lpString=".pdf") returned 4
	[0087.257] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0087.257] lstrlenW (lpString=".xls") returned 4
	[0087.257] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0087.257] lstrlenW (lpString=".xlsx") returned 5
	[0087.257] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0087.257] lstrlenW (lpString=".ppt") returned 4
	[0087.257] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0087.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67
	[0087.257] lstrlenW (lpString=".zip") returned 4
	[0087.257] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0087.257] lstrlenW (lpString=".rar") returned 4
	[0087.257] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0087.257] lstrlenW (lpString=".bz2") returned 4
	[0087.257] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0087.257] lstrlenW (lpString=".7z") returned 3
	[0087.257] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0087.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67
	[0087.257] lstrlenW (lpString=".dbf") returned 4
	[0087.257] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0087.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67
	[0087.257] lstrlenW (lpString=".1cd") returned 4
	[0087.257] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0087.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67
	[0087.257] lstrlenW (lpString=".jpg") returned 4
	[0087.257] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0087.258] lstrcmpiW (lpString1=".FLT", lpString2=".adobe") returned 1
	[0087.258] lstrlenW (lpString="PICTIM32.FLT") returned 12
	[0087.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.282] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=73080) returned 1
	[0087.282] CloseHandle (hObject=0x174) returned 1
	[0087.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20
	[0087.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.358] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.358] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.398] GetLastError () returned 0x0
	[0087.398] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x11d78, lpOverlapped=0x0) returned 1
	[0087.402] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x11d80, lpOverlapped=0x0) returned 1
	[0087.404] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.405] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0087.405] SetEndOfFile (hFile=0x174) returned 1
	[0087.413] CloseHandle (hObject=0x174) returned 1
	[0087.419] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.419] SetEndOfFile (hFile=0x1ac) returned 1
	[0087.521] CloseHandle (hObject=0x1ac) returned 1
	[0087.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0087.585] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1
	[0087.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0087.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0087.654] lstrlenW (lpString=".doc") returned 4
	[0087.654] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0087.654] lstrlenW (lpString=".docx") returned 5
	[0087.654] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0087.654] lstrlenW (lpString=".pdf") returned 4
	[0087.654] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0087.654] lstrlenW (lpString=".xls") returned 4
	[0087.654] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0087.654] lstrlenW (lpString=".xlsx") returned 5
	[0087.654] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0087.654] lstrlenW (lpString=".ppt") returned 4
	[0087.654] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0087.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0087.654] lstrlenW (lpString=".zip") returned 4
	[0087.655] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0087.655] lstrlenW (lpString=".rar") returned 4
	[0087.655] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0087.655] lstrlenW (lpString=".bz2") returned 4
	[0087.655] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0087.655] lstrlenW (lpString=".7z") returned 3
	[0087.655] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0087.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0087.655] lstrlenW (lpString=".dbf") returned 4
	[0087.655] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0087.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0087.655] lstrlenW (lpString=".1cd") returned 4
	[0087.655] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0087.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0087.655] lstrlenW (lpString=".jpg") returned 4
	[0087.655] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0087.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0087.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0087.655] lstrlenW (lpString=".doc") returned 4
	[0087.655] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0087.655] lstrlenW (lpString=".docx") returned 5
	[0087.655] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0087.655] lstrlenW (lpString=".pdf") returned 4
	[0087.655] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0087.656] lstrlenW (lpString=".xls") returned 4
	[0087.656] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0087.656] lstrlenW (lpString=".xlsx") returned 5
	[0087.656] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0087.656] lstrlenW (lpString=".ppt") returned 4
	[0087.656] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0087.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0087.656] lstrlenW (lpString=".zip") returned 4
	[0087.656] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0087.656] lstrlenW (lpString=".rar") returned 4
	[0087.656] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0087.656] lstrlenW (lpString=".bz2") returned 4
	[0087.656] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0087.656] lstrlenW (lpString=".7z") returned 3
	[0087.656] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0087.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0087.656] lstrlenW (lpString=".dbf") returned 4
	[0087.656] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0087.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0087.656] lstrlenW (lpString=".1cd") returned 4
	[0087.656] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0087.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0087.656] lstrlenW (lpString=".jpg") returned 4
	[0087.656] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0087.657] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0087.657] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0087.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.680] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=4096) returned 1
	[0087.680] CloseHandle (hObject=0x1ac) returned 1
	[0087.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20
	[0087.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0087.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0087.681] lstrlenW (lpString=".doc") returned 4
	[0087.682] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.682] lstrlenW (lpString=".docx") returned 5
	[0087.682] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.682] lstrlenW (lpString=".pdf") returned 4
	[0087.682] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.682] lstrlenW (lpString=".xls") returned 4
	[0087.682] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.682] lstrlenW (lpString=".xlsx") returned 5
	[0087.682] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.682] lstrlenW (lpString=".ppt") returned 4
	[0087.682] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0087.682] lstrlenW (lpString=".zip") returned 4
	[0087.682] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.682] lstrlenW (lpString=".rar") returned 4
	[0087.682] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.682] lstrlenW (lpString=".bz2") returned 4
	[0087.682] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.682] lstrlenW (lpString=".7z") returned 3
	[0087.682] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0087.682] lstrlenW (lpString=".dbf") returned 4
	[0087.682] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0087.682] lstrlenW (lpString=".1cd") returned 4
	[0087.683] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0087.683] lstrlenW (lpString=".jpg") returned 4
	[0087.683] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0087.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0087.683] lstrlenW (lpString=".doc") returned 4
	[0087.683] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.683] lstrlenW (lpString=".docx") returned 5
	[0087.683] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.683] lstrlenW (lpString=".pdf") returned 4
	[0087.683] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.683] lstrlenW (lpString=".xls") returned 4
	[0087.683] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.683] lstrlenW (lpString=".xlsx") returned 5
	[0087.683] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.683] lstrlenW (lpString=".ppt") returned 4
	[0087.683] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0087.683] lstrlenW (lpString=".zip") returned 4
	[0087.683] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.683] lstrlenW (lpString=".rar") returned 4
	[0087.683] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.684] lstrlenW (lpString=".bz2") returned 4
	[0087.684] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.684] lstrlenW (lpString=".7z") returned 3
	[0087.684] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0087.684] lstrlenW (lpString=".dbf") returned 4
	[0087.684] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0087.684] lstrlenW (lpString=".1cd") returned 4
	[0087.684] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0087.684] lstrlenW (lpString=".jpg") returned 4
	[0087.684] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.684] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0087.684] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0087.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.693] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=4096) returned 1
	[0087.693] CloseHandle (hObject=0x1ac) returned 1
	[0087.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20
	[0087.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0087.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0087.694] lstrlenW (lpString=".doc") returned 4
	[0087.694] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.694] lstrlenW (lpString=".docx") returned 5
	[0087.694] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.694] lstrlenW (lpString=".pdf") returned 4
	[0087.694] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.694] lstrlenW (lpString=".xls") returned 4
	[0087.694] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.694] lstrlenW (lpString=".xlsx") returned 5
	[0087.694] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.694] lstrlenW (lpString=".ppt") returned 4
	[0087.694] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0087.694] lstrlenW (lpString=".zip") returned 4
	[0087.694] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.694] lstrlenW (lpString=".rar") returned 4
	[0087.694] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.694] lstrlenW (lpString=".bz2") returned 4
	[0087.694] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.694] lstrlenW (lpString=".7z") returned 3
	[0087.694] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0087.695] lstrlenW (lpString=".dbf") returned 4
	[0087.695] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0087.695] lstrlenW (lpString=".1cd") returned 4
	[0087.695] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0087.695] lstrlenW (lpString=".jpg") returned 4
	[0087.695] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0087.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0087.695] lstrlenW (lpString=".doc") returned 4
	[0087.695] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.695] lstrlenW (lpString=".docx") returned 5
	[0087.695] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.695] lstrlenW (lpString=".pdf") returned 4
	[0087.695] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.695] lstrlenW (lpString=".xls") returned 4
	[0087.695] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.695] lstrlenW (lpString=".xlsx") returned 5
	[0087.695] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.695] lstrlenW (lpString=".ppt") returned 4
	[0087.695] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0087.696] lstrlenW (lpString=".zip") returned 4
	[0087.696] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.696] lstrlenW (lpString=".rar") returned 4
	[0087.696] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.696] lstrlenW (lpString=".bz2") returned 4
	[0087.696] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.696] lstrlenW (lpString=".7z") returned 3
	[0087.696] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0087.696] lstrlenW (lpString=".dbf") returned 4
	[0087.696] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0087.696] lstrlenW (lpString=".1cd") returned 4
	[0087.696] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0087.696] lstrlenW (lpString=".jpg") returned 4
	[0087.696] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.696] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0087.696] lstrlenW (lpString="InkObj.dll.mui") returned 14
	[0087.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0087.704] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=4608) returned 1
	[0087.704] CloseHandle (hObject=0x19c) returned 1
	[0087.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20
	[0087.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0087.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0087.757] lstrlenW (lpString=".doc") returned 4
	[0087.757] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.757] lstrlenW (lpString=".docx") returned 5
	[0087.757] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.757] lstrlenW (lpString=".pdf") returned 4
	[0087.757] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.757] lstrlenW (lpString=".xls") returned 4
	[0087.757] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.757] lstrlenW (lpString=".xlsx") returned 5
	[0087.757] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.757] lstrlenW (lpString=".ppt") returned 4
	[0087.757] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0087.757] lstrlenW (lpString=".zip") returned 4
	[0087.757] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.758] lstrlenW (lpString=".rar") returned 4
	[0087.758] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.758] lstrlenW (lpString=".bz2") returned 4
	[0087.758] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.758] lstrlenW (lpString=".7z") returned 3
	[0087.758] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0087.758] lstrlenW (lpString=".dbf") returned 4
	[0087.758] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0087.758] lstrlenW (lpString=".1cd") returned 4
	[0087.758] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0087.758] lstrlenW (lpString=".jpg") returned 4
	[0087.758] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0087.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0087.758] lstrlenW (lpString=".doc") returned 4
	[0087.758] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.758] lstrlenW (lpString=".docx") returned 5
	[0087.758] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.758] lstrlenW (lpString=".pdf") returned 4
	[0087.758] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.758] lstrlenW (lpString=".xls") returned 4
	[0087.758] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.758] lstrlenW (lpString=".xlsx") returned 5
	[0087.759] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.759] lstrlenW (lpString=".ppt") returned 4
	[0087.759] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0087.759] lstrlenW (lpString=".zip") returned 4
	[0087.759] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.759] lstrlenW (lpString=".rar") returned 4
	[0087.759] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.759] lstrlenW (lpString=".bz2") returned 4
	[0087.759] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.759] lstrlenW (lpString=".7z") returned 3
	[0087.759] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0087.759] lstrlenW (lpString=".dbf") returned 4
	[0087.759] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0087.759] lstrlenW (lpString=".1cd") returned 4
	[0087.759] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0087.759] lstrlenW (lpString=".jpg") returned 4
	[0087.759] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.759] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0087.760] lstrlenW (lpString="InkWatson.exe.mui") returned 17
	[0087.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0087.812] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=9216) returned 1
	[0087.813] CloseHandle (hObject=0x160) returned 1
	[0087.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20
	[0087.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74
	[0087.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74
	[0087.873] lstrlenW (lpString=".doc") returned 4
	[0087.873] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.873] lstrlenW (lpString=".docx") returned 5
	[0087.873] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0087.873] lstrlenW (lpString=".pdf") returned 4
	[0087.873] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.873] lstrlenW (lpString=".xls") returned 4
	[0087.873] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.873] lstrlenW (lpString=".xlsx") returned 5
	[0087.874] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0087.874] lstrlenW (lpString=".ppt") returned 4
	[0087.874] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74
	[0087.874] lstrlenW (lpString=".zip") returned 4
	[0087.874] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.874] lstrlenW (lpString=".rar") returned 4
	[0087.874] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.874] lstrlenW (lpString=".bz2") returned 4
	[0087.874] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.874] lstrlenW (lpString=".7z") returned 3
	[0087.874] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74
	[0087.874] lstrlenW (lpString=".dbf") returned 4
	[0087.874] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74
	[0087.874] lstrlenW (lpString=".1cd") returned 4
	[0087.874] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74
	[0087.874] lstrlenW (lpString=".jpg") returned 4
	[0087.874] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74
	[0087.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74
	[0087.874] lstrlenW (lpString=".doc") returned 4
	[0087.874] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.874] lstrlenW (lpString=".docx") returned 5
	[0087.875] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0087.875] lstrlenW (lpString=".pdf") returned 4
	[0087.875] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.875] lstrlenW (lpString=".xls") returned 4
	[0087.875] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.875] lstrlenW (lpString=".xlsx") returned 5
	[0087.875] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0087.875] lstrlenW (lpString=".ppt") returned 4
	[0087.875] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74
	[0087.875] lstrlenW (lpString=".zip") returned 4
	[0087.875] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.875] lstrlenW (lpString=".rar") returned 4
	[0087.875] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.875] lstrlenW (lpString=".bz2") returned 4
	[0087.875] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.875] lstrlenW (lpString=".7z") returned 3
	[0087.875] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74
	[0087.875] lstrlenW (lpString=".dbf") returned 4
	[0087.875] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74
	[0087.875] lstrlenW (lpString=".1cd") returned 4
	[0087.875] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74
	[0087.875] lstrlenW (lpString=".jpg") returned 4
	[0087.875] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.876] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0087.876] lstrlenW (lpString="micaut.dll.mui") returned 14
	[0087.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0087.897] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=8704) returned 1
	[0087.897] CloseHandle (hObject=0x178) returned 1
	[0087.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20
	[0087.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0087.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0087.991] lstrlenW (lpString=".doc") returned 4
	[0087.991] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.991] lstrlenW (lpString=".docx") returned 5
	[0087.991] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.991] lstrlenW (lpString=".pdf") returned 4
	[0087.992] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.992] lstrlenW (lpString=".xls") returned 4
	[0087.992] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.992] lstrlenW (lpString=".xlsx") returned 5
	[0087.992] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.992] lstrlenW (lpString=".ppt") returned 4
	[0087.992] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0087.992] lstrlenW (lpString=".zip") returned 4
	[0087.992] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.992] lstrlenW (lpString=".rar") returned 4
	[0087.992] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.992] lstrlenW (lpString=".bz2") returned 4
	[0087.992] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.992] lstrlenW (lpString=".7z") returned 3
	[0087.992] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0087.992] lstrlenW (lpString=".dbf") returned 4
	[0087.992] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0087.992] lstrlenW (lpString=".1cd") returned 4
	[0087.992] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0087.992] lstrlenW (lpString=".jpg") returned 4
	[0087.992] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0087.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0087.993] lstrlenW (lpString=".doc") returned 4
	[0087.993] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.993] lstrlenW (lpString=".docx") returned 5
	[0087.993] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.993] lstrlenW (lpString=".pdf") returned 4
	[0087.993] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.993] lstrlenW (lpString=".xls") returned 4
	[0087.993] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.993] lstrlenW (lpString=".xlsx") returned 5
	[0087.993] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.993] lstrlenW (lpString=".ppt") returned 4
	[0087.993] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0087.993] lstrlenW (lpString=".zip") returned 4
	[0087.993] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.993] lstrlenW (lpString=".rar") returned 4
	[0087.993] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.993] lstrlenW (lpString=".bz2") returned 4
	[0087.993] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.993] lstrlenW (lpString=".7z") returned 3
	[0087.993] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0087.993] lstrlenW (lpString=".dbf") returned 4
	[0087.993] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0087.993] lstrlenW (lpString=".1cd") returned 4
	[0087.994] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0087.994] lstrlenW (lpString=".jpg") returned 4
	[0087.994] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.994] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0087.994] lstrlenW (lpString="ShapeCollector.exe.mui") returned 22
	[0087.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.081] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=43520) returned 1
	[0088.081] CloseHandle (hObject=0x188) returned 1
	[0088.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20
	[0088.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79
	[0088.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79
	[0088.181] lstrlenW (lpString=".doc") returned 4
	[0088.182] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.182] lstrlenW (lpString=".docx") returned 5
	[0088.182] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0088.182] lstrlenW (lpString=".pdf") returned 4
	[0088.182] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.182] lstrlenW (lpString=".xls") returned 4
	[0088.182] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.182] lstrlenW (lpString=".xlsx") returned 5
	[0088.182] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0088.182] lstrlenW (lpString=".ppt") returned 4
	[0088.182] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79
	[0088.182] lstrlenW (lpString=".zip") returned 4
	[0088.182] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.182] lstrlenW (lpString=".rar") returned 4
	[0088.182] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.182] lstrlenW (lpString=".bz2") returned 4
	[0088.182] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.182] lstrlenW (lpString=".7z") returned 3
	[0088.182] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79
	[0088.182] lstrlenW (lpString=".dbf") returned 4
	[0088.182] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0089.435] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0089.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0089.437] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0089.437] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0089.437] ReadFile (in: hFile=0x1bc, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0089.442] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0089.442] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0089.463] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0089.463] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0089.463] ReadFile (in: hFile=0x1bc, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0089.490] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.491] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0089.504] SetEndOfFile (hFile=0x1bc) returned 1
	[0089.505] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x4001020
	[0089.505] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0089.505] WriteFile (in: hFile=0x1bc, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0089.506] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0089.506] WriteFile (in: hFile=0x1bc, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0089.510] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0089.510] WriteFile (in: hFile=0x1bc, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0089.516] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x4001020 | out: hHeap=0x5e0000) returned 1
	[0089.516] CloseHandle (hObject=0x1bc) returned 1
	[0089.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67
	[0089.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67
	[0089.517] lstrlenW (lpString=".doc") returned 4
	[0089.517] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.517] lstrlenW (lpString=".docx") returned 5
	[0089.517] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1
	[0089.517] lstrlenW (lpString=".pdf") returned 4
	[0089.517] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.517] lstrlenW (lpString=".xls") returned 4
	[0089.517] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.517] lstrlenW (lpString=".xlsx") returned 5
	[0089.517] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1
	[0089.517] lstrlenW (lpString=".ppt") returned 4
	[0089.517] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67
	[0089.517] lstrlenW (lpString=".zip") returned 4
	[0089.517] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.517] lstrlenW (lpString=".rar") returned 4
	[0089.517] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.517] lstrlenW (lpString=".bz2") returned 4
	[0089.517] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.517] lstrlenW (lpString=".7z") returned 3
	[0089.517] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67
	[0089.517] lstrlenW (lpString=".dbf") returned 4
	[0089.517] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67
	[0089.517] lstrlenW (lpString=".1cd") returned 4
	[0089.517] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67
	[0089.517] lstrlenW (lpString=".jpg") returned 4
	[0089.517] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67
	[0089.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67
	[0089.518] lstrlenW (lpString=".doc") returned 4
	[0089.518] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.518] lstrlenW (lpString=".docx") returned 5
	[0089.518] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1
	[0089.518] lstrlenW (lpString=".pdf") returned 4
	[0089.518] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.528] lstrlenW (lpString=".xls") returned 4
	[0089.528] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.528] lstrlenW (lpString=".xlsx") returned 5
	[0089.528] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1
	[0089.528] lstrlenW (lpString=".ppt") returned 4
	[0089.528] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67
	[0089.528] lstrlenW (lpString=".zip") returned 4
	[0089.528] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.528] lstrlenW (lpString=".rar") returned 4
	[0089.528] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.528] lstrlenW (lpString=".bz2") returned 4
	[0089.528] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.528] lstrlenW (lpString=".7z") returned 3
	[0089.529] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67
	[0089.529] lstrlenW (lpString=".dbf") returned 4
	[0089.529] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67
	[0089.529] lstrlenW (lpString=".1cd") returned 4
	[0089.529] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67
	[0089.529] lstrlenW (lpString=".jpg") returned 4
	[0089.529] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.529] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.529] lstrlenW (lpString="ACEDAO.DLL") returned 10
	[0089.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.529] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=744888) returned 1
	[0089.530] CloseHandle (hObject=0x1b0) returned 1
	[0089.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20
	[0089.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.530] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.530] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.531] GetLastError () returned 0x0
	[0089.531] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xb5db8, lpOverlapped=0x0) returned 1
	[0089.561] WriteFile (in: hFile=0x160, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xb5dc0, lpOverlapped=0x0) returned 1
	[0089.577] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.577] WriteFile (in: hFile=0x160, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0089.577] SetEndOfFile (hFile=0x160) returned 1
	[0089.577] CloseHandle (hObject=0x160) returned 1
	[0089.577] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.577] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.584] CloseHandle (hObject=0x1b0) returned 1
	[0089.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.585] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 1
	[0089.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66
	[0089.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66
	[0089.585] lstrlenW (lpString=".doc") returned 4
	[0089.585] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.585] lstrlenW (lpString=".docx") returned 5
	[0089.585] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1
	[0089.585] lstrlenW (lpString=".pdf") returned 4
	[0089.585] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.585] lstrlenW (lpString=".xls") returned 4
	[0089.585] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.585] lstrlenW (lpString=".xlsx") returned 5
	[0089.585] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1
	[0089.585] lstrlenW (lpString=".ppt") returned 4
	[0089.585] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66
	[0089.585] lstrlenW (lpString=".zip") returned 4
	[0089.585] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.585] lstrlenW (lpString=".rar") returned 4
	[0089.585] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.585] lstrlenW (lpString=".bz2") returned 4
	[0089.585] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.585] lstrlenW (lpString=".7z") returned 3
	[0089.586] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66
	[0089.586] lstrlenW (lpString=".dbf") returned 4
	[0089.586] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66
	[0089.586] lstrlenW (lpString=".1cd") returned 4
	[0089.586] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66
	[0089.586] lstrlenW (lpString=".jpg") returned 4
	[0089.586] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66
	[0089.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66
	[0089.586] lstrlenW (lpString=".doc") returned 4
	[0089.586] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.586] lstrlenW (lpString=".docx") returned 5
	[0089.586] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1
	[0089.586] lstrlenW (lpString=".pdf") returned 4
	[0089.586] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.586] lstrlenW (lpString=".xls") returned 4
	[0089.586] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.586] lstrlenW (lpString=".xlsx") returned 5
	[0089.586] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1
	[0089.586] lstrlenW (lpString=".ppt") returned 4
	[0089.586] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66
	[0089.586] lstrlenW (lpString=".zip") returned 4
	[0089.586] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.586] lstrlenW (lpString=".rar") returned 4
	[0089.586] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.586] lstrlenW (lpString=".bz2") returned 4
	[0089.586] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.586] lstrlenW (lpString=".7z") returned 3
	[0089.586] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66
	[0089.587] lstrlenW (lpString=".dbf") returned 4
	[0089.587] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66
	[0089.587] lstrlenW (lpString=".1cd") returned 4
	[0089.587] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66
	[0089.587] lstrlenW (lpString=".jpg") returned 4
	[0089.587] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.587] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.587] lstrlenW (lpString="ACEERR.DLL") returned 10
	[0089.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.590] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=43408) returned 1
	[0089.590] CloseHandle (hObject=0x1b0) returned 1
	[0089.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20
	[0089.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.591] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.591] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0089.591] GetLastError () returned 0x0
	[0089.591] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xa990, lpOverlapped=0x0) returned 1
	[0089.594] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xa9a0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xa9a0, lpOverlapped=0x0) returned 1
	[0089.596] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.596] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0089.596] SetEndOfFile (hFile=0x1b8) returned 1
	[0089.596] CloseHandle (hObject=0x1b8) returned 1
	[0089.596] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.596] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.597] CloseHandle (hObject=0x1b0) returned 1
	[0089.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.598] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 1
	[0089.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66
	[0089.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66
	[0089.598] lstrlenW (lpString=".doc") returned 4
	[0089.598] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.598] lstrlenW (lpString=".docx") returned 5
	[0089.598] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0089.598] lstrlenW (lpString=".pdf") returned 4
	[0089.598] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.598] lstrlenW (lpString=".xls") returned 4
	[0089.598] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.598] lstrlenW (lpString=".xlsx") returned 5
	[0089.598] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0089.598] lstrlenW (lpString=".ppt") returned 4
	[0089.598] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66
	[0089.599] lstrlenW (lpString=".zip") returned 4
	[0089.599] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.599] lstrlenW (lpString=".rar") returned 4
	[0089.599] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.599] lstrlenW (lpString=".bz2") returned 4
	[0089.599] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.599] lstrlenW (lpString=".7z") returned 3
	[0089.599] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66
	[0089.599] lstrlenW (lpString=".dbf") returned 4
	[0089.599] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66
	[0089.599] lstrlenW (lpString=".1cd") returned 4
	[0089.599] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66
	[0089.599] lstrlenW (lpString=".jpg") returned 4
	[0089.599] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66
	[0089.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66
	[0089.599] lstrlenW (lpString=".doc") returned 4
	[0089.599] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.599] lstrlenW (lpString=".docx") returned 5
	[0089.599] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0089.599] lstrlenW (lpString=".pdf") returned 4
	[0089.599] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.599] lstrlenW (lpString=".xls") returned 4
	[0089.599] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.599] lstrlenW (lpString=".xlsx") returned 5
	[0089.599] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0089.599] lstrlenW (lpString=".ppt") returned 4
	[0089.599] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66
	[0089.600] lstrlenW (lpString=".zip") returned 4
	[0089.600] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.600] lstrlenW (lpString=".rar") returned 4
	[0089.600] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.600] lstrlenW (lpString=".bz2") returned 4
	[0089.600] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.600] lstrlenW (lpString=".7z") returned 3
	[0089.600] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66
	[0089.600] lstrlenW (lpString=".dbf") returned 4
	[0089.600] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66
	[0089.600] lstrlenW (lpString=".1cd") returned 4
	[0089.600] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66
	[0089.600] lstrlenW (lpString=".jpg") returned 4
	[0089.600] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.600] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.600] lstrlenW (lpString="ACEES.DLL") returned 9
	[0089.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.603] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1012648) returned 1
	[0089.603] CloseHandle (hObject=0x160) returned 1
	[0089.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20
	[0089.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.604] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.604] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0089.604] GetLastError () returned 0x0
	[0089.604] ReadFile (in: hFile=0x160, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xf73a8, lpOverlapped=0x0) returned 1
	[0089.640] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf73b0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xf73b0, lpOverlapped=0x0) returned 1
	[0089.685] ReadFile (in: hFile=0x160, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.685] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0089.685] SetEndOfFile (hFile=0x198) returned 1
	[0089.685] CloseHandle (hObject=0x198) returned 1
	[0089.685] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.685] SetEndOfFile (hFile=0x160) returned 1
	[0089.694] CloseHandle (hObject=0x160) returned 1
	[0089.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.694] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 1
	[0089.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65
	[0089.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65
	[0089.695] lstrlenW (lpString=".doc") returned 4
	[0089.695] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.695] lstrlenW (lpString=".docx") returned 5
	[0089.695] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0089.695] lstrlenW (lpString=".pdf") returned 4
	[0089.695] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.695] lstrlenW (lpString=".xls") returned 4
	[0089.695] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.695] lstrlenW (lpString=".xlsx") returned 5
	[0089.695] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0089.695] lstrlenW (lpString=".ppt") returned 4
	[0089.695] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65
	[0089.695] lstrlenW (lpString=".zip") returned 4
	[0089.695] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.695] lstrlenW (lpString=".rar") returned 4
	[0089.695] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.695] lstrlenW (lpString=".bz2") returned 4
	[0089.695] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.695] lstrlenW (lpString=".7z") returned 3
	[0089.695] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65
	[0089.695] lstrlenW (lpString=".dbf") returned 4
	[0089.695] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65
	[0089.695] lstrlenW (lpString=".1cd") returned 4
	[0089.695] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65
	[0089.695] lstrlenW (lpString=".jpg") returned 4
	[0089.696] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65
	[0089.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65
	[0089.696] lstrlenW (lpString=".doc") returned 4
	[0089.696] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.696] lstrlenW (lpString=".docx") returned 5
	[0089.696] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0089.696] lstrlenW (lpString=".pdf") returned 4
	[0089.696] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.696] lstrlenW (lpString=".xls") returned 4
	[0089.696] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.696] lstrlenW (lpString=".xlsx") returned 5
	[0089.696] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0089.696] lstrlenW (lpString=".ppt") returned 4
	[0089.696] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65
	[0089.696] lstrlenW (lpString=".zip") returned 4
	[0089.696] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.696] lstrlenW (lpString=".rar") returned 4
	[0089.696] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.696] lstrlenW (lpString=".bz2") returned 4
	[0089.696] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.696] lstrlenW (lpString=".7z") returned 3
	[0089.696] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65
	[0089.696] lstrlenW (lpString=".dbf") returned 4
	[0089.696] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65
	[0089.696] lstrlenW (lpString=".1cd") returned 4
	[0089.696] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65
	[0089.696] lstrlenW (lpString=".jpg") returned 4
	[0089.697] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.697] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.697] lstrlenW (lpString="ACEEXCH.DLL") returned 11
	[0089.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.697] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=442272) returned 1
	[0089.697] CloseHandle (hObject=0x160) returned 1
	[0089.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20
	[0089.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.698] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.698] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0089.699] GetLastError () returned 0x0
	[0089.699] ReadFile (in: hFile=0x160, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x6bfa0, lpOverlapped=0x0) returned 1
	[0089.735] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x6bfb0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x6bfb0, lpOverlapped=0x0) returned 1
	[0089.744] ReadFile (in: hFile=0x160, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.744] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.744] SetEndOfFile (hFile=0x198) returned 1
	[0089.744] CloseHandle (hObject=0x198) returned 1
	[0089.745] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.745] SetEndOfFile (hFile=0x160) returned 1
	[0089.750] CloseHandle (hObject=0x160) returned 1
	[0089.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.750] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 1
	[0089.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67
	[0089.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67
	[0089.751] lstrlenW (lpString=".doc") returned 4
	[0089.751] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.751] lstrlenW (lpString=".docx") returned 5
	[0089.751] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1
	[0089.751] lstrlenW (lpString=".pdf") returned 4
	[0089.751] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.751] lstrlenW (lpString=".xls") returned 4
	[0089.751] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.751] lstrlenW (lpString=".xlsx") returned 5
	[0089.751] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1
	[0089.751] lstrlenW (lpString=".ppt") returned 4
	[0089.751] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67
	[0089.751] lstrlenW (lpString=".zip") returned 4
	[0089.751] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.751] lstrlenW (lpString=".rar") returned 4
	[0089.751] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.751] lstrlenW (lpString=".bz2") returned 4
	[0089.751] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.751] lstrlenW (lpString=".7z") returned 3
	[0089.751] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67
	[0089.752] lstrlenW (lpString=".dbf") returned 4
	[0089.752] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67
	[0089.752] lstrlenW (lpString=".1cd") returned 4
	[0089.752] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67
	[0089.752] lstrlenW (lpString=".jpg") returned 4
	[0089.752] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67
	[0089.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67
	[0089.752] lstrlenW (lpString=".doc") returned 4
	[0089.752] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.752] lstrlenW (lpString=".docx") returned 5
	[0089.752] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1
	[0089.752] lstrlenW (lpString=".pdf") returned 4
	[0089.752] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.752] lstrlenW (lpString=".xls") returned 4
	[0089.752] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.752] lstrlenW (lpString=".xlsx") returned 5
	[0089.752] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1
	[0089.752] lstrlenW (lpString=".ppt") returned 4
	[0089.752] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67
	[0089.753] lstrlenW (lpString=".zip") returned 4
	[0089.753] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.753] lstrlenW (lpString=".rar") returned 4
	[0089.753] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.753] lstrlenW (lpString=".bz2") returned 4
	[0089.753] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.753] lstrlenW (lpString=".7z") returned 3
	[0089.753] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67
	[0089.753] lstrlenW (lpString=".dbf") returned 4
	[0089.753] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67
	[0089.753] lstrlenW (lpString=".1cd") returned 4
	[0089.753] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67
	[0089.753] lstrlenW (lpString=".jpg") returned 4
	[0089.753] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.753] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.753] lstrlenW (lpString="ACEODBC.DLL") returned 11
	[0089.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.754] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=342960) returned 1
	[0089.754] CloseHandle (hObject=0x160) returned 1
	[0089.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20
	[0089.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.755] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.755] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0089.756] GetLastError () returned 0x0
	[0089.756] ReadFile (in: hFile=0x160, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x53bb0, lpOverlapped=0x0) returned 1
	[0089.808] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x53bc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x53bc0, lpOverlapped=0x0) returned 1
	[0089.816] ReadFile (in: hFile=0x160, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.816] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.816] SetEndOfFile (hFile=0x198) returned 1
	[0089.816] CloseHandle (hObject=0x198) returned 1
	[0089.817] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.817] SetEndOfFile (hFile=0x160) returned 1
	[0089.821] CloseHandle (hObject=0x160) returned 1
	[0089.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.821] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 1
	[0089.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67
	[0089.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67
	[0089.821] lstrlenW (lpString=".doc") returned 4
	[0089.821] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.821] lstrlenW (lpString=".docx") returned 5
	[0089.821] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1
	[0089.821] lstrlenW (lpString=".pdf") returned 4
	[0089.821] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.821] lstrlenW (lpString=".xls") returned 4
	[0089.821] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.822] lstrlenW (lpString=".xlsx") returned 5
	[0089.822] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1
	[0089.822] lstrlenW (lpString=".ppt") returned 4
	[0089.822] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67
	[0089.822] lstrlenW (lpString=".zip") returned 4
	[0089.822] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.822] lstrlenW (lpString=".rar") returned 4
	[0089.822] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.822] lstrlenW (lpString=".bz2") returned 4
	[0089.822] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.822] lstrlenW (lpString=".7z") returned 3
	[0089.822] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67
	[0089.822] lstrlenW (lpString=".dbf") returned 4
	[0089.822] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67
	[0089.822] lstrlenW (lpString=".1cd") returned 4
	[0089.822] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67
	[0089.822] lstrlenW (lpString=".jpg") returned 4
	[0089.822] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67
	[0089.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67
	[0089.822] lstrlenW (lpString=".doc") returned 4
	[0089.822] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.822] lstrlenW (lpString=".docx") returned 5
	[0089.822] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1
	[0089.822] lstrlenW (lpString=".pdf") returned 4
	[0089.822] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.823] lstrlenW (lpString=".xls") returned 4
	[0089.823] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.823] lstrlenW (lpString=".xlsx") returned 5
	[0089.823] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1
	[0089.823] lstrlenW (lpString=".ppt") returned 4
	[0089.823] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67
	[0089.823] lstrlenW (lpString=".zip") returned 4
	[0089.823] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.823] lstrlenW (lpString=".rar") returned 4
	[0089.823] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.823] lstrlenW (lpString=".bz2") returned 4
	[0089.823] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.823] lstrlenW (lpString=".7z") returned 3
	[0089.823] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67
	[0089.823] lstrlenW (lpString=".dbf") returned 4
	[0089.823] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67
	[0089.823] lstrlenW (lpString=".1cd") returned 4
	[0089.823] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67
	[0089.823] lstrlenW (lpString=".jpg") returned 4
	[0089.823] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.823] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.823] lstrlenW (lpString="ACEODDBS.DLL") returned 12
	[0089.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.824] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=15800) returned 1
	[0089.824] CloseHandle (hObject=0x160) returned 1
	[0089.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20
	[0089.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.825] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.825] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0089.826] GetLastError () returned 0x0
	[0089.826] ReadFile (in: hFile=0x160, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x3db8, lpOverlapped=0x0) returned 1
	[0089.871] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x3dc0, lpOverlapped=0x0) returned 1
	[0089.872] ReadFile (in: hFile=0x160, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.874] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.874] SetEndOfFile (hFile=0x198) returned 1
	[0089.875] CloseHandle (hObject=0x198) returned 1
	[0089.875] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.875] SetEndOfFile (hFile=0x160) returned 1
	[0089.876] CloseHandle (hObject=0x160) returned 1
	[0089.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.876] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 1
	[0089.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68
	[0089.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68
	[0089.877] lstrlenW (lpString=".doc") returned 4
	[0089.877] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.877] lstrlenW (lpString=".docx") returned 5
	[0089.877] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0089.877] lstrlenW (lpString=".pdf") returned 4
	[0089.877] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.877] lstrlenW (lpString=".xls") returned 4
	[0089.877] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.877] lstrlenW (lpString=".xlsx") returned 5
	[0089.877] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0089.877] lstrlenW (lpString=".ppt") returned 4
	[0089.877] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68
	[0089.877] lstrlenW (lpString=".zip") returned 4
	[0089.877] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.877] lstrlenW (lpString=".rar") returned 4
	[0089.877] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.877] lstrlenW (lpString=".bz2") returned 4
	[0089.877] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.877] lstrlenW (lpString=".7z") returned 3
	[0089.877] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68
	[0089.878] lstrlenW (lpString=".dbf") returned 4
	[0089.878] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68
	[0089.878] lstrlenW (lpString=".1cd") returned 4
	[0089.878] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68
	[0089.878] lstrlenW (lpString=".jpg") returned 4
	[0089.878] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68
	[0089.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68
	[0089.878] lstrlenW (lpString=".doc") returned 4
	[0089.878] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.878] lstrlenW (lpString=".docx") returned 5
	[0089.878] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0089.878] lstrlenW (lpString=".pdf") returned 4
	[0089.878] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.878] lstrlenW (lpString=".xls") returned 4
	[0089.878] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.878] lstrlenW (lpString=".xlsx") returned 5
	[0089.878] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0089.878] lstrlenW (lpString=".ppt") returned 4
	[0089.878] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68
	[0089.878] lstrlenW (lpString=".zip") returned 4
	[0089.878] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.878] lstrlenW (lpString=".rar") returned 4
	[0089.878] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.878] lstrlenW (lpString=".bz2") returned 4
	[0089.879] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.879] lstrlenW (lpString=".7z") returned 3
	[0089.879] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68
	[0089.879] lstrlenW (lpString=".dbf") returned 4
	[0089.879] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68
	[0089.879] lstrlenW (lpString=".1cd") returned 4
	[0089.879] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68
	[0089.879] lstrlenW (lpString=".jpg") returned 4
	[0089.879] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.879] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.879] lstrlenW (lpString="ACEODTXT.DLL") returned 12
	[0089.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.880] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=15800) returned 1
	[0089.880] CloseHandle (hObject=0x160) returned 1
	[0089.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 0x20
	[0089.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.881] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.881] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0089.881] GetLastError () returned 0x0
	[0089.881] ReadFile (in: hFile=0x160, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x3db8, lpOverlapped=0x0) returned 1
	[0089.907] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x3dc0, lpOverlapped=0x0) returned 1
	[0089.908] ReadFile (in: hFile=0x160, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.908] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.909] SetEndOfFile (hFile=0x198) returned 1
	[0089.909] CloseHandle (hObject=0x198) returned 1
	[0089.909] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.909] SetEndOfFile (hFile=0x160) returned 1
	[0089.910] CloseHandle (hObject=0x160) returned 1
	[0089.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.910] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 1
	[0089.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68
	[0089.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68
	[0089.933] lstrlenW (lpString=".doc") returned 4
	[0089.933] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.933] lstrlenW (lpString=".docx") returned 5
	[0089.933] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0089.933] lstrlenW (lpString=".pdf") returned 4
	[0089.933] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.933] lstrlenW (lpString=".xls") returned 4
	[0089.933] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.933] lstrlenW (lpString=".xlsx") returned 5
	[0089.933] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0089.933] lstrlenW (lpString=".ppt") returned 4
	[0089.933] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68
	[0089.933] lstrlenW (lpString=".zip") returned 4
	[0089.933] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.933] lstrlenW (lpString=".rar") returned 4
	[0089.933] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.933] lstrlenW (lpString=".bz2") returned 4
	[0089.933] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.933] lstrlenW (lpString=".7z") returned 3
	[0089.933] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68
	[0089.933] lstrlenW (lpString=".dbf") returned 4
	[0089.933] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68
	[0089.933] lstrlenW (lpString=".1cd") returned 4
	[0089.933] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68
	[0089.933] lstrlenW (lpString=".jpg") returned 4
	[0089.933] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68
	[0089.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68
	[0089.934] lstrlenW (lpString=".doc") returned 4
	[0089.934] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.934] lstrlenW (lpString=".docx") returned 5
	[0089.934] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0089.934] lstrlenW (lpString=".pdf") returned 4
	[0089.934] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.934] lstrlenW (lpString=".xls") returned 4
	[0089.934] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.934] lstrlenW (lpString=".xlsx") returned 5
	[0089.934] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0089.934] lstrlenW (lpString=".ppt") returned 4
	[0089.934] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68
	[0089.934] lstrlenW (lpString=".zip") returned 4
	[0089.934] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.934] lstrlenW (lpString=".rar") returned 4
	[0089.934] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.934] lstrlenW (lpString=".bz2") returned 4
	[0089.934] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.934] lstrlenW (lpString=".7z") returned 3
	[0089.934] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68
	[0089.934] lstrlenW (lpString=".dbf") returned 4
	[0089.934] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68
	[0089.934] lstrlenW (lpString=".1cd") returned 4
	[0089.934] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68
	[0089.934] lstrlenW (lpString=".jpg") returned 4
	[0089.934] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.935] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.935] lstrlenW (lpString="ACER3X.DLL") returned 10
	[0089.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.047] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=451480) returned 1
	[0090.047] CloseHandle (hObject=0x184) returned 1
	[0090.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 0x20
	[0090.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.273] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.273] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0090.379] GetLastError () returned 0x0
	[0090.379] ReadFile (in: hFile=0x184, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x6e398, lpOverlapped=0x0) returned 1
	[0090.403] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x6e3a0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x6e3a0, lpOverlapped=0x0) returned 1
	[0090.415] ReadFile (in: hFile=0x184, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.415] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0090.415] SetEndOfFile (hFile=0x1a8) returned 1
	[0090.423] CloseHandle (hObject=0x1a8) returned 1
	[0090.429] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.429] SetEndOfFile (hFile=0x184) returned 1
	[0090.465] CloseHandle (hObject=0x184) returned 1
	[0090.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.497] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 1
	[0090.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66
	[0090.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66
	[0090.500] lstrlenW (lpString=".doc") returned 4
	[0090.500] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0090.500] lstrlenW (lpString=".docx") returned 5
	[0090.500] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1
	[0090.500] lstrlenW (lpString=".pdf") returned 4
	[0090.500] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0090.500] lstrlenW (lpString=".xls") returned 4
	[0090.500] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0090.500] lstrlenW (lpString=".xlsx") returned 5
	[0090.500] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1
	[0090.500] lstrlenW (lpString=".ppt") returned 4
	[0090.501] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0090.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66
	[0090.501] lstrlenW (lpString=".zip") returned 4
	[0090.501] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0090.501] lstrlenW (lpString=".rar") returned 4
	[0090.501] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0090.501] lstrlenW (lpString=".bz2") returned 4
	[0090.501] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0090.501] lstrlenW (lpString=".7z") returned 3
	[0090.501] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0090.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66
	[0090.501] lstrlenW (lpString=".dbf") returned 4
	[0090.501] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0090.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66
	[0090.501] lstrlenW (lpString=".1cd") returned 4
	[0090.501] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0090.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66
	[0090.501] lstrlenW (lpString=".jpg") returned 4
	[0090.501] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0090.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66
	[0090.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66
	[0090.501] lstrlenW (lpString=".doc") returned 4
	[0090.501] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0090.501] lstrlenW (lpString=".docx") returned 5
	[0090.501] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1
	[0090.502] lstrlenW (lpString=".pdf") returned 4
	[0090.502] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0090.502] lstrlenW (lpString=".xls") returned 4
	[0090.502] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0090.502] lstrlenW (lpString=".xlsx") returned 5
	[0090.502] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1
	[0090.502] lstrlenW (lpString=".ppt") returned 4
	[0090.502] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0090.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66
	[0090.502] lstrlenW (lpString=".zip") returned 4
	[0090.502] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0090.502] lstrlenW (lpString=".rar") returned 4
	[0090.502] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0090.502] lstrlenW (lpString=".bz2") returned 4
	[0090.502] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0090.502] lstrlenW (lpString=".7z") returned 3
	[0090.502] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0090.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66
	[0090.502] lstrlenW (lpString=".dbf") returned 4
	[0090.502] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0090.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66
	[0090.502] lstrlenW (lpString=".1cd") returned 4
	[0090.502] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0090.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66
	[0090.502] lstrlenW (lpString=".jpg") returned 4
	[0090.502] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0090.503] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0090.503] lstrlenW (lpString="ACEWDAT.DLL") returned 11
	[0090.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.578] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=3050912) returned 1
	[0090.578] CloseHandle (hObject=0x184) returned 1
	[0090.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll")) returned 0x20
	[0090.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0090.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0090.703] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0090.703] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0090.704] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0090.864] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0090.864] ReadFile (in: hFile=0x1c4, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0091.264] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0091.264] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0091.264] ReadFile (in: hFile=0x1c4, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0091.402] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.402] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0091.492] SetEndOfFile (hFile=0x1c4) returned 1
	[0091.492] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f60070
	[0091.492] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.492] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.494] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.494] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.500] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.500] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.502] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f60070 | out: hHeap=0x5e0000) returned 1
	[0091.502] CloseHandle (hObject=0x1c4) returned 1
	[0091.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0091.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67
	[0091.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67
	[0091.503] lstrlenW (lpString=".doc") returned 4
	[0091.503] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0091.503] lstrlenW (lpString=".docx") returned 5
	[0091.503] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0091.503] lstrlenW (lpString=".pdf") returned 4
	[0091.504] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0091.504] lstrlenW (lpString=".xls") returned 4
	[0091.504] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0091.504] lstrlenW (lpString=".xlsx") returned 5
	[0091.504] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0091.504] lstrlenW (lpString=".ppt") returned 4
	[0091.504] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0091.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67
	[0091.504] lstrlenW (lpString=".zip") returned 4
	[0091.504] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0091.504] lstrlenW (lpString=".rar") returned 4
	[0091.504] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0091.504] lstrlenW (lpString=".bz2") returned 4
	[0091.504] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0091.504] lstrlenW (lpString=".7z") returned 3
	[0091.504] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0091.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67
	[0091.504] lstrlenW (lpString=".dbf") returned 4
	[0091.504] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0091.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67
	[0091.504] lstrlenW (lpString=".1cd") returned 4
	[0091.504] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0091.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67
	[0091.504] lstrlenW (lpString=".jpg") returned 4
	[0091.504] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0091.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67
	[0091.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67
	[0091.505] lstrlenW (lpString=".doc") returned 4
	[0091.505] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0091.505] lstrlenW (lpString=".docx") returned 5
	[0091.505] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0091.505] lstrlenW (lpString=".pdf") returned 4
	[0091.505] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0091.505] lstrlenW (lpString=".xls") returned 4
	[0091.505] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0091.505] lstrlenW (lpString=".xlsx") returned 5
	[0091.505] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0091.505] lstrlenW (lpString=".ppt") returned 4
	[0091.505] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0091.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67
	[0091.505] lstrlenW (lpString=".zip") returned 4
	[0091.505] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0091.505] lstrlenW (lpString=".rar") returned 4
	[0091.505] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0091.505] lstrlenW (lpString=".bz2") returned 4
	[0091.505] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0091.505] lstrlenW (lpString=".7z") returned 3
	[0091.505] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0091.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67
	[0091.505] lstrlenW (lpString=".dbf") returned 4
	[0091.506] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0091.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67
	[0091.506] lstrlenW (lpString=".1cd") returned 4
	[0091.506] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0091.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67
	[0091.506] lstrlenW (lpString=".jpg") returned 4
	[0091.506] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0091.506] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0091.506] lstrlenW (lpString="EXP_PDF.DLL") returned 11
	[0091.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0091.508] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=138616) returned 1
	[0091.508] CloseHandle (hObject=0x1c4) returned 1
	[0091.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 0x20
	[0091.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0091.509] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.509] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0091.510] GetLastError () returned 0x0
	[0091.510] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x21d78, lpOverlapped=0x0) returned 1
	[0091.654] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x21d80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x21d80, lpOverlapped=0x0) returned 1
	[0091.657] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.658] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0091.658] SetEndOfFile (hFile=0x1b0) returned 1
	[0091.658] CloseHandle (hObject=0x1b0) returned 1
	[0091.658] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.658] SetEndOfFile (hFile=0x1c4) returned 1
	[0091.660] CloseHandle (hObject=0x1c4) returned 1
	[0091.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0091.661] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 1
	[0091.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67
	[0091.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67
	[0091.719] lstrlenW (lpString=".doc") returned 4
	[0091.719] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0091.719] lstrlenW (lpString=".docx") returned 5
	[0091.719] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1
	[0091.719] lstrlenW (lpString=".pdf") returned 4
	[0091.719] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0091.719] lstrlenW (lpString=".xls") returned 4
	[0091.719] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0091.719] lstrlenW (lpString=".xlsx") returned 5
	[0091.719] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1
	[0091.719] lstrlenW (lpString=".ppt") returned 4
	[0091.719] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0091.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67
	[0091.719] lstrlenW (lpString=".zip") returned 4
	[0091.719] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0091.720] lstrlenW (lpString=".rar") returned 4
	[0091.720] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0091.720] lstrlenW (lpString=".bz2") returned 4
	[0091.720] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0091.720] lstrlenW (lpString=".7z") returned 3
	[0091.720] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0091.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67
	[0091.720] lstrlenW (lpString=".dbf") returned 4
	[0091.720] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0091.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67
	[0091.720] lstrlenW (lpString=".1cd") returned 4
	[0091.720] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0091.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67
	[0091.720] lstrlenW (lpString=".jpg") returned 4
	[0091.720] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0091.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67
	[0091.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67
	[0091.720] lstrlenW (lpString=".doc") returned 4
	[0091.720] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0091.720] lstrlenW (lpString=".docx") returned 5
	[0091.720] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1
	[0091.720] lstrlenW (lpString=".pdf") returned 4
	[0091.720] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0091.720] lstrlenW (lpString=".xls") returned 4
	[0091.720] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0091.720] lstrlenW (lpString=".xlsx") returned 5
	[0091.721] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1
	[0091.721] lstrlenW (lpString=".ppt") returned 4
	[0091.721] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0091.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67
	[0091.721] lstrlenW (lpString=".zip") returned 4
	[0091.721] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0091.721] lstrlenW (lpString=".rar") returned 4
	[0091.721] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0091.721] lstrlenW (lpString=".bz2") returned 4
	[0091.721] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0091.721] lstrlenW (lpString=".7z") returned 3
	[0091.721] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0091.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67
	[0091.721] lstrlenW (lpString=".dbf") returned 4
	[0091.721] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0091.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67
	[0091.721] lstrlenW (lpString=".1cd") returned 4
	[0091.721] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0091.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67
	[0091.721] lstrlenW (lpString=".jpg") returned 4
	[0091.721] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0091.721] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0091.722] lstrlenW (lpString="IACOM2.DLL") returned 10
	[0091.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0091.801] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=4289376) returned 1
	[0091.801] CloseHandle (hObject=0x1b0) returned 1
	[0091.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll")) returned 0x20
	[0091.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0092.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0092.095] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0092.095] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.095] ReadFile (in: hFile=0x184, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.123] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.123] ReadFile (in: hFile=0x184, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.140] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0092.140] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.140] ReadFile (in: hFile=0x184, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.209] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.209] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0092.232] SetEndOfFile (hFile=0x184) returned 1
	[0092.244] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f60070
	[0092.244] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0092.244] WriteFile (in: hFile=0x184, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0092.246] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0092.246] WriteFile (in: hFile=0x184, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0092.248] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0092.248] WriteFile (in: hFile=0x184, lpBuffer=0x3f60070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60070*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0092.250] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f60070 | out: hHeap=0x5e0000) returned 1
	[0092.250] CloseHandle (hObject=0x184) returned 1
	[0092.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66
	[0092.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66
	[0092.258] lstrlenW (lpString=".doc") returned 4
	[0092.258] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.258] lstrlenW (lpString=".docx") returned 5
	[0092.258] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1
	[0092.258] lstrlenW (lpString=".pdf") returned 4
	[0092.258] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.259] lstrlenW (lpString=".xls") returned 4
	[0092.259] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.259] lstrlenW (lpString=".xlsx") returned 5
	[0092.259] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1
	[0092.259] lstrlenW (lpString=".ppt") returned 4
	[0092.259] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66
	[0092.259] lstrlenW (lpString=".zip") returned 4
	[0092.259] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.259] lstrlenW (lpString=".rar") returned 4
	[0092.259] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.259] lstrlenW (lpString=".bz2") returned 4
	[0092.259] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.259] lstrlenW (lpString=".7z") returned 3
	[0092.259] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66
	[0092.259] lstrlenW (lpString=".dbf") returned 4
	[0092.259] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66
	[0092.259] lstrlenW (lpString=".1cd") returned 4
	[0092.259] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66
	[0092.259] lstrlenW (lpString=".jpg") returned 4
	[0092.259] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66
	[0092.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66
	[0092.259] lstrlenW (lpString=".doc") returned 4
	[0092.260] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.260] lstrlenW (lpString=".docx") returned 5
	[0092.260] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1
	[0092.260] lstrlenW (lpString=".pdf") returned 4
	[0092.260] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.260] lstrlenW (lpString=".xls") returned 4
	[0092.260] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.260] lstrlenW (lpString=".xlsx") returned 5
	[0092.260] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1
	[0092.260] lstrlenW (lpString=".ppt") returned 4
	[0092.260] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66
	[0092.260] lstrlenW (lpString=".zip") returned 4
	[0092.260] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.260] lstrlenW (lpString=".rar") returned 4
	[0092.260] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.260] lstrlenW (lpString=".bz2") returned 4
	[0092.260] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.260] lstrlenW (lpString=".7z") returned 3
	[0092.260] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66
	[0092.260] lstrlenW (lpString=".dbf") returned 4
	[0092.260] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66
	[0092.260] lstrlenW (lpString=".1cd") returned 4
	[0092.260] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66
	[0092.260] lstrlenW (lpString=".jpg") returned 4
	[0092.260] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.261] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0092.261] lstrlenW (lpString="msoshext.dll") returned 12
	[0092.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0092.261] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1269648) returned 1
	[0092.261] CloseHandle (hObject=0x1b8) returned 1
	[0092.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 0x20
	[0092.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0092.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68
	[0092.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68
	[0092.263] lstrlenW (lpString=".doc") returned 4
	[0092.263] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0092.263] lstrlenW (lpString=".docx") returned 5
	[0092.263] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0092.263] lstrlenW (lpString=".pdf") returned 4
	[0092.263] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0092.263] lstrlenW (lpString=".xls") returned 4
	[0092.263] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0092.263] lstrlenW (lpString=".xlsx") returned 5
	[0092.263] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0092.263] lstrlenW (lpString=".ppt") returned 4
	[0092.263] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0092.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68
	[0092.263] lstrlenW (lpString=".zip") returned 4
	[0092.263] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0092.263] lstrlenW (lpString=".rar") returned 4
	[0092.263] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0092.263] lstrlenW (lpString=".bz2") returned 4
	[0092.264] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0092.264] lstrlenW (lpString=".7z") returned 3
	[0092.264] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0092.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68
	[0092.264] lstrlenW (lpString=".dbf") returned 4
	[0092.264] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0092.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68
	[0092.264] lstrlenW (lpString=".1cd") returned 4
	[0092.264] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0092.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68
	[0092.264] lstrlenW (lpString=".jpg") returned 4
	[0092.264] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0092.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68
	[0092.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68
	[0092.264] lstrlenW (lpString=".doc") returned 4
	[0092.264] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0092.264] lstrlenW (lpString=".docx") returned 5
	[0092.264] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0092.264] lstrlenW (lpString=".pdf") returned 4
	[0092.264] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0092.264] lstrlenW (lpString=".xls") returned 4
	[0092.264] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0092.264] lstrlenW (lpString=".xlsx") returned 5
	[0092.264] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0092.264] lstrlenW (lpString=".ppt") returned 4
	[0092.264] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0092.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68
	[0092.265] lstrlenW (lpString=".zip") returned 4
	[0092.265] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0092.265] lstrlenW (lpString=".rar") returned 4
	[0092.265] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0092.265] lstrlenW (lpString=".bz2") returned 4
	[0092.265] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0092.265] lstrlenW (lpString=".7z") returned 3
	[0092.265] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0092.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68
	[0092.265] lstrlenW (lpString=".dbf") returned 4
	[0092.265] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0092.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68
	[0092.265] lstrlenW (lpString=".1cd") returned 4
	[0092.265] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0092.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68
	[0092.265] lstrlenW (lpString=".jpg") returned 4
	[0092.265] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0092.265] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0092.265] lstrlenW (lpString="MSOXEV.DLL") returned 10
	[0092.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0092.286] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=56144) returned 1
	[0092.286] CloseHandle (hObject=0x1b0) returned 1
	[0092.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 0x20
	[0092.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0092.322] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.322] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0092.325] GetLastError () returned 0x0
	[0092.325] ReadFile (in: hFile=0x160, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xdb50, lpOverlapped=0x0) returned 1
	[0092.613] WriteFile (in: hFile=0x190, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xdb60, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xdb60, lpOverlapped=0x0) returned 1
	[0092.616] ReadFile (in: hFile=0x160, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.616] WriteFile (in: hFile=0x190, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0092.616] SetEndOfFile (hFile=0x190) returned 1
	[0092.616] CloseHandle (hObject=0x190) returned 1
	[0092.617] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.617] SetEndOfFile (hFile=0x160) returned 1
	[0092.618] CloseHandle (hObject=0x160) returned 1
	[0092.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.618] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 1
	[0092.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66
	[0092.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66
	[0092.619] lstrlenW (lpString=".doc") returned 4
	[0092.619] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.619] lstrlenW (lpString=".docx") returned 5
	[0092.619] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1
	[0092.619] lstrlenW (lpString=".pdf") returned 4
	[0092.619] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.619] lstrlenW (lpString=".xls") returned 4
	[0092.619] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.619] lstrlenW (lpString=".xlsx") returned 5
	[0092.619] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1
	[0092.619] lstrlenW (lpString=".ppt") returned 4
	[0092.619] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66
	[0092.619] lstrlenW (lpString=".zip") returned 4
	[0092.619] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.619] lstrlenW (lpString=".rar") returned 4
	[0092.619] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.619] lstrlenW (lpString=".bz2") returned 4
	[0092.619] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.619] lstrlenW (lpString=".7z") returned 3
	[0092.619] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66
	[0092.619] lstrlenW (lpString=".dbf") returned 4
	[0092.619] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66
	[0092.619] lstrlenW (lpString=".1cd") returned 4
	[0092.619] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66
	[0092.619] lstrlenW (lpString=".jpg") returned 4
	[0092.619] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66
	[0092.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66
	[0092.620] lstrlenW (lpString=".doc") returned 4
	[0092.620] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.620] lstrlenW (lpString=".docx") returned 5
	[0092.620] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1
	[0092.620] lstrlenW (lpString=".pdf") returned 4
	[0092.620] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.620] lstrlenW (lpString=".xls") returned 4
	[0092.620] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.620] lstrlenW (lpString=".xlsx") returned 5
	[0092.620] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1
	[0092.620] lstrlenW (lpString=".ppt") returned 4
	[0092.620] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66
	[0092.620] lstrlenW (lpString=".zip") returned 4
	[0092.620] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.620] lstrlenW (lpString=".rar") returned 4
	[0092.620] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.620] lstrlenW (lpString=".bz2") returned 4
	[0092.620] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.620] lstrlenW (lpString=".7z") returned 3
	[0092.620] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66
	[0092.620] lstrlenW (lpString=".dbf") returned 4
	[0092.620] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66
	[0092.620] lstrlenW (lpString=".1cd") returned 4
	[0092.620] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66
	[0092.620] lstrlenW (lpString=".jpg") returned 4
	[0092.620] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.621] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0092.621] lstrlenW (lpString="MSSOAP30.DLL") returned 12
	[0092.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0092.621] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=705392) returned 1
	[0092.621] CloseHandle (hObject=0x160) returned 1
	[0092.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 0x20
	[0092.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0092.622] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.622] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0092.623] GetLastError () returned 0x0
	[0092.623] ReadFile (in: hFile=0x160, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xac370, lpOverlapped=0x0) returned 1
	[0092.672] WriteFile (in: hFile=0x190, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xac380, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xac380, lpOverlapped=0x0) returned 1
	[0092.689] ReadFile (in: hFile=0x160, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.689] WriteFile (in: hFile=0x190, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0092.689] SetEndOfFile (hFile=0x190) returned 1
	[0092.690] CloseHandle (hObject=0x190) returned 1
	[0092.690] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.690] SetEndOfFile (hFile=0x160) returned 1
	[0092.696] CloseHandle (hObject=0x160) returned 1
	[0092.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.696] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 1
	[0092.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68
	[0092.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68
	[0092.708] lstrlenW (lpString=".doc") returned 4
	[0092.708] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.708] lstrlenW (lpString=".docx") returned 5
	[0092.708] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0092.708] lstrlenW (lpString=".pdf") returned 4
	[0092.708] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.708] lstrlenW (lpString=".xls") returned 4
	[0092.708] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.708] lstrlenW (lpString=".xlsx") returned 5
	[0092.708] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0092.708] lstrlenW (lpString=".ppt") returned 4
	[0092.708] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68
	[0092.708] lstrlenW (lpString=".zip") returned 4
	[0092.708] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.708] lstrlenW (lpString=".rar") returned 4
	[0092.708] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.708] lstrlenW (lpString=".bz2") returned 4
	[0092.708] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.708] lstrlenW (lpString=".7z") returned 3
	[0092.708] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68
	[0092.708] lstrlenW (lpString=".dbf") returned 4
	[0092.708] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68
	[0092.708] lstrlenW (lpString=".1cd") returned 4
	[0092.708] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68
	[0092.708] lstrlenW (lpString=".jpg") returned 4
	[0092.708] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68
	[0092.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68
	[0092.709] lstrlenW (lpString=".doc") returned 4
	[0092.709] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.709] lstrlenW (lpString=".docx") returned 5
	[0092.709] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0092.709] lstrlenW (lpString=".pdf") returned 4
	[0092.709] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.709] lstrlenW (lpString=".xls") returned 4
	[0092.709] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.709] lstrlenW (lpString=".xlsx") returned 5
	[0092.709] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0092.709] lstrlenW (lpString=".ppt") returned 4
	[0092.709] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68
	[0092.709] lstrlenW (lpString=".zip") returned 4
	[0092.709] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.709] lstrlenW (lpString=".rar") returned 4
	[0092.709] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.709] lstrlenW (lpString=".bz2") returned 4
	[0092.709] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.709] lstrlenW (lpString=".7z") returned 3
	[0092.709] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68
	[0092.709] lstrlenW (lpString=".dbf") returned 4
	[0092.709] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68
	[0092.709] lstrlenW (lpString=".1cd") returned 4
	[0092.709] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68
	[0092.709] lstrlenW (lpString=".jpg") returned 4
	[0092.709] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.710] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0092.710] lstrlenW (lpString="Oarpmany.exe") returned 12
	[0092.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0092.739] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=232840) returned 1
	[0092.739] CloseHandle (hObject=0x1b0) returned 1
	[0092.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 0x20
	[0092.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0092.763] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.763] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0092.774] GetLastError () returned 0x0
	[0092.775] ReadFile (in: hFile=0x174, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x38d88, lpOverlapped=0x0) returned 1
	[0092.813] WriteFile (in: hFile=0x1b4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x38d90, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x38d90, lpOverlapped=0x0) returned 1
	[0092.817] ReadFile (in: hFile=0x174, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.817] WriteFile (in: hFile=0x1b4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0092.818] SetEndOfFile (hFile=0x1b4) returned 1
	[0092.818] CloseHandle (hObject=0x1b4) returned 1
	[0092.818] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.818] SetEndOfFile (hFile=0x174) returned 1
	[0092.820] CloseHandle (hObject=0x174) returned 1
	[0092.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.820] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 1
	[0092.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68
	[0092.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68
	[0092.821] lstrlenW (lpString=".doc") returned 4
	[0092.821] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0092.821] lstrlenW (lpString=".docx") returned 5
	[0092.821] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0092.821] lstrlenW (lpString=".pdf") returned 4
	[0092.821] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0092.821] lstrlenW (lpString=".xls") returned 4
	[0092.821] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0092.821] lstrlenW (lpString=".xlsx") returned 5
	[0092.821] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0092.821] lstrlenW (lpString=".ppt") returned 4
	[0092.821] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0092.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68
	[0092.821] lstrlenW (lpString=".zip") returned 4
	[0092.821] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0092.821] lstrlenW (lpString=".rar") returned 4
	[0092.821] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0092.821] lstrlenW (lpString=".bz2") returned 4
	[0092.821] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0092.821] lstrlenW (lpString=".7z") returned 3
	[0092.821] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0092.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68
	[0092.821] lstrlenW (lpString=".dbf") returned 4
	[0092.821] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0092.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68
	[0092.821] lstrlenW (lpString=".1cd") returned 4
	[0092.821] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0092.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68
	[0092.822] lstrlenW (lpString=".jpg") returned 4
	[0092.822] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0092.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68
	[0092.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68
	[0092.822] lstrlenW (lpString=".doc") returned 4
	[0092.822] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0092.822] lstrlenW (lpString=".docx") returned 5
	[0092.822] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0092.822] lstrlenW (lpString=".pdf") returned 4
	[0092.822] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0092.822] lstrlenW (lpString=".xls") returned 4
	[0092.822] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0092.822] lstrlenW (lpString=".xlsx") returned 5
	[0092.822] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0092.822] lstrlenW (lpString=".ppt") returned 4
	[0092.822] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0092.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68
	[0092.822] lstrlenW (lpString=".zip") returned 4
	[0092.822] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0092.822] lstrlenW (lpString=".rar") returned 4
	[0092.822] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0092.822] lstrlenW (lpString=".bz2") returned 4
	[0092.822] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0092.822] lstrlenW (lpString=".7z") returned 3
	[0092.822] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0092.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68
	[0092.822] lstrlenW (lpString=".dbf") returned 4
	[0092.822] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0092.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68
	[0092.822] lstrlenW (lpString=".1cd") returned 4
	[0092.822] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0092.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68
	[0092.822] lstrlenW (lpString=".jpg") returned 4
	[0092.823] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0092.823] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0092.823] lstrlenW (lpString="promointl.dll") returned 13
	[0092.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0092.883] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=15760) returned 1
	[0092.883] CloseHandle (hObject=0x1a4) returned 1
	[0092.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 0x20
	[0092.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0092.903] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.903] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0092.911] GetLastError () returned 0x0
	[0092.911] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x3d90, lpOverlapped=0x0) returned 1
	[0092.916] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x3da0, lpOverlapped=0x0) returned 1
	[0092.918] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.918] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0092.918] SetEndOfFile (hFile=0x174) returned 1
	[0092.924] CloseHandle (hObject=0x174) returned 1
	[0092.929] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.929] SetEndOfFile (hFile=0x190) returned 1
	[0092.933] CloseHandle (hObject=0x190) returned 1
	[0092.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.949] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 1
	[0092.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106
	[0092.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106
	[0092.950] lstrlenW (lpString=".doc") returned 4
	[0092.950] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0092.950] lstrlenW (lpString=".docx") returned 5
	[0092.950] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1
	[0092.950] lstrlenW (lpString=".pdf") returned 4
	[0092.950] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0092.950] lstrlenW (lpString=".xls") returned 4
	[0092.950] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0092.950] lstrlenW (lpString=".xlsx") returned 5
	[0092.950] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1
	[0092.950] lstrlenW (lpString=".ppt") returned 4
	[0092.950] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0092.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106
	[0092.950] lstrlenW (lpString=".zip") returned 4
	[0092.950] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0092.950] lstrlenW (lpString=".rar") returned 4
	[0092.950] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0092.950] lstrlenW (lpString=".bz2") returned 4
	[0092.950] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0092.950] lstrlenW (lpString=".7z") returned 3
	[0092.950] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0092.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106
	[0092.951] lstrlenW (lpString=".dbf") returned 4
	[0092.951] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0092.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106
	[0092.951] lstrlenW (lpString=".1cd") returned 4
	[0092.951] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0092.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106
	[0092.951] lstrlenW (lpString=".jpg") returned 4
	[0092.951] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0092.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106
	[0092.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106
	[0092.951] lstrlenW (lpString=".doc") returned 4
	[0092.951] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0092.951] lstrlenW (lpString=".docx") returned 5
	[0092.951] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1
	[0092.951] lstrlenW (lpString=".pdf") returned 4
	[0092.951] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0092.951] lstrlenW (lpString=".xls") returned 4
	[0092.951] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0092.951] lstrlenW (lpString=".xlsx") returned 5
	[0092.951] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1
	[0092.951] lstrlenW (lpString=".ppt") returned 4
	[0092.951] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0092.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106
	[0092.951] lstrlenW (lpString=".zip") returned 4
	[0092.951] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0092.952] lstrlenW (lpString=".rar") returned 4
	[0092.952] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0092.952] lstrlenW (lpString=".bz2") returned 4
	[0092.952] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0092.952] lstrlenW (lpString=".7z") returned 3
	[0092.952] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0092.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106
	[0092.952] lstrlenW (lpString=".dbf") returned 4
	[0092.952] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0092.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106
	[0092.952] lstrlenW (lpString=".1cd") returned 4
	[0092.952] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0092.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106
	[0092.952] lstrlenW (lpString=".jpg") returned 4
	[0092.952] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0092.952] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0092.952] lstrlenW (lpString="pidgenx.dll") returned 11
	[0092.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.061] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1463568) returned 1
	[0093.061] CloseHandle (hObject=0x190) returned 1
	[0093.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 0x20
	[0093.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0093.089] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.089] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0093.105] GetLastError () returned 0x0
	[0093.105] ReadFile (in: hFile=0x184, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0093.394] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0093.459] ReadFile (in: hFile=0x184, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x65520, lpOverlapped=0x0) returned 1
	[0093.602] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x65530, lpOverlapped=0x0) returned 1
	[0093.613] ReadFile (in: hFile=0x184, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.613] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0093.613] SetEndOfFile (hFile=0x1a4) returned 1
	[0093.613] CloseHandle (hObject=0x1a4) returned 1
	[0093.614] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.614] SetEndOfFile (hFile=0x184) returned 1
	[0093.618] CloseHandle (hObject=0x184) returned 1
	[0093.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.618] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 1
	[0093.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91
	[0093.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91
	[0093.618] lstrlenW (lpString=".doc") returned 4
	[0093.618] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0093.618] lstrlenW (lpString=".docx") returned 5
	[0093.618] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1
	[0093.618] lstrlenW (lpString=".pdf") returned 4
	[0093.618] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0093.618] lstrlenW (lpString=".xls") returned 4
	[0093.618] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0093.618] lstrlenW (lpString=".xlsx") returned 5
	[0093.618] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1
	[0093.618] lstrlenW (lpString=".ppt") returned 4
	[0093.619] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0093.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91
	[0093.619] lstrlenW (lpString=".zip") returned 4
	[0093.619] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0093.619] lstrlenW (lpString=".rar") returned 4
	[0093.619] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0093.619] lstrlenW (lpString=".bz2") returned 4
	[0093.619] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0093.619] lstrlenW (lpString=".7z") returned 3
	[0093.619] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0093.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91
	[0093.619] lstrlenW (lpString=".dbf") returned 4
	[0093.619] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0093.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91
	[0093.619] lstrlenW (lpString=".1cd") returned 4
	[0093.619] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0093.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91
	[0093.619] lstrlenW (lpString=".jpg") returned 4
	[0093.619] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0093.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91
	[0093.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91
	[0093.619] lstrlenW (lpString=".doc") returned 4
	[0093.619] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0093.619] lstrlenW (lpString=".docx") returned 5
	[0093.619] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1
	[0093.619] lstrlenW (lpString=".pdf") returned 4
	[0093.619] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0093.619] lstrlenW (lpString=".xls") returned 4
	[0093.619] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0093.619] lstrlenW (lpString=".xlsx") returned 5
	[0093.619] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1
	[0093.620] lstrlenW (lpString=".ppt") returned 4
	[0093.620] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0093.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91
	[0093.620] lstrlenW (lpString=".zip") returned 4
	[0093.620] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0093.620] lstrlenW (lpString=".rar") returned 4
	[0093.620] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0093.620] lstrlenW (lpString=".bz2") returned 4
	[0093.620] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0093.620] lstrlenW (lpString=".7z") returned 3
	[0093.620] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0093.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91
	[0093.620] lstrlenW (lpString=".dbf") returned 4
	[0093.620] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0093.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91
	[0093.620] lstrlenW (lpString=".1cd") returned 4
	[0093.620] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0093.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91
	[0093.620] lstrlenW (lpString=".jpg") returned 4
	[0093.620] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0093.620] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0093.620] lstrlenW (lpString="SERCONV.DLL") returned 11
	[0093.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0093.643] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=591736) returned 1
	[0093.643] CloseHandle (hObject=0x1b8) returned 1
	[0093.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll")) returned 0x20
	[0093.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0093.678] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.678] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0093.691] GetLastError () returned 0x0
	[0093.691] ReadFile (in: hFile=0x184, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x90778, lpOverlapped=0x0) returned 1
	[0093.776] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x90780, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x90780, lpOverlapped=0x0) returned 1
	[0093.788] ReadFile (in: hFile=0x184, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.788] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0093.788] SetEndOfFile (hFile=0x1a4) returned 1
	[0093.788] CloseHandle (hObject=0x1a4) returned 1
	[0093.788] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.788] SetEndOfFile (hFile=0x184) returned 1
	[0093.794] CloseHandle (hObject=0x184) returned 1
	[0093.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.794] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll")) returned 1
	[0093.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67
	[0093.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67
	[0093.795] lstrlenW (lpString=".doc") returned 4
	[0093.795] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.795] lstrlenW (lpString=".docx") returned 5
	[0093.795] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1
	[0093.795] lstrlenW (lpString=".pdf") returned 4
	[0093.795] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.795] lstrlenW (lpString=".xls") returned 4
	[0093.795] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.795] lstrlenW (lpString=".xlsx") returned 5
	[0093.795] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1
	[0093.795] lstrlenW (lpString=".ppt") returned 4
	[0093.795] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67
	[0093.795] lstrlenW (lpString=".zip") returned 4
	[0093.795] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.795] lstrlenW (lpString=".rar") returned 4
	[0093.795] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.795] lstrlenW (lpString=".bz2") returned 4
	[0093.795] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.795] lstrlenW (lpString=".7z") returned 3
	[0093.795] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67
	[0093.795] lstrlenW (lpString=".dbf") returned 4
	[0093.795] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67
	[0093.795] lstrlenW (lpString=".1cd") returned 4
	[0093.795] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67
	[0093.795] lstrlenW (lpString=".jpg") returned 4
	[0093.795] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67
	[0093.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67
	[0093.796] lstrlenW (lpString=".doc") returned 4
	[0093.796] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.796] lstrlenW (lpString=".docx") returned 5
	[0093.796] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1
	[0093.796] lstrlenW (lpString=".pdf") returned 4
	[0093.796] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.796] lstrlenW (lpString=".xls") returned 4
	[0093.796] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.796] lstrlenW (lpString=".xlsx") returned 5
	[0093.796] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1
	[0093.796] lstrlenW (lpString=".ppt") returned 4
	[0093.796] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67
	[0093.796] lstrlenW (lpString=".zip") returned 4
	[0093.796] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.796] lstrlenW (lpString=".rar") returned 4
	[0093.796] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.796] lstrlenW (lpString=".bz2") returned 4
	[0093.796] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.796] lstrlenW (lpString=".7z") returned 3
	[0093.796] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67
	[0093.796] lstrlenW (lpString=".dbf") returned 4
	[0093.796] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67
	[0093.797] lstrlenW (lpString=".1cd") returned 4
	[0093.797] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67
	[0093.797] lstrlenW (lpString=".jpg") returned 4
	[0093.797] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.797] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0093.797] lstrlenW (lpString="VBAJET32.DLL") returned 12
	[0093.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0093.798] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=49488) returned 1
	[0093.798] CloseHandle (hObject=0x184) returned 1
	[0093.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll")) returned 0x20
	[0093.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0093.799] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.799] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0093.800] GetLastError () returned 0x0
	[0093.800] ReadFile (in: hFile=0x184, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xc150, lpOverlapped=0x0) returned 1
	[0093.802] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc160, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xc160, lpOverlapped=0x0) returned 1
	[0093.803] ReadFile (in: hFile=0x184, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.804] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0093.804] SetEndOfFile (hFile=0x1a4) returned 1
	[0093.804] CloseHandle (hObject=0x1a4) returned 1
	[0093.804] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.804] SetEndOfFile (hFile=0x184) returned 1
	[0093.805] CloseHandle (hObject=0x184) returned 1
	[0093.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.805] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll")) returned 1
	[0093.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68
	[0093.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68
	[0093.806] lstrlenW (lpString=".doc") returned 4
	[0093.806] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.806] lstrlenW (lpString=".docx") returned 5
	[0093.806] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1
	[0093.806] lstrlenW (lpString=".pdf") returned 4
	[0093.806] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.806] lstrlenW (lpString=".xls") returned 4
	[0093.806] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.806] lstrlenW (lpString=".xlsx") returned 5
	[0093.806] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1
	[0093.806] lstrlenW (lpString=".ppt") returned 4
	[0093.806] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68
	[0093.806] lstrlenW (lpString=".zip") returned 4
	[0093.806] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.806] lstrlenW (lpString=".rar") returned 4
	[0093.806] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.806] lstrlenW (lpString=".bz2") returned 4
	[0093.806] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.806] lstrlenW (lpString=".7z") returned 3
	[0093.806] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68
	[0093.806] lstrlenW (lpString=".dbf") returned 4
	[0093.806] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68
	[0093.806] lstrlenW (lpString=".1cd") returned 4
	[0093.806] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68
	[0093.806] lstrlenW (lpString=".jpg") returned 4
	[0093.806] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68
	[0093.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68
	[0093.807] lstrlenW (lpString=".doc") returned 4
	[0093.807] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.807] lstrlenW (lpString=".docx") returned 5
	[0093.807] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1
	[0093.807] lstrlenW (lpString=".pdf") returned 4
	[0093.807] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.807] lstrlenW (lpString=".xls") returned 4
	[0093.807] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.807] lstrlenW (lpString=".xlsx") returned 5
	[0093.807] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1
	[0093.807] lstrlenW (lpString=".ppt") returned 4
	[0093.807] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68
	[0093.807] lstrlenW (lpString=".zip") returned 4
	[0093.807] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.807] lstrlenW (lpString=".rar") returned 4
	[0093.807] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.807] lstrlenW (lpString=".bz2") returned 4
	[0093.807] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.807] lstrlenW (lpString=".7z") returned 3
	[0093.807] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68
	[0093.807] lstrlenW (lpString=".dbf") returned 4
	[0093.807] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68
	[0093.807] lstrlenW (lpString=".1cd") returned 4
	[0093.807] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68
	[0093.807] lstrlenW (lpString=".jpg") returned 4
	[0093.807] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.808] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0093.808] lstrlenW (lpString="WISC30.DLL") returned 10
	[0093.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.865] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=147344) returned 1
	[0093.865] CloseHandle (hObject=0x190) returned 1
	[0093.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll")) returned 0x20
	[0093.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.866] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.866] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0093.867] GetLastError () returned 0x0
	[0093.867] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x23f90, lpOverlapped=0x0) returned 1
	[0093.909] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x23fa0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x23fa0, lpOverlapped=0x0) returned 1
	[0093.913] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.913] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0093.913] SetEndOfFile (hFile=0x1b8) returned 1
	[0093.913] CloseHandle (hObject=0x1b8) returned 1
	[0093.914] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.914] SetEndOfFile (hFile=0x190) returned 1
	[0093.915] CloseHandle (hObject=0x190) returned 1
	[0093.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.916] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll")) returned 1
	[0093.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66
	[0093.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66
	[0093.916] lstrlenW (lpString=".doc") returned 4
	[0093.916] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.916] lstrlenW (lpString=".docx") returned 5
	[0093.916] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0093.916] lstrlenW (lpString=".pdf") returned 4
	[0093.916] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.916] lstrlenW (lpString=".xls") returned 4
	[0093.916] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.916] lstrlenW (lpString=".xlsx") returned 5
	[0093.916] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0093.916] lstrlenW (lpString=".ppt") returned 4
	[0093.916] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66
	[0093.916] lstrlenW (lpString=".zip") returned 4
	[0093.916] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.916] lstrlenW (lpString=".rar") returned 4
	[0093.916] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.916] lstrlenW (lpString=".bz2") returned 4
	[0093.916] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.917] lstrlenW (lpString=".7z") returned 3
	[0093.917] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66
	[0093.917] lstrlenW (lpString=".dbf") returned 4
	[0093.917] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66
	[0093.917] lstrlenW (lpString=".1cd") returned 4
	[0093.917] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66
	[0093.917] lstrlenW (lpString=".jpg") returned 4
	[0093.917] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66
	[0093.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66
	[0093.917] lstrlenW (lpString=".doc") returned 4
	[0093.917] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.917] lstrlenW (lpString=".docx") returned 5
	[0093.917] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0093.917] lstrlenW (lpString=".pdf") returned 4
	[0093.917] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.917] lstrlenW (lpString=".xls") returned 4
	[0093.918] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.918] lstrlenW (lpString=".xlsx") returned 5
	[0093.918] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0093.918] lstrlenW (lpString=".ppt") returned 4
	[0093.918] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66
	[0093.918] lstrlenW (lpString=".zip") returned 4
	[0093.918] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.918] lstrlenW (lpString=".rar") returned 4
	[0093.918] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.918] lstrlenW (lpString=".bz2") returned 4
	[0093.918] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.918] lstrlenW (lpString=".7z") returned 3
	[0093.918] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66
	[0093.918] lstrlenW (lpString=".dbf") returned 4
	[0093.918] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66
	[0093.918] lstrlenW (lpString=".1cd") returned 4
	[0093.918] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66
	[0093.918] lstrlenW (lpString=".jpg") returned 4
	[0093.918] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.919] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0093.919] lstrlenW (lpString="OSPPOBJS.DLL") returned 12
	[0093.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.919] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2173696) returned 1
	[0093.919] CloseHandle (hObject=0x190) returned 1
	[0093.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll")) returned 0x20
	[0093.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0093.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.921] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0093.921] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.921] ReadFile (in: hFile=0x190, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0093.923] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xb0e55, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.924] ReadFile (in: hFile=0x190, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0093.940] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.940] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x1d2b00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.940] ReadFile (in: hFile=0x190, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0093.964] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.964] WriteFile (in: hFile=0x190, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0094.032] SetEndOfFile (hFile=0x190) returned 1
	[0094.032] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x4001020
	[0094.032] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0094.032] WriteFile (in: hFile=0x190, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0094.033] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xb0e55, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0094.033] WriteFile (in: hFile=0x190, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0094.036] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x1d2b00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0094.036] WriteFile (in: hFile=0x190, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0094.037] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x4001020 | out: hHeap=0x5e0000) returned 1
	[0094.037] CloseHandle (hObject=0x190) returned 1
	[0094.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92
	[0094.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92
	[0094.038] lstrlenW (lpString=".doc") returned 4
	[0094.038] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.038] lstrlenW (lpString=".docx") returned 5
	[0094.038] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0094.038] lstrlenW (lpString=".pdf") returned 4
	[0094.038] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.038] lstrlenW (lpString=".xls") returned 4
	[0094.038] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.038] lstrlenW (lpString=".xlsx") returned 5
	[0094.038] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0094.038] lstrlenW (lpString=".ppt") returned 4
	[0094.038] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92
	[0094.038] lstrlenW (lpString=".zip") returned 4
	[0094.038] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.038] lstrlenW (lpString=".rar") returned 4
	[0094.039] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.039] lstrlenW (lpString=".bz2") returned 4
	[0094.039] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.039] lstrlenW (lpString=".7z") returned 3
	[0094.039] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92
	[0094.039] lstrlenW (lpString=".dbf") returned 4
	[0094.039] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92
	[0094.039] lstrlenW (lpString=".1cd") returned 4
	[0094.039] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92
	[0094.039] lstrlenW (lpString=".jpg") returned 4
	[0094.039] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92
	[0094.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92
	[0094.039] lstrlenW (lpString=".doc") returned 4
	[0094.039] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.039] lstrlenW (lpString=".docx") returned 5
	[0094.039] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0094.039] lstrlenW (lpString=".pdf") returned 4
	[0094.039] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.039] lstrlenW (lpString=".xls") returned 4
	[0094.039] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.039] lstrlenW (lpString=".xlsx") returned 5
	[0094.039] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0094.039] lstrlenW (lpString=".ppt") returned 4
	[0094.039] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92
	[0094.039] lstrlenW (lpString=".zip") returned 4
	[0094.040] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.040] lstrlenW (lpString=".rar") returned 4
	[0094.040] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.040] lstrlenW (lpString=".bz2") returned 4
	[0094.040] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.040] lstrlenW (lpString=".7z") returned 3
	[0094.040] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92
	[0094.040] lstrlenW (lpString=".dbf") returned 4
	[0094.040] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92
	[0094.040] lstrlenW (lpString=".1cd") returned 4
	[0094.040] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92
	[0094.040] lstrlenW (lpString=".jpg") returned 4
	[0094.040] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.040] lstrcmpiW (lpString1=".EXE", lpString2=".adobe") returned 1
	[0094.040] lstrlenW (lpString="OSPPSVC.EXE") returned 11
	[0094.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0094.041] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=4925184) returned 1
	[0094.041] CloseHandle (hObject=0x190) returned 1
	[0094.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe")) returned 0x20
	[0094.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0094.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0094.043] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1
	[0094.043] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0094.043] ReadFile (in: hFile=0x190, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0094.061] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x190d00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0094.061] ReadFile (in: hFile=0x190, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0094.129] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.129] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x472700, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1
	[0094.129] ReadFile (in: hFile=0x190, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0094.156] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.156] WriteFile (in: hFile=0x190, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0094.180] SetEndOfFile (hFile=0x190) returned 1
	[0094.180] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x4001020
	[0094.180] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0094.180] WriteFile (in: hFile=0x190, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0094.182] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x190d00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0094.182] WriteFile (in: hFile=0x190, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0094.186] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x472700, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1
	[0094.186] WriteFile (in: hFile=0x190, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0094.188] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x4001020 | out: hHeap=0x5e0000) returned 1
	[0094.188] CloseHandle (hObject=0x190) returned 1
	[0094.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91
	[0094.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91
	[0094.189] lstrlenW (lpString=".doc") returned 4
	[0094.189] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0094.189] lstrlenW (lpString=".docx") returned 5
	[0094.189] lstrcmpiW (lpString1=".docx", lpString2="C.EXE") returned -1
	[0094.189] lstrlenW (lpString=".pdf") returned 4
	[0094.189] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0094.189] lstrlenW (lpString=".xls") returned 4
	[0094.189] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0094.189] lstrlenW (lpString=".xlsx") returned 5
	[0094.189] lstrcmpiW (lpString1=".xlsx", lpString2="C.EXE") returned -1
	[0094.189] lstrlenW (lpString=".ppt") returned 4
	[0094.189] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0094.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91
	[0094.189] lstrlenW (lpString=".zip") returned 4
	[0094.189] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0094.189] lstrlenW (lpString=".rar") returned 4
	[0094.189] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0094.189] lstrlenW (lpString=".bz2") returned 4
	[0094.189] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0094.189] lstrlenW (lpString=".7z") returned 3
	[0094.189] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0094.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91
	[0094.189] lstrlenW (lpString=".dbf") returned 4
	[0094.189] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0094.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91
	[0094.189] lstrlenW (lpString=".1cd") returned 4
	[0094.189] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0094.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91
	[0094.189] lstrlenW (lpString=".jpg") returned 4
	[0094.189] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0094.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91
	[0094.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91
	[0094.190] lstrlenW (lpString=".doc") returned 4
	[0094.190] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0094.190] lstrlenW (lpString=".docx") returned 5
	[0094.190] lstrcmpiW (lpString1=".docx", lpString2="C.EXE") returned -1
	[0094.190] lstrlenW (lpString=".pdf") returned 4
	[0094.190] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0094.190] lstrlenW (lpString=".xls") returned 4
	[0094.190] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0094.190] lstrlenW (lpString=".xlsx") returned 5
	[0094.190] lstrcmpiW (lpString1=".xlsx", lpString2="C.EXE") returned -1
	[0094.190] lstrlenW (lpString=".ppt") returned 4
	[0094.190] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0094.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91
	[0094.190] lstrlenW (lpString=".zip") returned 4
	[0094.190] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0094.190] lstrlenW (lpString=".rar") returned 4
	[0094.190] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0094.190] lstrlenW (lpString=".bz2") returned 4
	[0094.190] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0094.190] lstrlenW (lpString=".7z") returned 3
	[0094.190] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0094.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91
	[0094.190] lstrlenW (lpString=".dbf") returned 4
	[0094.190] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0094.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91
	[0094.190] lstrlenW (lpString=".1cd") returned 4
	[0094.190] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0094.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91
	[0094.190] lstrlenW (lpString=".jpg") returned 4
	[0094.191] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0094.191] lstrcmpiW (lpString1=".LEX", lpString2=".adobe") returned 1
	[0094.191] lstrlenW (lpString="MSWDS_FR.LEX") returned 12
	[0094.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0094.218] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=295663) returned 1
	[0094.218] CloseHandle (hObject=0x190) returned 1
	[0094.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 0x20
	[0094.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0094.273] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.273] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0094.308] GetLastError () returned 0x0
	[0094.308] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x482ef, lpOverlapped=0x0) returned 1
	[0094.359] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x482f0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x482f0, lpOverlapped=0x0) returned 1
	[0094.366] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.366] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0094.366] SetEndOfFile (hFile=0x1a8) returned 1
	[0094.366] CloseHandle (hObject=0x1a8) returned 1
	[0094.366] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.366] SetEndOfFile (hFile=0x1b8) returned 1
	[0094.369] CloseHandle (hObject=0x1b8) returned 1
	[0094.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.370] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 1
	[0094.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65
	[0094.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65
	[0094.370] lstrlenW (lpString=".doc") returned 4
	[0094.370] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1
	[0094.370] lstrlenW (lpString=".docx") returned 5
	[0094.370] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1
	[0094.370] lstrlenW (lpString=".pdf") returned 4
	[0094.370] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1
	[0094.370] lstrlenW (lpString=".xls") returned 4
	[0094.370] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1
	[0094.370] lstrlenW (lpString=".xlsx") returned 5
	[0094.370] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1
	[0094.370] lstrlenW (lpString=".ppt") returned 4
	[0094.370] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1
	[0094.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65
	[0094.370] lstrlenW (lpString=".zip") returned 4
	[0094.371] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1
	[0094.371] lstrlenW (lpString=".rar") returned 4
	[0094.371] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1
	[0094.371] lstrlenW (lpString=".bz2") returned 4
	[0094.371] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1
	[0094.371] lstrlenW (lpString=".7z") returned 3
	[0094.371] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1
	[0094.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65
	[0094.371] lstrlenW (lpString=".dbf") returned 4
	[0094.371] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1
	[0094.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65
	[0094.371] lstrlenW (lpString=".1cd") returned 4
	[0094.371] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1
	[0094.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65
	[0094.371] lstrlenW (lpString=".jpg") returned 4
	[0094.371] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1
	[0094.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65
	[0094.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65
	[0094.371] lstrlenW (lpString=".doc") returned 4
	[0094.371] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1
	[0094.371] lstrlenW (lpString=".docx") returned 5
	[0094.371] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1
	[0094.371] lstrlenW (lpString=".pdf") returned 4
	[0094.371] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1
	[0094.371] lstrlenW (lpString=".xls") returned 4
	[0094.371] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1
	[0094.371] lstrlenW (lpString=".xlsx") returned 5
	[0094.371] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1
	[0094.371] lstrlenW (lpString=".ppt") returned 4
	[0094.371] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1
	[0094.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65
	[0094.371] lstrlenW (lpString=".zip") returned 4
	[0094.371] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1
	[0094.372] lstrlenW (lpString=".rar") returned 4
	[0094.372] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1
	[0094.372] lstrlenW (lpString=".bz2") returned 4
	[0094.372] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1
	[0094.372] lstrlenW (lpString=".7z") returned 3
	[0094.372] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1
	[0094.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65
	[0094.372] lstrlenW (lpString=".dbf") returned 4
	[0094.372] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1
	[0094.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65
	[0094.372] lstrlenW (lpString=".1cd") returned 4
	[0094.372] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1
	[0094.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65
	[0094.372] lstrlenW (lpString=".jpg") returned 4
	[0094.372] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1
	[0094.372] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0094.372] lstrlenW (lpString="FPERSON.DLL") returned 11
	[0094.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0094.382] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=217984) returned 1
	[0094.382] CloseHandle (hObject=0x194) returned 1
	[0094.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll")) returned 0x20
	[0094.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0094.441] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.441] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0094.460] GetLastError () returned 0x0
	[0094.460] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x35380, lpOverlapped=0x0) returned 1
	[0094.471] WriteFile (in: hFile=0x188, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x35390, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x35390, lpOverlapped=0x0) returned 1
	[0094.477] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.477] WriteFile (in: hFile=0x188, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0094.477] SetEndOfFile (hFile=0x188) returned 1
	[0094.484] CloseHandle (hObject=0x188) returned 1
	[0094.487] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.487] SetEndOfFile (hFile=0x1a8) returned 1
	[0094.496] CloseHandle (hObject=0x1a8) returned 1
	[0094.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.497] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll")) returned 1
	[0094.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68
	[0094.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68
	[0094.498] lstrlenW (lpString=".doc") returned 4
	[0094.498] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.498] lstrlenW (lpString=".docx") returned 5
	[0094.498] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1
	[0094.498] lstrlenW (lpString=".pdf") returned 4
	[0094.498] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.498] lstrlenW (lpString=".xls") returned 4
	[0094.498] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.499] lstrlenW (lpString=".xlsx") returned 5
	[0094.499] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1
	[0094.499] lstrlenW (lpString=".ppt") returned 4
	[0094.499] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68
	[0094.499] lstrlenW (lpString=".zip") returned 4
	[0094.499] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.499] lstrlenW (lpString=".rar") returned 4
	[0094.499] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.499] lstrlenW (lpString=".bz2") returned 4
	[0094.499] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.499] lstrlenW (lpString=".7z") returned 3
	[0094.499] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68
	[0094.499] lstrlenW (lpString=".dbf") returned 4
	[0094.499] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68
	[0094.499] lstrlenW (lpString=".1cd") returned 4
	[0094.499] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68
	[0094.499] lstrlenW (lpString=".jpg") returned 4
	[0094.499] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68
	[0094.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68
	[0094.499] lstrlenW (lpString=".doc") returned 4
	[0094.500] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.500] lstrlenW (lpString=".docx") returned 5
	[0094.500] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1
	[0094.500] lstrlenW (lpString=".pdf") returned 4
	[0094.500] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.500] lstrlenW (lpString=".xls") returned 4
	[0094.500] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.500] lstrlenW (lpString=".xlsx") returned 5
	[0094.500] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1
	[0094.500] lstrlenW (lpString=".ppt") returned 4
	[0094.500] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68
	[0094.500] lstrlenW (lpString=".zip") returned 4
	[0094.500] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.500] lstrlenW (lpString=".rar") returned 4
	[0094.500] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.500] lstrlenW (lpString=".bz2") returned 4
	[0094.500] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.500] lstrlenW (lpString=".7z") returned 3
	[0094.500] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68
	[0094.500] lstrlenW (lpString=".dbf") returned 4
	[0094.500] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68
	[0094.500] lstrlenW (lpString=".1cd") returned 4
	[0094.500] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68
	[0094.501] lstrlenW (lpString=".jpg") returned 4
	[0094.501] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.501] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0094.501] lstrlenW (lpString="FSTOCK.DLL") returned 10
	[0094.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0094.526] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=159104) returned 1
	[0094.526] CloseHandle (hObject=0x1b8) returned 1
	[0094.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll")) returned 0x20
	[0094.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0094.572] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.573] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0094.594] GetLastError () returned 0x0
	[0094.594] ReadFile (in: hFile=0x194, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x26d80, lpOverlapped=0x0) returned 1
	[0094.621] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x26d90, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x26d90, lpOverlapped=0x0) returned 1
	[0094.624] ReadFile (in: hFile=0x194, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.624] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0094.624] SetEndOfFile (hFile=0x1a0) returned 1
	[0094.630] CloseHandle (hObject=0x1a0) returned 1
	[0094.635] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.635] SetEndOfFile (hFile=0x194) returned 1
	[0094.640] CloseHandle (hObject=0x194) returned 1
	[0094.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.643] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll")) returned 1
	[0094.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67
	[0094.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67
	[0094.659] lstrlenW (lpString=".doc") returned 4
	[0094.659] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.659] lstrlenW (lpString=".docx") returned 5
	[0094.659] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1
	[0094.660] lstrlenW (lpString=".pdf") returned 4
	[0094.660] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.660] lstrlenW (lpString=".xls") returned 4
	[0094.660] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.660] lstrlenW (lpString=".xlsx") returned 5
	[0094.660] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1
	[0094.660] lstrlenW (lpString=".ppt") returned 4
	[0094.660] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67
	[0094.660] lstrlenW (lpString=".zip") returned 4
	[0094.660] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.660] lstrlenW (lpString=".rar") returned 4
	[0094.660] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.660] lstrlenW (lpString=".bz2") returned 4
	[0094.660] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.660] lstrlenW (lpString=".7z") returned 3
	[0094.660] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67
	[0094.660] lstrlenW (lpString=".dbf") returned 4
	[0094.660] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67
	[0094.660] lstrlenW (lpString=".1cd") returned 4
	[0094.660] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67
	[0094.660] lstrlenW (lpString=".jpg") returned 4
	[0094.660] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67
	[0094.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67
	[0094.661] lstrlenW (lpString=".doc") returned 4
	[0094.661] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.661] lstrlenW (lpString=".docx") returned 5
	[0094.661] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1
	[0094.661] lstrlenW (lpString=".pdf") returned 4
	[0094.661] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.661] lstrlenW (lpString=".xls") returned 4
	[0094.661] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.661] lstrlenW (lpString=".xlsx") returned 5
	[0094.661] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1
	[0094.661] lstrlenW (lpString=".ppt") returned 4
	[0094.661] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67
	[0094.661] lstrlenW (lpString=".zip") returned 4
	[0094.661] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.661] lstrlenW (lpString=".rar") returned 4
	[0094.661] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.661] lstrlenW (lpString=".bz2") returned 4
	[0094.661] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.661] lstrlenW (lpString=".7z") returned 3
	[0094.661] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67
	[0094.661] lstrlenW (lpString=".dbf") returned 4
	[0094.662] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67
	[0094.662] lstrlenW (lpString=".1cd") returned 4
	[0094.662] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67
	[0094.662] lstrlenW (lpString=".jpg") returned 4
	[0094.662] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.662] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0094.662] lstrlenW (lpString="SmartTagInstall.exe") returned 19
	[0094.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0094.676] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=15744) returned 1
	[0094.676] CloseHandle (hObject=0x1a0) returned 1
	[0094.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe")) returned 0x20
	[0094.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0094.720] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.720] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0094.765] GetLastError () returned 0x0
	[0094.765] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x3d80, lpOverlapped=0x0) returned 1
	[0094.813] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x3d90, lpOverlapped=0x0) returned 1
	[0094.815] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.815] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0094.815] SetEndOfFile (hFile=0x19c) returned 1
	[0094.815] CloseHandle (hObject=0x19c) returned 1
	[0094.816] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.816] SetEndOfFile (hFile=0x198) returned 1
	[0094.817] CloseHandle (hObject=0x198) returned 1
	[0094.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.817] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe")) returned 1
	[0094.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76
	[0094.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76
	[0094.818] lstrlenW (lpString=".doc") returned 4
	[0094.818] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0094.818] lstrlenW (lpString=".docx") returned 5
	[0094.818] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0094.818] lstrlenW (lpString=".pdf") returned 4
	[0094.819] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0094.819] lstrlenW (lpString=".xls") returned 4
	[0094.819] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0094.819] lstrlenW (lpString=".xlsx") returned 5
	[0094.819] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0094.819] lstrlenW (lpString=".ppt") returned 4
	[0094.819] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0094.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76
	[0094.819] lstrlenW (lpString=".zip") returned 4
	[0094.819] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0094.819] lstrlenW (lpString=".rar") returned 4
	[0094.819] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0094.819] lstrlenW (lpString=".bz2") returned 4
	[0094.819] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0094.819] lstrlenW (lpString=".7z") returned 3
	[0094.819] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0094.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76
	[0094.819] lstrlenW (lpString=".dbf") returned 4
	[0094.819] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0094.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76
	[0094.819] lstrlenW (lpString=".1cd") returned 4
	[0094.819] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0094.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76
	[0094.819] lstrlenW (lpString=".jpg") returned 4
	[0094.819] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0094.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76
	[0094.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76
	[0094.820] lstrlenW (lpString=".doc") returned 4
	[0094.820] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0094.820] lstrlenW (lpString=".docx") returned 5
	[0094.820] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0094.820] lstrlenW (lpString=".pdf") returned 4
	[0094.820] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0094.820] lstrlenW (lpString=".xls") returned 4
	[0094.820] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0094.820] lstrlenW (lpString=".xlsx") returned 5
	[0094.820] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0094.820] lstrlenW (lpString=".ppt") returned 4
	[0094.820] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0094.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76
	[0094.820] lstrlenW (lpString=".zip") returned 4
	[0094.820] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0094.820] lstrlenW (lpString=".rar") returned 4
	[0094.820] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0094.820] lstrlenW (lpString=".bz2") returned 4
	[0094.820] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0094.820] lstrlenW (lpString=".7z") returned 3
	[0094.820] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0094.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76
	[0094.820] lstrlenW (lpString=".dbf") returned 4
	[0094.820] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0094.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76
	[0094.820] lstrlenW (lpString=".1cd") returned 4
	[0094.820] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0094.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76
	[0094.821] lstrlenW (lpString=".jpg") returned 4
	[0094.821] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0094.821] lstrcmpiW (lpString1=".CNV", lpString2=".adobe") returned 1
	[0094.821] lstrlenW (lpString="WPFT532.CNV") returned 11
	[0094.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0094.822] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=196976) returned 1
	[0094.822] CloseHandle (hObject=0x198) returned 1
	[0094.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv")) returned 0x20
	[0094.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0094.823] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.823] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0094.824] GetLastError () returned 0x0
	[0094.824] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x30170, lpOverlapped=0x0) returned 1
	[0094.929] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x30180, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x30180, lpOverlapped=0x0) returned 1
	[0094.934] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.934] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0094.934] SetEndOfFile (hFile=0x19c) returned 1
	[0094.934] CloseHandle (hObject=0x19c) returned 1
	[0094.934] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.934] SetEndOfFile (hFile=0x198) returned 1
	[0094.937] CloseHandle (hObject=0x198) returned 1
	[0094.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.937] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv")) returned 1
	[0094.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67
	[0094.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67
	[0094.937] lstrlenW (lpString=".doc") returned 4
	[0094.937] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1
	[0094.937] lstrlenW (lpString=".docx") returned 5
	[0094.937] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1
	[0094.938] lstrlenW (lpString=".pdf") returned 4
	[0094.938] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1
	[0094.938] lstrlenW (lpString=".xls") returned 4
	[0094.938] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1
	[0094.938] lstrlenW (lpString=".xlsx") returned 5
	[0094.938] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1
	[0094.938] lstrlenW (lpString=".ppt") returned 4
	[0094.938] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1
	[0094.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67
	[0094.938] lstrlenW (lpString=".zip") returned 4
	[0094.938] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1
	[0094.938] lstrlenW (lpString=".rar") returned 4
	[0094.938] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1
	[0094.938] lstrlenW (lpString=".bz2") returned 4
	[0094.938] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1
	[0094.938] lstrlenW (lpString=".7z") returned 3
	[0094.938] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1
	[0094.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67
	[0094.938] lstrlenW (lpString=".dbf") returned 4
	[0094.938] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1
	[0094.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67
	[0094.938] lstrlenW (lpString=".1cd") returned 4
	[0094.938] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1
	[0094.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67
	[0094.938] lstrlenW (lpString=".jpg") returned 4
	[0094.938] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1
	[0094.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67
	[0094.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67
	[0094.939] lstrlenW (lpString=".doc") returned 4
	[0094.939] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1
	[0094.939] lstrlenW (lpString=".docx") returned 5
	[0094.939] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1
	[0094.939] lstrlenW (lpString=".pdf") returned 4
	[0094.939] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1
	[0094.939] lstrlenW (lpString=".xls") returned 4
	[0094.939] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1
	[0094.939] lstrlenW (lpString=".xlsx") returned 5
	[0094.939] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1
	[0094.939] lstrlenW (lpString=".ppt") returned 4
	[0094.939] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1
	[0094.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67
	[0094.939] lstrlenW (lpString=".zip") returned 4
	[0094.939] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1
	[0094.940] lstrlenW (lpString=".rar") returned 4
	[0094.940] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1
	[0094.940] lstrlenW (lpString=".bz2") returned 4
	[0094.940] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1
	[0094.940] lstrlenW (lpString=".7z") returned 3
	[0094.940] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1
	[0094.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67
	[0094.940] lstrlenW (lpString=".dbf") returned 4
	[0094.940] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1
	[0094.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67
	[0094.940] lstrlenW (lpString=".1cd") returned 4
	[0094.940] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1
	[0094.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67
	[0094.940] lstrlenW (lpString=".jpg") returned 4
	[0094.940] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1
	[0094.940] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0094.940] lstrlenW (lpString="ARCTIC.INF") returned 10
	[0094.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0094.941] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=513) returned 1
	[0094.941] CloseHandle (hObject=0x198) returned 1
	[0094.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf")) returned 0x20
	[0094.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0094.942] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.942] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0094.943] GetLastError () returned 0x0
	[0094.943] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x201, lpOverlapped=0x0) returned 1
	[0094.944] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x210, lpOverlapped=0x0) returned 1
	[0094.945] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.945] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0094.945] SetEndOfFile (hFile=0x19c) returned 1
	[0094.946] CloseHandle (hObject=0x19c) returned 1
	[0094.946] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.946] SetEndOfFile (hFile=0x198) returned 1
	[0094.947] CloseHandle (hObject=0x198) returned 1
	[0094.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.947] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf")) returned 1
	[0094.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73
	[0094.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73
	[0094.948] lstrlenW (lpString=".doc") returned 4
	[0094.948] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0094.948] lstrlenW (lpString=".docx") returned 5
	[0094.948] lstrcmpiW (lpString1=".docx", lpString2="C.INF") returned -1
	[0094.948] lstrlenW (lpString=".pdf") returned 4
	[0094.948] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0094.948] lstrlenW (lpString=".xls") returned 4
	[0094.948] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0094.948] lstrlenW (lpString=".xlsx") returned 5
	[0094.948] lstrcmpiW (lpString1=".xlsx", lpString2="C.INF") returned -1
	[0094.948] lstrlenW (lpString=".ppt") returned 4
	[0094.948] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0094.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73
	[0094.948] lstrlenW (lpString=".zip") returned 4
	[0094.948] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0094.948] lstrlenW (lpString=".rar") returned 4
	[0094.948] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0094.948] lstrlenW (lpString=".bz2") returned 4
	[0094.948] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0094.948] lstrlenW (lpString=".7z") returned 3
	[0094.948] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0094.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73
	[0094.948] lstrlenW (lpString=".dbf") returned 4
	[0094.949] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0094.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73
	[0094.949] lstrlenW (lpString=".1cd") returned 4
	[0094.949] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0094.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73
	[0094.949] lstrlenW (lpString=".jpg") returned 4
	[0094.949] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0094.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73
	[0094.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73
	[0094.949] lstrlenW (lpString=".doc") returned 4
	[0094.949] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0094.949] lstrlenW (lpString=".docx") returned 5
	[0094.949] lstrcmpiW (lpString1=".docx", lpString2="C.INF") returned -1
	[0094.949] lstrlenW (lpString=".pdf") returned 4
	[0094.949] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0094.949] lstrlenW (lpString=".xls") returned 4
	[0094.949] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0094.949] lstrlenW (lpString=".xlsx") returned 5
	[0094.949] lstrcmpiW (lpString1=".xlsx", lpString2="C.INF") returned -1
	[0094.949] lstrlenW (lpString=".ppt") returned 4
	[0094.949] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0094.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73
	[0094.949] lstrlenW (lpString=".zip") returned 4
	[0094.949] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0094.949] lstrlenW (lpString=".rar") returned 4
	[0094.949] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0094.949] lstrlenW (lpString=".bz2") returned 4
	[0094.950] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0094.950] lstrlenW (lpString=".7z") returned 3
	[0094.950] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0094.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73
	[0094.950] lstrlenW (lpString=".dbf") returned 4
	[0094.950] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0094.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73
	[0094.950] lstrlenW (lpString=".1cd") returned 4
	[0094.950] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0094.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73
	[0094.950] lstrlenW (lpString=".jpg") returned 4
	[0094.950] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0094.950] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0094.950] lstrlenW (lpString="AXIS.ELM") returned 8
	[0094.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0094.951] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=100798) returned 1
	[0094.951] CloseHandle (hObject=0x198) returned 1
	[0094.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm")) returned 0x20
	[0094.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0094.952] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.952] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0094.953] GetLastError () returned 0x0
	[0094.953] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x189be, lpOverlapped=0x0) returned 1
	[0095.059] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x189c0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x189c0, lpOverlapped=0x0) returned 1
	[0095.062] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.062] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0095.062] SetEndOfFile (hFile=0x19c) returned 1
	[0095.062] CloseHandle (hObject=0x19c) returned 1
	[0095.062] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.062] SetEndOfFile (hFile=0x198) returned 1
	[0095.064] CloseHandle (hObject=0x198) returned 1
	[0095.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.065] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm")) returned 1
	[0095.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69
	[0095.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69
	[0095.065] lstrlenW (lpString=".doc") returned 4
	[0095.065] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.065] lstrlenW (lpString=".docx") returned 5
	[0095.065] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1
	[0095.065] lstrlenW (lpString=".pdf") returned 4
	[0095.065] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.065] lstrlenW (lpString=".xls") returned 4
	[0095.065] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.065] lstrlenW (lpString=".xlsx") returned 5
	[0095.065] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1
	[0095.065] lstrlenW (lpString=".ppt") returned 4
	[0095.065] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69
	[0095.065] lstrlenW (lpString=".zip") returned 4
	[0095.065] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.066] lstrlenW (lpString=".rar") returned 4
	[0095.066] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.066] lstrlenW (lpString=".bz2") returned 4
	[0095.066] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.066] lstrlenW (lpString=".7z") returned 3
	[0095.066] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69
	[0095.066] lstrlenW (lpString=".dbf") returned 4
	[0095.066] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69
	[0095.066] lstrlenW (lpString=".1cd") returned 4
	[0095.066] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69
	[0095.066] lstrlenW (lpString=".jpg") returned 4
	[0095.066] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69
	[0095.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69
	[0095.066] lstrlenW (lpString=".doc") returned 4
	[0095.066] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.066] lstrlenW (lpString=".docx") returned 5
	[0095.066] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1
	[0095.066] lstrlenW (lpString=".pdf") returned 4
	[0095.066] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.066] lstrlenW (lpString=".xls") returned 4
	[0095.067] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.067] lstrlenW (lpString=".xlsx") returned 5
	[0095.067] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1
	[0095.067] lstrlenW (lpString=".ppt") returned 4
	[0095.067] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69
	[0095.067] lstrlenW (lpString=".zip") returned 4
	[0095.067] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.067] lstrlenW (lpString=".rar") returned 4
	[0095.067] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.067] lstrlenW (lpString=".bz2") returned 4
	[0095.067] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.067] lstrlenW (lpString=".7z") returned 3
	[0095.067] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69
	[0095.067] lstrlenW (lpString=".dbf") returned 4
	[0095.067] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69
	[0095.067] lstrlenW (lpString=".1cd") returned 4
	[0095.067] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69
	[0095.067] lstrlenW (lpString=".jpg") returned 4
	[0095.067] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.068] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.068] lstrlenW (lpString="BLENDS.INF") returned 10
	[0095.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.087] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=534) returned 1
	[0095.087] CloseHandle (hObject=0x19c) returned 1
	[0095.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf")) returned 0x20
	[0095.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.088] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.088] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0095.089] GetLastError () returned 0x0
	[0095.089] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x216, lpOverlapped=0x0) returned 1
	[0095.090] WriteFile (in: hFile=0x194, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x220, lpOverlapped=0x0) returned 1
	[0095.094] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.094] WriteFile (in: hFile=0x194, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0095.094] SetEndOfFile (hFile=0x194) returned 1
	[0095.094] CloseHandle (hObject=0x194) returned 1
	[0095.095] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.095] SetEndOfFile (hFile=0x19c) returned 1
	[0095.096] CloseHandle (hObject=0x19c) returned 1
	[0095.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.096] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf")) returned 1
	[0095.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73
	[0095.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73
	[0095.096] lstrlenW (lpString=".doc") returned 4
	[0095.096] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.096] lstrlenW (lpString=".docx") returned 5
	[0095.096] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0095.097] lstrlenW (lpString=".pdf") returned 4
	[0095.097] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.097] lstrlenW (lpString=".xls") returned 4
	[0095.097] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.097] lstrlenW (lpString=".xlsx") returned 5
	[0095.097] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0095.097] lstrlenW (lpString=".ppt") returned 4
	[0095.097] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73
	[0095.097] lstrlenW (lpString=".zip") returned 4
	[0095.097] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.097] lstrlenW (lpString=".rar") returned 4
	[0095.097] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.097] lstrlenW (lpString=".bz2") returned 4
	[0095.097] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.097] lstrlenW (lpString=".7z") returned 3
	[0095.097] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73
	[0095.097] lstrlenW (lpString=".dbf") returned 4
	[0095.097] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73
	[0095.097] lstrlenW (lpString=".1cd") returned 4
	[0095.097] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73
	[0095.097] lstrlenW (lpString=".jpg") returned 4
	[0095.097] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73
	[0095.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73
	[0095.098] lstrlenW (lpString=".doc") returned 4
	[0095.098] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.098] lstrlenW (lpString=".docx") returned 5
	[0095.098] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0095.098] lstrlenW (lpString=".pdf") returned 4
	[0095.098] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.098] lstrlenW (lpString=".xls") returned 4
	[0095.098] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.098] lstrlenW (lpString=".xlsx") returned 5
	[0095.098] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0095.098] lstrlenW (lpString=".ppt") returned 4
	[0095.098] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73
	[0095.098] lstrlenW (lpString=".zip") returned 4
	[0095.098] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.098] lstrlenW (lpString=".rar") returned 4
	[0095.098] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.098] lstrlenW (lpString=".bz2") returned 4
	[0095.098] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.098] lstrlenW (lpString=".7z") returned 3
	[0095.098] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73
	[0095.098] lstrlenW (lpString=".dbf") returned 4
	[0095.098] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73
	[0095.099] lstrlenW (lpString=".1cd") returned 4
	[0095.099] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73
	[0095.099] lstrlenW (lpString=".jpg") returned 4
	[0095.099] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.099] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.099] lstrlenW (lpString="BLUECALM.INF") returned 12
	[0095.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.100] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=551) returned 1
	[0095.100] CloseHandle (hObject=0x19c) returned 1
	[0095.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf")) returned 0x20
	[0095.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.101] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.101] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0095.101] GetLastError () returned 0x0
	[0095.101] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x227, lpOverlapped=0x0) returned 1
	[0095.102] WriteFile (in: hFile=0x194, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x230, lpOverlapped=0x0) returned 1
	[0095.104] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.104] WriteFile (in: hFile=0x194, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.104] SetEndOfFile (hFile=0x194) returned 1
	[0095.104] CloseHandle (hObject=0x194) returned 1
	[0095.104] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.104] SetEndOfFile (hFile=0x19c) returned 1
	[0095.105] CloseHandle (hObject=0x19c) returned 1
	[0095.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.106] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf")) returned 1
	[0095.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77
	[0095.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77
	[0095.106] lstrlenW (lpString=".doc") returned 4
	[0095.106] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.106] lstrlenW (lpString=".docx") returned 5
	[0095.106] lstrcmpiW (lpString1=".docx", lpString2="M.INF") returned -1
	[0095.106] lstrlenW (lpString=".pdf") returned 4
	[0095.106] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.106] lstrlenW (lpString=".xls") returned 4
	[0095.106] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.106] lstrlenW (lpString=".xlsx") returned 5
	[0095.106] lstrcmpiW (lpString1=".xlsx", lpString2="M.INF") returned -1
	[0095.106] lstrlenW (lpString=".ppt") returned 4
	[0095.106] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77
	[0095.106] lstrlenW (lpString=".zip") returned 4
	[0095.106] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.106] lstrlenW (lpString=".rar") returned 4
	[0095.107] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.107] lstrlenW (lpString=".bz2") returned 4
	[0095.107] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.107] lstrlenW (lpString=".7z") returned 3
	[0095.107] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77
	[0095.107] lstrlenW (lpString=".dbf") returned 4
	[0095.107] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77
	[0095.107] lstrlenW (lpString=".1cd") returned 4
	[0095.107] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77
	[0095.107] lstrlenW (lpString=".jpg") returned 4
	[0095.107] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77
	[0095.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77
	[0095.107] lstrlenW (lpString=".doc") returned 4
	[0095.107] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.107] lstrlenW (lpString=".docx") returned 5
	[0095.107] lstrcmpiW (lpString1=".docx", lpString2="M.INF") returned -1
	[0095.107] lstrlenW (lpString=".pdf") returned 4
	[0095.107] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.107] lstrlenW (lpString=".xls") returned 4
	[0095.107] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.107] lstrlenW (lpString=".xlsx") returned 5
	[0095.107] lstrcmpiW (lpString1=".xlsx", lpString2="M.INF") returned -1
	[0095.107] lstrlenW (lpString=".ppt") returned 4
	[0095.108] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77
	[0095.108] lstrlenW (lpString=".zip") returned 4
	[0095.108] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.108] lstrlenW (lpString=".rar") returned 4
	[0095.108] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.108] lstrlenW (lpString=".bz2") returned 4
	[0095.108] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.108] lstrlenW (lpString=".7z") returned 3
	[0095.108] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77
	[0095.108] lstrlenW (lpString=".dbf") returned 4
	[0095.108] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77
	[0095.108] lstrlenW (lpString=".1cd") returned 4
	[0095.108] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77
	[0095.108] lstrlenW (lpString=".jpg") returned 4
	[0095.108] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.108] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.108] lstrlenW (lpString="BLUEPRNT.ELM") returned 12
	[0095.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.109] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=55942) returned 1
	[0095.109] CloseHandle (hObject=0x19c) returned 1
	[0095.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm")) returned 0x20
	[0095.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.110] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.110] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0095.112] GetLastError () returned 0x0
	[0095.112] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xda86, lpOverlapped=0x0) returned 1
	[0095.126] WriteFile (in: hFile=0x194, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xda90, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xda90, lpOverlapped=0x0) returned 1
	[0095.128] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.128] WriteFile (in: hFile=0x194, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.128] SetEndOfFile (hFile=0x194) returned 1
	[0095.129] CloseHandle (hObject=0x194) returned 1
	[0095.129] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.129] SetEndOfFile (hFile=0x19c) returned 1
	[0095.130] CloseHandle (hObject=0x19c) returned 1
	[0095.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.131] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm")) returned 1
	[0095.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77
	[0095.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77
	[0095.132] lstrlenW (lpString=".doc") returned 4
	[0095.132] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.132] lstrlenW (lpString=".docx") returned 5
	[0095.132] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1
	[0095.132] lstrlenW (lpString=".pdf") returned 4
	[0095.132] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.132] lstrlenW (lpString=".xls") returned 4
	[0095.132] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.132] lstrlenW (lpString=".xlsx") returned 5
	[0095.132] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1
	[0095.132] lstrlenW (lpString=".ppt") returned 4
	[0095.132] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77
	[0095.132] lstrlenW (lpString=".zip") returned 4
	[0095.132] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.132] lstrlenW (lpString=".rar") returned 4
	[0095.133] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.133] lstrlenW (lpString=".bz2") returned 4
	[0095.133] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.133] lstrlenW (lpString=".7z") returned 3
	[0095.133] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77
	[0095.133] lstrlenW (lpString=".dbf") returned 4
	[0095.133] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77
	[0095.133] lstrlenW (lpString=".1cd") returned 4
	[0095.133] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77
	[0095.133] lstrlenW (lpString=".jpg") returned 4
	[0095.133] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77
	[0095.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77
	[0095.133] lstrlenW (lpString=".doc") returned 4
	[0095.133] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.133] lstrlenW (lpString=".docx") returned 5
	[0095.133] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1
	[0095.133] lstrlenW (lpString=".pdf") returned 4
	[0095.133] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.133] lstrlenW (lpString=".xls") returned 4
	[0095.133] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.133] lstrlenW (lpString=".xlsx") returned 5
	[0095.134] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1
	[0095.134] lstrlenW (lpString=".ppt") returned 4
	[0095.134] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77
	[0095.134] lstrlenW (lpString=".zip") returned 4
	[0095.134] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.134] lstrlenW (lpString=".rar") returned 4
	[0095.134] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.134] lstrlenW (lpString=".bz2") returned 4
	[0095.134] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.134] lstrlenW (lpString=".7z") returned 3
	[0095.134] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77
	[0095.134] lstrlenW (lpString=".dbf") returned 4
	[0095.134] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77
	[0095.134] lstrlenW (lpString=".1cd") returned 4
	[0095.134] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77
	[0095.134] lstrlenW (lpString=".jpg") returned 4
	[0095.134] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.134] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.135] lstrlenW (lpString="BOLDSTRI.ELM") returned 12
	[0095.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.135] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=60154) returned 1
	[0095.135] CloseHandle (hObject=0x19c) returned 1
	[0095.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 0x20
	[0095.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.136] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.136] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0095.137] GetLastError () returned 0x0
	[0095.137] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xeafa, lpOverlapped=0x0) returned 1
	[0095.168] WriteFile (in: hFile=0x194, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xeb00, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xeb00, lpOverlapped=0x0) returned 1
	[0095.170] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.170] WriteFile (in: hFile=0x194, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.170] SetEndOfFile (hFile=0x194) returned 1
	[0095.171] CloseHandle (hObject=0x194) returned 1
	[0095.171] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.171] SetEndOfFile (hFile=0x19c) returned 1
	[0095.172] CloseHandle (hObject=0x19c) returned 1
	[0095.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.173] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 1
	[0095.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77
	[0095.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77
	[0095.173] lstrlenW (lpString=".doc") returned 4
	[0095.173] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.173] lstrlenW (lpString=".docx") returned 5
	[0095.173] lstrcmpiW (lpString1=".docx", lpString2="I.ELM") returned -1
	[0095.173] lstrlenW (lpString=".pdf") returned 4
	[0095.173] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.173] lstrlenW (lpString=".xls") returned 4
	[0095.173] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.173] lstrlenW (lpString=".xlsx") returned 5
	[0095.174] lstrcmpiW (lpString1=".xlsx", lpString2="I.ELM") returned -1
	[0095.174] lstrlenW (lpString=".ppt") returned 4
	[0095.174] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77
	[0095.174] lstrlenW (lpString=".zip") returned 4
	[0095.174] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.174] lstrlenW (lpString=".rar") returned 4
	[0095.174] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.174] lstrlenW (lpString=".bz2") returned 4
	[0095.174] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.174] lstrlenW (lpString=".7z") returned 3
	[0095.174] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77
	[0095.174] lstrlenW (lpString=".dbf") returned 4
	[0095.174] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77
	[0095.174] lstrlenW (lpString=".1cd") returned 4
	[0095.174] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77
	[0095.174] lstrlenW (lpString=".jpg") returned 4
	[0095.174] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77
	[0095.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77
	[0095.174] lstrlenW (lpString=".doc") returned 4
	[0095.174] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.175] lstrlenW (lpString=".docx") returned 5
	[0095.175] lstrcmpiW (lpString1=".docx", lpString2="I.ELM") returned -1
	[0095.175] lstrlenW (lpString=".pdf") returned 4
	[0095.175] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.175] lstrlenW (lpString=".xls") returned 4
	[0095.175] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.175] lstrlenW (lpString=".xlsx") returned 5
	[0095.175] lstrcmpiW (lpString1=".xlsx", lpString2="I.ELM") returned -1
	[0095.175] lstrlenW (lpString=".ppt") returned 4
	[0095.175] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77
	[0095.175] lstrlenW (lpString=".zip") returned 4
	[0095.175] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.175] lstrlenW (lpString=".rar") returned 4
	[0095.175] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.175] lstrlenW (lpString=".bz2") returned 4
	[0095.175] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.175] lstrlenW (lpString=".7z") returned 3
	[0095.175] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77
	[0095.175] lstrlenW (lpString=".dbf") returned 4
	[0095.176] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77
	[0095.176] lstrlenW (lpString=".1cd") returned 4
	[0095.176] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77
	[0095.176] lstrlenW (lpString=".jpg") returned 4
	[0095.176] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.176] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.176] lstrlenW (lpString="BREEZE.INF") returned 10
	[0095.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.215] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=450) returned 1
	[0095.215] CloseHandle (hObject=0x1a0) returned 1
	[0095.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf")) returned 0x20
	[0095.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.216] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.216] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.216] GetLastError () returned 0x0
	[0095.216] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x1c2, lpOverlapped=0x0) returned 1
	[0095.217] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x1d0, lpOverlapped=0x0) returned 1
	[0095.219] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.219] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0095.219] SetEndOfFile (hFile=0x19c) returned 1
	[0095.219] CloseHandle (hObject=0x19c) returned 1
	[0095.219] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.219] SetEndOfFile (hFile=0x1a0) returned 1
	[0095.220] CloseHandle (hObject=0x1a0) returned 1
	[0095.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.220] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf")) returned 1
	[0095.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73
	[0095.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73
	[0095.220] lstrlenW (lpString=".doc") returned 4
	[0095.220] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.221] lstrlenW (lpString=".docx") returned 5
	[0095.221] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.221] lstrlenW (lpString=".pdf") returned 4
	[0095.221] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.221] lstrlenW (lpString=".xls") returned 4
	[0095.221] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.221] lstrlenW (lpString=".xlsx") returned 5
	[0095.221] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.221] lstrlenW (lpString=".ppt") returned 4
	[0095.221] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73
	[0095.221] lstrlenW (lpString=".zip") returned 4
	[0095.221] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.221] lstrlenW (lpString=".rar") returned 4
	[0095.221] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.221] lstrlenW (lpString=".bz2") returned 4
	[0095.221] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.221] lstrlenW (lpString=".7z") returned 3
	[0095.221] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73
	[0095.221] lstrlenW (lpString=".dbf") returned 4
	[0095.221] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73
	[0095.221] lstrlenW (lpString=".1cd") returned 4
	[0095.221] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73
	[0095.221] lstrlenW (lpString=".jpg") returned 4
	[0095.221] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73
	[0095.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73
	[0095.221] lstrlenW (lpString=".doc") returned 4
	[0095.221] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.221] lstrlenW (lpString=".docx") returned 5
	[0095.222] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.222] lstrlenW (lpString=".pdf") returned 4
	[0095.222] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.222] lstrlenW (lpString=".xls") returned 4
	[0095.222] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.222] lstrlenW (lpString=".xlsx") returned 5
	[0095.222] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.222] lstrlenW (lpString=".ppt") returned 4
	[0095.222] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73
	[0095.222] lstrlenW (lpString=".zip") returned 4
	[0095.222] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.222] lstrlenW (lpString=".rar") returned 4
	[0095.222] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.222] lstrlenW (lpString=".bz2") returned 4
	[0095.222] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.222] lstrlenW (lpString=".7z") returned 3
	[0095.222] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73
	[0095.222] lstrlenW (lpString=".dbf") returned 4
	[0095.222] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73
	[0095.222] lstrlenW (lpString=".1cd") returned 4
	[0095.222] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73
	[0095.222] lstrlenW (lpString=".jpg") returned 4
	[0095.222] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.222] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.223] lstrlenW (lpString="CASCADE.ELM") returned 11
	[0095.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.223] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=47684) returned 1
	[0095.223] CloseHandle (hObject=0x1a0) returned 1
	[0095.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm")) returned 0x20
	[0095.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.224] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.224] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.224] GetLastError () returned 0x0
	[0095.224] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xba44, lpOverlapped=0x0) returned 1
	[0095.243] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xba50, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xba50, lpOverlapped=0x0) returned 1
	[0095.245] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.245] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.245] SetEndOfFile (hFile=0x19c) returned 1
	[0095.245] CloseHandle (hObject=0x19c) returned 1
	[0095.246] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.246] SetEndOfFile (hFile=0x1a0) returned 1
	[0095.247] CloseHandle (hObject=0x1a0) returned 1
	[0095.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.247] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm")) returned 1
	[0095.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75
	[0095.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75
	[0095.247] lstrlenW (lpString=".doc") returned 4
	[0095.247] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.247] lstrlenW (lpString=".docx") returned 5
	[0095.248] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.248] lstrlenW (lpString=".pdf") returned 4
	[0095.248] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.248] lstrlenW (lpString=".xls") returned 4
	[0095.248] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.248] lstrlenW (lpString=".xlsx") returned 5
	[0095.248] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.248] lstrlenW (lpString=".ppt") returned 4
	[0095.248] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75
	[0095.248] lstrlenW (lpString=".zip") returned 4
	[0095.248] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.248] lstrlenW (lpString=".rar") returned 4
	[0095.248] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.248] lstrlenW (lpString=".bz2") returned 4
	[0095.248] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.248] lstrlenW (lpString=".7z") returned 3
	[0095.248] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75
	[0095.248] lstrlenW (lpString=".dbf") returned 4
	[0095.248] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75
	[0095.248] lstrlenW (lpString=".1cd") returned 4
	[0095.248] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75
	[0095.248] lstrlenW (lpString=".jpg") returned 4
	[0095.248] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75
	[0095.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75
	[0095.249] lstrlenW (lpString=".doc") returned 4
	[0095.249] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.249] lstrlenW (lpString=".docx") returned 5
	[0095.249] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.249] lstrlenW (lpString=".pdf") returned 4
	[0095.249] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.249] lstrlenW (lpString=".xls") returned 4
	[0095.249] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.249] lstrlenW (lpString=".xlsx") returned 5
	[0095.249] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.249] lstrlenW (lpString=".ppt") returned 4
	[0095.249] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75
	[0095.249] lstrlenW (lpString=".zip") returned 4
	[0095.249] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.249] lstrlenW (lpString=".rar") returned 4
	[0095.249] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.249] lstrlenW (lpString=".bz2") returned 4
	[0095.249] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.249] lstrlenW (lpString=".7z") returned 3
	[0095.249] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75
	[0095.249] lstrlenW (lpString=".dbf") returned 4
	[0095.250] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75
	[0095.250] lstrlenW (lpString=".1cd") returned 4
	[0095.250] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75
	[0095.250] lstrlenW (lpString=".jpg") returned 4
	[0095.250] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.250] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.251] lstrlenW (lpString="COMPASS.INF") returned 11
	[0095.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.258] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=486) returned 1
	[0095.258] CloseHandle (hObject=0x19c) returned 1
	[0095.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf")) returned 0x20
	[0095.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.274] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.274] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.281] GetLastError () returned 0x0
	[0095.281] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x1e6, lpOverlapped=0x0) returned 1
	[0095.283] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x1f0, lpOverlapped=0x0) returned 1
	[0095.284] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.284] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.284] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.296] CloseHandle (hObject=0x1c8) returned 1
	[0095.325] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.325] SetEndOfFile (hFile=0x190) returned 1
	[0095.326] CloseHandle (hObject=0x190) returned 1
	[0095.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.326] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf")) returned 1
	[0095.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75
	[0095.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75
	[0095.326] lstrlenW (lpString=".doc") returned 4
	[0095.326] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.326] lstrlenW (lpString=".docx") returned 5
	[0095.326] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0095.327] lstrlenW (lpString=".pdf") returned 4
	[0095.327] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.327] lstrlenW (lpString=".xls") returned 4
	[0095.327] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.327] lstrlenW (lpString=".xlsx") returned 5
	[0095.327] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0095.327] lstrlenW (lpString=".ppt") returned 4
	[0095.327] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75
	[0095.327] lstrlenW (lpString=".zip") returned 4
	[0095.327] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.327] lstrlenW (lpString=".rar") returned 4
	[0095.327] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.327] lstrlenW (lpString=".bz2") returned 4
	[0095.327] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.327] lstrlenW (lpString=".7z") returned 3
	[0095.327] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75
	[0095.327] lstrlenW (lpString=".dbf") returned 4
	[0095.327] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75
	[0095.327] lstrlenW (lpString=".1cd") returned 4
	[0095.327] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75
	[0095.327] lstrlenW (lpString=".jpg") returned 4
	[0095.327] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75
	[0095.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75
	[0095.327] lstrlenW (lpString=".doc") returned 4
	[0095.327] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.327] lstrlenW (lpString=".docx") returned 5
	[0095.327] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0095.328] lstrlenW (lpString=".pdf") returned 4
	[0095.328] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.328] lstrlenW (lpString=".xls") returned 4
	[0095.328] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.328] lstrlenW (lpString=".xlsx") returned 5
	[0095.328] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0095.328] lstrlenW (lpString=".ppt") returned 4
	[0095.328] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75
	[0095.328] lstrlenW (lpString=".zip") returned 4
	[0095.328] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.328] lstrlenW (lpString=".rar") returned 4
	[0095.328] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.328] lstrlenW (lpString=".bz2") returned 4
	[0095.328] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.328] lstrlenW (lpString=".7z") returned 3
	[0095.328] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75
	[0095.328] lstrlenW (lpString=".dbf") returned 4
	[0095.328] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75
	[0095.328] lstrlenW (lpString=".1cd") returned 4
	[0095.328] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75
	[0095.328] lstrlenW (lpString=".jpg") returned 4
	[0095.328] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.328] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.328] lstrlenW (lpString="DEEPBLUE.ELM") returned 12
	[0095.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.329] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=71388) returned 1
	[0095.329] CloseHandle (hObject=0x190) returned 1
	[0095.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm")) returned 0x20
	[0095.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.330] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.330] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.330] GetLastError () returned 0x0
	[0095.330] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x116dc, lpOverlapped=0x0) returned 1
	[0095.399] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x116e0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x116e0, lpOverlapped=0x0) returned 1
	[0095.401] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.402] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.402] SetEndOfFile (hFile=0x1a0) returned 1
	[0095.402] CloseHandle (hObject=0x1a0) returned 1
	[0095.402] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.402] SetEndOfFile (hFile=0x190) returned 1
	[0095.403] CloseHandle (hObject=0x190) returned 1
	[0095.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.404] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm")) returned 1
	[0095.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77
	[0095.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77
	[0095.404] lstrlenW (lpString=".doc") returned 4
	[0095.404] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.404] lstrlenW (lpString=".docx") returned 5
	[0095.404] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.404] lstrlenW (lpString=".pdf") returned 4
	[0095.404] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.404] lstrlenW (lpString=".xls") returned 4
	[0095.404] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.404] lstrlenW (lpString=".xlsx") returned 5
	[0095.404] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.404] lstrlenW (lpString=".ppt") returned 4
	[0095.404] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77
	[0095.404] lstrlenW (lpString=".zip") returned 4
	[0095.404] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.404] lstrlenW (lpString=".rar") returned 4
	[0095.405] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.405] lstrlenW (lpString=".bz2") returned 4
	[0095.405] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.405] lstrlenW (lpString=".7z") returned 3
	[0095.405] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77
	[0095.405] lstrlenW (lpString=".dbf") returned 4
	[0095.405] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77
	[0095.405] lstrlenW (lpString=".1cd") returned 4
	[0095.405] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77
	[0095.405] lstrlenW (lpString=".jpg") returned 4
	[0095.405] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77
	[0095.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77
	[0095.405] lstrlenW (lpString=".doc") returned 4
	[0095.405] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.405] lstrlenW (lpString=".docx") returned 5
	[0095.405] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.405] lstrlenW (lpString=".pdf") returned 4
	[0095.405] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.405] lstrlenW (lpString=".xls") returned 4
	[0095.405] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.405] lstrlenW (lpString=".xlsx") returned 5
	[0095.405] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.405] lstrlenW (lpString=".ppt") returned 4
	[0095.405] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77
	[0095.405] lstrlenW (lpString=".zip") returned 4
	[0095.405] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.406] lstrlenW (lpString=".rar") returned 4
	[0095.406] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.406] lstrlenW (lpString=".bz2") returned 4
	[0095.406] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.406] lstrlenW (lpString=".7z") returned 3
	[0095.406] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77
	[0095.406] lstrlenW (lpString=".dbf") returned 4
	[0095.406] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77
	[0095.406] lstrlenW (lpString=".1cd") returned 4
	[0095.406] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77
	[0095.406] lstrlenW (lpString=".jpg") returned 4
	[0095.406] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.406] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.406] lstrlenW (lpString="EDGE.INF") returned 8
	[0095.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.407] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=529) returned 1
	[0095.407] CloseHandle (hObject=0x190) returned 1
	[0095.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf")) returned 0x20
	[0095.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.407] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.408] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.408] GetLastError () returned 0x0
	[0095.408] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x211, lpOverlapped=0x0) returned 1
	[0095.409] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x220, lpOverlapped=0x0) returned 1
	[0095.410] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.410] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0095.410] SetEndOfFile (hFile=0x1a0) returned 1
	[0095.410] CloseHandle (hObject=0x1a0) returned 1
	[0095.410] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.411] SetEndOfFile (hFile=0x190) returned 1
	[0095.411] CloseHandle (hObject=0x190) returned 1
	[0095.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.412] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf")) returned 1
	[0095.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69
	[0095.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69
	[0095.412] lstrlenW (lpString=".doc") returned 4
	[0095.412] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.412] lstrlenW (lpString=".docx") returned 5
	[0095.412] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.412] lstrlenW (lpString=".pdf") returned 4
	[0095.412] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.412] lstrlenW (lpString=".xls") returned 4
	[0095.412] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.412] lstrlenW (lpString=".xlsx") returned 5
	[0095.412] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.412] lstrlenW (lpString=".ppt") returned 4
	[0095.412] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69
	[0095.412] lstrlenW (lpString=".zip") returned 4
	[0095.412] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.412] lstrlenW (lpString=".rar") returned 4
	[0095.412] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.412] lstrlenW (lpString=".bz2") returned 4
	[0095.412] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.412] lstrlenW (lpString=".7z") returned 3
	[0095.412] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69
	[0095.412] lstrlenW (lpString=".dbf") returned 4
	[0095.412] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69
	[0095.413] lstrlenW (lpString=".1cd") returned 4
	[0095.413] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69
	[0095.413] lstrlenW (lpString=".jpg") returned 4
	[0095.413] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69
	[0095.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69
	[0095.413] lstrlenW (lpString=".doc") returned 4
	[0095.413] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.413] lstrlenW (lpString=".docx") returned 5
	[0095.413] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.413] lstrlenW (lpString=".pdf") returned 4
	[0095.413] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.413] lstrlenW (lpString=".xls") returned 4
	[0095.413] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.413] lstrlenW (lpString=".xlsx") returned 5
	[0095.413] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.413] lstrlenW (lpString=".ppt") returned 4
	[0095.413] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69
	[0095.413] lstrlenW (lpString=".zip") returned 4
	[0095.413] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.413] lstrlenW (lpString=".rar") returned 4
	[0095.413] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.413] lstrlenW (lpString=".bz2") returned 4
	[0095.413] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.413] lstrlenW (lpString=".7z") returned 3
	[0095.413] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69
	[0095.413] lstrlenW (lpString=".dbf") returned 4
	[0095.413] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69
	[0095.413] lstrlenW (lpString=".1cd") returned 4
	[0095.414] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69
	[0095.414] lstrlenW (lpString=".jpg") returned 4
	[0095.414] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.414] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.414] lstrlenW (lpString="EVRGREEN.ELM") returned 12
	[0095.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.414] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=77294) returned 1
	[0095.414] CloseHandle (hObject=0x190) returned 1
	[0095.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm")) returned 0x20
	[0095.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.415] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.415] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.415] GetLastError () returned 0x0
	[0095.416] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x12dee, lpOverlapped=0x0) returned 1
	[0095.432] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x12df0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x12df0, lpOverlapped=0x0) returned 1
	[0095.434] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.434] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.434] SetEndOfFile (hFile=0x1a0) returned 1
	[0095.434] CloseHandle (hObject=0x1a0) returned 1
	[0095.435] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.435] SetEndOfFile (hFile=0x190) returned 1
	[0095.436] CloseHandle (hObject=0x190) returned 1
	[0095.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.436] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm")) returned 1
	[0095.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77
	[0095.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77
	[0095.453] lstrlenW (lpString=".doc") returned 4
	[0095.453] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.453] lstrlenW (lpString=".docx") returned 5
	[0095.453] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1
	[0095.453] lstrlenW (lpString=".pdf") returned 4
	[0095.453] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.453] lstrlenW (lpString=".xls") returned 4
	[0095.453] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.453] lstrlenW (lpString=".xlsx") returned 5
	[0095.453] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1
	[0095.453] lstrlenW (lpString=".ppt") returned 4
	[0095.453] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77
	[0095.453] lstrlenW (lpString=".zip") returned 4
	[0095.453] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.453] lstrlenW (lpString=".rar") returned 4
	[0095.453] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.453] lstrlenW (lpString=".bz2") returned 4
	[0095.453] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.453] lstrlenW (lpString=".7z") returned 3
	[0095.453] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77
	[0095.453] lstrlenW (lpString=".dbf") returned 4
	[0095.453] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77
	[0095.453] lstrlenW (lpString=".1cd") returned 4
	[0095.453] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77
	[0095.453] lstrlenW (lpString=".jpg") returned 4
	[0095.453] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77
	[0095.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77
	[0095.454] lstrlenW (lpString=".doc") returned 4
	[0095.454] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.454] lstrlenW (lpString=".docx") returned 5
	[0095.454] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1
	[0095.454] lstrlenW (lpString=".pdf") returned 4
	[0095.454] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.454] lstrlenW (lpString=".xls") returned 4
	[0095.454] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.454] lstrlenW (lpString=".xlsx") returned 5
	[0095.454] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1
	[0095.454] lstrlenW (lpString=".ppt") returned 4
	[0095.454] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77
	[0095.454] lstrlenW (lpString=".zip") returned 4
	[0095.454] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.454] lstrlenW (lpString=".rar") returned 4
	[0095.454] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.454] lstrlenW (lpString=".bz2") returned 4
	[0095.454] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.454] lstrlenW (lpString=".7z") returned 3
	[0095.454] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77
	[0095.454] lstrlenW (lpString=".dbf") returned 4
	[0095.454] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77
	[0095.454] lstrlenW (lpString=".1cd") returned 4
	[0095.454] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77
	[0095.454] lstrlenW (lpString=".jpg") returned 4
	[0095.454] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.455] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.455] lstrlenW (lpString="ICE.ELM") returned 7
	[0095.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.501] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=68048) returned 1
	[0095.501] CloseHandle (hObject=0x188) returned 1
	[0095.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm")) returned 0x20
	[0095.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.512] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.512] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.517] GetLastError () returned 0x0
	[0095.517] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x109d0, lpOverlapped=0x0) returned 1
	[0095.531] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x109e0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x109e0, lpOverlapped=0x0) returned 1
	[0095.534] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.534] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0095.534] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.534] CloseHandle (hObject=0x1c8) returned 1
	[0095.535] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.535] SetEndOfFile (hFile=0x190) returned 1
	[0095.536] CloseHandle (hObject=0x190) returned 1
	[0095.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.536] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm")) returned 1
	[0095.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67
	[0095.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67
	[0095.537] lstrlenW (lpString=".doc") returned 4
	[0095.537] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.537] lstrlenW (lpString=".docx") returned 5
	[0095.537] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.537] lstrlenW (lpString=".pdf") returned 4
	[0095.537] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.537] lstrlenW (lpString=".xls") returned 4
	[0095.537] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.537] lstrlenW (lpString=".xlsx") returned 5
	[0095.537] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.537] lstrlenW (lpString=".ppt") returned 4
	[0095.537] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67
	[0095.537] lstrlenW (lpString=".zip") returned 4
	[0095.537] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.537] lstrlenW (lpString=".rar") returned 4
	[0095.537] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.537] lstrlenW (lpString=".bz2") returned 4
	[0095.537] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.537] lstrlenW (lpString=".7z") returned 3
	[0095.537] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67
	[0095.537] lstrlenW (lpString=".dbf") returned 4
	[0095.537] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67
	[0095.537] lstrlenW (lpString=".1cd") returned 4
	[0095.537] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67
	[0095.538] lstrlenW (lpString=".jpg") returned 4
	[0095.538] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67
	[0095.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67
	[0095.538] lstrlenW (lpString=".doc") returned 4
	[0095.538] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.538] lstrlenW (lpString=".docx") returned 5
	[0095.538] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.538] lstrlenW (lpString=".pdf") returned 4
	[0095.538] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.538] lstrlenW (lpString=".xls") returned 4
	[0095.538] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.538] lstrlenW (lpString=".xlsx") returned 5
	[0095.538] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.538] lstrlenW (lpString=".ppt") returned 4
	[0095.538] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67
	[0095.538] lstrlenW (lpString=".zip") returned 4
	[0095.538] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.538] lstrlenW (lpString=".rar") returned 4
	[0095.538] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.538] lstrlenW (lpString=".bz2") returned 4
	[0095.538] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.538] lstrlenW (lpString=".7z") returned 3
	[0095.538] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67
	[0095.538] lstrlenW (lpString=".dbf") returned 4
	[0095.538] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67
	[0095.538] lstrlenW (lpString=".1cd") returned 4
	[0095.538] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67
	[0095.539] lstrlenW (lpString=".jpg") returned 4
	[0095.539] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.539] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.539] lstrlenW (lpString="JOURNAL.INF") returned 11
	[0095.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.573] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=499) returned 1
	[0095.573] CloseHandle (hObject=0x1c8) returned 1
	[0095.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf")) returned 0x20
	[0095.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.698] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.698] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0095.708] GetLastError () returned 0x0
	[0095.708] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x1f3, lpOverlapped=0x0) returned 1
	[0095.709] WriteFile (in: hFile=0x1b4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x200, lpOverlapped=0x0) returned 1
	[0095.710] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.710] WriteFile (in: hFile=0x1b4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.713] SetEndOfFile (hFile=0x1b4) returned 1
	[0095.715] CloseHandle (hObject=0x1b4) returned 1
	[0095.720] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.720] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.721] CloseHandle (hObject=0x1c8) returned 1
	[0095.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.721] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf")) returned 1
	[0095.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75
	[0095.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75
	[0095.721] lstrlenW (lpString=".doc") returned 4
	[0095.721] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.721] lstrlenW (lpString=".docx") returned 5
	[0095.721] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1
	[0095.722] lstrlenW (lpString=".pdf") returned 4
	[0095.722] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.722] lstrlenW (lpString=".xls") returned 4
	[0095.722] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.722] lstrlenW (lpString=".xlsx") returned 5
	[0095.722] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1
	[0095.722] lstrlenW (lpString=".ppt") returned 4
	[0095.722] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75
	[0095.722] lstrlenW (lpString=".zip") returned 4
	[0095.722] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.722] lstrlenW (lpString=".rar") returned 4
	[0095.722] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.722] lstrlenW (lpString=".bz2") returned 4
	[0095.722] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.722] lstrlenW (lpString=".7z") returned 3
	[0095.722] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75
	[0095.722] lstrlenW (lpString=".dbf") returned 4
	[0095.722] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75
	[0095.722] lstrlenW (lpString=".1cd") returned 4
	[0095.722] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75
	[0095.722] lstrlenW (lpString=".jpg") returned 4
	[0095.722] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75
	[0095.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75
	[0095.722] lstrlenW (lpString=".doc") returned 4
	[0095.722] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.722] lstrlenW (lpString=".docx") returned 5
	[0095.722] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1
	[0095.722] lstrlenW (lpString=".pdf") returned 4
	[0095.723] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.723] lstrlenW (lpString=".xls") returned 4
	[0095.723] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.723] lstrlenW (lpString=".xlsx") returned 5
	[0095.723] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1
	[0095.723] lstrlenW (lpString=".ppt") returned 4
	[0095.723] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75
	[0095.723] lstrlenW (lpString=".zip") returned 4
	[0095.723] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.723] lstrlenW (lpString=".rar") returned 4
	[0095.723] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.723] lstrlenW (lpString=".bz2") returned 4
	[0095.723] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.723] lstrlenW (lpString=".7z") returned 3
	[0095.723] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75
	[0095.723] lstrlenW (lpString=".dbf") returned 4
	[0095.723] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75
	[0095.723] lstrlenW (lpString=".1cd") returned 4
	[0095.723] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75
	[0095.723] lstrlenW (lpString=".jpg") returned 4
	[0095.723] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.723] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.723] lstrlenW (lpString="QUAD.ELM") returned 8
	[0095.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.736] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=48039) returned 1
	[0095.736] CloseHandle (hObject=0x1c8) returned 1
	[0095.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm")) returned 0x20
	[0095.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0095.812] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.812] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.822] GetLastError () returned 0x0
	[0095.822] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xbba7, lpOverlapped=0x0) returned 1
	[0095.838] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xbbb0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xbbb0, lpOverlapped=0x0) returned 1
	[0095.840] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.840] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0095.840] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.840] CloseHandle (hObject=0x1c8) returned 1
	[0095.840] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.840] SetEndOfFile (hFile=0x1b4) returned 1
	[0095.841] CloseHandle (hObject=0x1b4) returned 1
	[0095.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.842] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm")) returned 1
	[0095.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69
	[0095.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69
	[0095.842] lstrlenW (lpString=".doc") returned 4
	[0095.842] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.843] lstrlenW (lpString=".docx") returned 5
	[0095.843] lstrcmpiW (lpString1=".docx", lpString2="D.ELM") returned -1
	[0095.843] lstrlenW (lpString=".pdf") returned 4
	[0095.843] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.843] lstrlenW (lpString=".xls") returned 4
	[0095.843] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.843] lstrlenW (lpString=".xlsx") returned 5
	[0095.843] lstrcmpiW (lpString1=".xlsx", lpString2="D.ELM") returned -1
	[0095.843] lstrlenW (lpString=".ppt") returned 4
	[0095.843] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69
	[0095.843] lstrlenW (lpString=".zip") returned 4
	[0095.843] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.843] lstrlenW (lpString=".rar") returned 4
	[0095.843] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.843] lstrlenW (lpString=".bz2") returned 4
	[0095.843] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.843] lstrlenW (lpString=".7z") returned 3
	[0095.843] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69
	[0095.843] lstrlenW (lpString=".dbf") returned 4
	[0095.843] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69
	[0095.843] lstrlenW (lpString=".1cd") returned 4
	[0095.843] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69
	[0095.844] lstrlenW (lpString=".jpg") returned 4
	[0095.844] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69
	[0095.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69
	[0095.844] lstrlenW (lpString=".doc") returned 4
	[0095.844] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.844] lstrlenW (lpString=".docx") returned 5
	[0095.844] lstrcmpiW (lpString1=".docx", lpString2="D.ELM") returned -1
	[0095.844] lstrlenW (lpString=".pdf") returned 4
	[0095.844] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.844] lstrlenW (lpString=".xls") returned 4
	[0095.844] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.844] lstrlenW (lpString=".xlsx") returned 5
	[0095.844] lstrcmpiW (lpString1=".xlsx", lpString2="D.ELM") returned -1
	[0095.844] lstrlenW (lpString=".ppt") returned 4
	[0095.844] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69
	[0095.844] lstrlenW (lpString=".zip") returned 4
	[0095.844] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.844] lstrlenW (lpString=".rar") returned 4
	[0095.844] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.844] lstrlenW (lpString=".bz2") returned 4
	[0095.844] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.844] lstrlenW (lpString=".7z") returned 3
	[0095.844] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69
	[0095.845] lstrlenW (lpString=".dbf") returned 4
	[0095.845] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69
	[0095.845] lstrlenW (lpString=".1cd") returned 4
	[0095.845] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69
	[0095.845] lstrlenW (lpString=".jpg") returned 4
	[0095.845] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.845] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.845] lstrlenW (lpString="RIPPLE.INF") returned 10
	[0095.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0095.846] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=487) returned 1
	[0095.846] CloseHandle (hObject=0x1b4) returned 1
	[0095.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf")) returned 0x20
	[0095.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0095.847] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.847] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.848] GetLastError () returned 0x0
	[0095.848] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x1e7, lpOverlapped=0x0) returned 1
	[0095.849] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x1f0, lpOverlapped=0x0) returned 1
	[0095.850] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.850] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0095.851] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.851] CloseHandle (hObject=0x1c8) returned 1
	[0095.851] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.851] SetEndOfFile (hFile=0x1b4) returned 1
	[0095.852] CloseHandle (hObject=0x1b4) returned 1
	[0095.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.854] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf")) returned 1
	[0095.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73
	[0095.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73
	[0095.854] lstrlenW (lpString=".doc") returned 4
	[0095.854] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.854] lstrlenW (lpString=".docx") returned 5
	[0095.854] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.854] lstrlenW (lpString=".pdf") returned 4
	[0095.854] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.854] lstrlenW (lpString=".xls") returned 4
	[0095.854] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.854] lstrlenW (lpString=".xlsx") returned 5
	[0095.854] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.854] lstrlenW (lpString=".ppt") returned 4
	[0095.854] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73
	[0095.855] lstrlenW (lpString=".zip") returned 4
	[0095.855] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.855] lstrlenW (lpString=".rar") returned 4
	[0095.855] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.855] lstrlenW (lpString=".bz2") returned 4
	[0095.855] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.855] lstrlenW (lpString=".7z") returned 3
	[0095.855] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73
	[0095.855] lstrlenW (lpString=".dbf") returned 4
	[0095.855] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73
	[0095.855] lstrlenW (lpString=".1cd") returned 4
	[0095.855] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73
	[0095.855] lstrlenW (lpString=".jpg") returned 4
	[0095.855] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73
	[0095.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73
	[0095.855] lstrlenW (lpString=".doc") returned 4
	[0095.855] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.855] lstrlenW (lpString=".docx") returned 5
	[0095.855] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.855] lstrlenW (lpString=".pdf") returned 4
	[0095.855] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.855] lstrlenW (lpString=".xls") returned 4
	[0095.856] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.856] lstrlenW (lpString=".xlsx") returned 5
	[0095.856] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.856] lstrlenW (lpString=".ppt") returned 4
	[0095.856] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73
	[0095.856] lstrlenW (lpString=".zip") returned 4
	[0095.856] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.856] lstrlenW (lpString=".rar") returned 4
	[0095.856] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.856] lstrlenW (lpString=".bz2") returned 4
	[0095.856] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.856] lstrlenW (lpString=".7z") returned 3
	[0095.856] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73
	[0095.856] lstrlenW (lpString=".dbf") returned 4
	[0095.856] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73
	[0095.856] lstrlenW (lpString=".1cd") returned 4
	[0095.856] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73
	[0095.856] lstrlenW (lpString=".jpg") returned 4
	[0095.856] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.856] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.857] lstrlenW (lpString="RMNSQUE.ELM") returned 11
	[0095.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0095.857] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=73271) returned 1
	[0095.857] CloseHandle (hObject=0x1b4) returned 1
	[0095.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm")) returned 0x20
	[0095.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0095.858] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.858] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.859] GetLastError () returned 0x0
	[0095.859] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x11e37, lpOverlapped=0x0) returned 1
	[0095.875] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x11e40, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x11e40, lpOverlapped=0x0) returned 1
	[0095.877] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.877] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.877] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.877] CloseHandle (hObject=0x1c8) returned 1
	[0095.878] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.878] SetEndOfFile (hFile=0x1b4) returned 1
	[0095.879] CloseHandle (hObject=0x1b4) returned 1
	[0095.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.880] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm")) returned 1
	[0095.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75
	[0095.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75
	[0095.892] lstrlenW (lpString=".doc") returned 4
	[0095.892] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.892] lstrlenW (lpString=".docx") returned 5
	[0095.892] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.892] lstrlenW (lpString=".pdf") returned 4
	[0095.892] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.892] lstrlenW (lpString=".xls") returned 4
	[0095.892] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.892] lstrlenW (lpString=".xlsx") returned 5
	[0095.892] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.892] lstrlenW (lpString=".ppt") returned 4
	[0095.892] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75
	[0095.892] lstrlenW (lpString=".zip") returned 4
	[0095.893] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.893] lstrlenW (lpString=".rar") returned 4
	[0095.893] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.893] lstrlenW (lpString=".bz2") returned 4
	[0095.893] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.893] lstrlenW (lpString=".7z") returned 3
	[0095.893] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75
	[0095.893] lstrlenW (lpString=".dbf") returned 4
	[0095.893] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75
	[0095.893] lstrlenW (lpString=".1cd") returned 4
	[0095.893] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75
	[0095.893] lstrlenW (lpString=".jpg") returned 4
	[0095.893] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75
	[0095.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75
	[0095.893] lstrlenW (lpString=".doc") returned 4
	[0095.893] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.893] lstrlenW (lpString=".docx") returned 5
	[0095.893] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.893] lstrlenW (lpString=".pdf") returned 4
	[0095.893] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.893] lstrlenW (lpString=".xls") returned 4
	[0095.893] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.894] lstrlenW (lpString=".xlsx") returned 5
	[0095.894] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.894] lstrlenW (lpString=".ppt") returned 4
	[0095.894] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75
	[0095.894] lstrlenW (lpString=".zip") returned 4
	[0095.894] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.894] lstrlenW (lpString=".rar") returned 4
	[0095.894] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.894] lstrlenW (lpString=".bz2") returned 4
	[0095.894] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.894] lstrlenW (lpString=".7z") returned 3
	[0095.894] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75
	[0095.894] lstrlenW (lpString=".dbf") returned 4
	[0095.894] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75
	[0095.894] lstrlenW (lpString=".1cd") returned 4
	[0095.894] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75
	[0095.894] lstrlenW (lpString=".jpg") returned 4
	[0095.894] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.894] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.895] lstrlenW (lpString="SATIN.ELM") returned 9
	[0095.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0095.935] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=103279) returned 1
	[0095.935] CloseHandle (hObject=0x1a4) returned 1
	[0095.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm")) returned 0x20
	[0096.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0096.054] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.054] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.066] GetLastError () returned 0x0
	[0096.066] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x1936f, lpOverlapped=0x0) returned 1
	[0096.082] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x19370, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x19370, lpOverlapped=0x0) returned 1
	[0096.086] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.086] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0096.086] SetEndOfFile (hFile=0x184) returned 1
	[0096.086] CloseHandle (hObject=0x184) returned 1
	[0096.087] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.087] SetEndOfFile (hFile=0x1c8) returned 1
	[0096.089] CloseHandle (hObject=0x1c8) returned 1
	[0096.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.089] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm")) returned 1
	[0096.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71
	[0096.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71
	[0096.089] lstrlenW (lpString=".doc") returned 4
	[0096.089] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.089] lstrlenW (lpString=".docx") returned 5
	[0096.089] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1
	[0096.089] lstrlenW (lpString=".pdf") returned 4
	[0096.090] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.090] lstrlenW (lpString=".xls") returned 4
	[0096.090] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.090] lstrlenW (lpString=".xlsx") returned 5
	[0096.090] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1
	[0096.090] lstrlenW (lpString=".ppt") returned 4
	[0096.090] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71
	[0096.090] lstrlenW (lpString=".zip") returned 4
	[0096.090] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.090] lstrlenW (lpString=".rar") returned 4
	[0096.090] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.090] lstrlenW (lpString=".bz2") returned 4
	[0096.090] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.090] lstrlenW (lpString=".7z") returned 3
	[0096.090] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71
	[0096.090] lstrlenW (lpString=".dbf") returned 4
	[0096.090] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71
	[0096.090] lstrlenW (lpString=".1cd") returned 4
	[0096.090] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71
	[0096.090] lstrlenW (lpString=".jpg") returned 4
	[0096.090] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71
	[0096.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71
	[0096.091] lstrlenW (lpString=".doc") returned 4
	[0096.091] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.091] lstrlenW (lpString=".docx") returned 5
	[0096.091] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1
	[0096.091] lstrlenW (lpString=".pdf") returned 4
	[0096.091] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.091] lstrlenW (lpString=".xls") returned 4
	[0096.091] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.091] lstrlenW (lpString=".xlsx") returned 5
	[0096.091] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1
	[0096.091] lstrlenW (lpString=".ppt") returned 4
	[0096.091] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71
	[0096.091] lstrlenW (lpString=".zip") returned 4
	[0096.091] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.091] lstrlenW (lpString=".rar") returned 4
	[0096.091] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.091] lstrlenW (lpString=".bz2") returned 4
	[0096.091] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.091] lstrlenW (lpString=".7z") returned 3
	[0096.091] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71
	[0096.091] lstrlenW (lpString=".dbf") returned 4
	[0096.091] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71
	[0096.091] lstrlenW (lpString=".1cd") returned 4
	[0096.091] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71
	[0096.092] lstrlenW (lpString=".jpg") returned 4
	[0096.092] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.092] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0096.092] lstrlenW (lpString="STRTEDGE.INF") returned 12
	[0096.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.093] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=625) returned 1
	[0096.093] CloseHandle (hObject=0x184) returned 1
	[0096.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf")) returned 0x20
	[0096.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.094] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.094] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0096.095] GetLastError () returned 0x0
	[0096.095] ReadFile (in: hFile=0x184, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x271, lpOverlapped=0x0) returned 1
	[0096.096] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x280, lpOverlapped=0x0) returned 1
	[0096.097] ReadFile (in: hFile=0x184, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.097] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0096.097] SetEndOfFile (hFile=0x1a4) returned 1
	[0096.098] CloseHandle (hObject=0x1a4) returned 1
	[0096.102] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.102] SetEndOfFile (hFile=0x184) returned 1
	[0096.103] CloseHandle (hObject=0x184) returned 1
	[0096.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.103] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf")) returned 1
	[0096.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77
	[0096.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77
	[0096.103] lstrlenW (lpString=".doc") returned 4
	[0096.103] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.103] lstrlenW (lpString=".docx") returned 5
	[0096.103] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0096.103] lstrlenW (lpString=".pdf") returned 4
	[0096.103] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.103] lstrlenW (lpString=".xls") returned 4
	[0096.104] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.104] lstrlenW (lpString=".xlsx") returned 5
	[0096.104] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0096.104] lstrlenW (lpString=".ppt") returned 4
	[0096.104] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77
	[0096.104] lstrlenW (lpString=".zip") returned 4
	[0096.104] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.104] lstrlenW (lpString=".rar") returned 4
	[0096.104] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.104] lstrlenW (lpString=".bz2") returned 4
	[0096.104] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.104] lstrlenW (lpString=".7z") returned 3
	[0096.104] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77
	[0096.104] lstrlenW (lpString=".dbf") returned 4
	[0096.104] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77
	[0096.104] lstrlenW (lpString=".1cd") returned 4
	[0096.104] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77
	[0096.104] lstrlenW (lpString=".jpg") returned 4
	[0096.104] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77
	[0096.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77
	[0096.104] lstrlenW (lpString=".doc") returned 4
	[0096.105] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.105] lstrlenW (lpString=".docx") returned 5
	[0096.105] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0096.105] lstrlenW (lpString=".pdf") returned 4
	[0096.105] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.105] lstrlenW (lpString=".xls") returned 4
	[0096.105] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.105] lstrlenW (lpString=".xlsx") returned 5
	[0096.105] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0096.105] lstrlenW (lpString=".ppt") returned 4
	[0096.105] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77
	[0096.105] lstrlenW (lpString=".zip") returned 4
	[0096.105] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.105] lstrlenW (lpString=".rar") returned 4
	[0096.105] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.105] lstrlenW (lpString=".bz2") returned 4
	[0096.105] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.105] lstrlenW (lpString=".7z") returned 3
	[0096.105] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77
	[0096.105] lstrlenW (lpString=".dbf") returned 4
	[0096.105] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77
	[0096.105] lstrlenW (lpString=".1cd") returned 4
	[0096.105] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77
	[0096.105] lstrlenW (lpString=".jpg") returned 4
	[0096.106] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.106] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0096.106] lstrlenW (lpString="STUDIO.ELM") returned 10
	[0096.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 60
	os_tid = 0xba0

	[0073.181] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x37a06a0
	[0073.181] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x37b06a8
	[0073.181] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630a10
	[0073.181] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x6c0690
	[0073.181] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630a28
	[0073.181] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3b80020
	[0073.182] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630a40
	[0073.182] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630a40, Size=0x20) returned 0x6162d8
	[0073.182] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630a40
	[0073.182] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630a40, Size=0x20) returned 0x6162b0
	[0073.182] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0073.182] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0073.182] Wow64DisableWow64FsRedirection (in: OldValue=0x319ff58 | out: OldValue=0x319ff58*=0x0) returned 1
	[0073.182] lstrlenW (lpString="kernel32.dll") returned 12
	[0073.182] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162d8 | out: hHeap=0x5e0000) returned 1
	[0073.182] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0073.182] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162b0 | out: hHeap=0x5e0000) returned 1
	[0073.182] Sleep (dwMilliseconds=0x64) 
	[0073.724] Sleep (dwMilliseconds=0x64) 
	[0074.274] Sleep (dwMilliseconds=0x64) 
	[0074.731] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0074.731] lstrlenW (lpString="PowerPointMUI.xml") returned 17
	[0074.731] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0074.732] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1450) returned 1
	[0074.732] CloseHandle (hObject=0x16c) returned 1
	[0074.732] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020
	[0074.732] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.732] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0074.732] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.732] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.732] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0074.733] GetLastError () returned 0x0
	[0074.733] ReadFile (in: hFile=0x16c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x5aa, lpOverlapped=0x0) returned 1
	[0074.856] WriteFile (in: hFile=0x174, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0074.857] ReadFile (in: hFile=0x16c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0074.857] WriteFile (in: hFile=0x174, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0074.857] SetEndOfFile (hFile=0x174) returned 1
	[0074.857] CloseHandle (hObject=0x174) returned 1
	[0074.859] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.859] SetEndOfFile (hFile=0x16c) returned 1
	[0074.861] CloseHandle (hObject=0x16c) returned 1
	[0074.861] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0074.861] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1
	[0074.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0074.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0074.862] lstrlenW (lpString=".doc") returned 4
	[0074.862] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0074.862] lstrlenW (lpString=".docx") returned 5
	[0074.862] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0074.862] lstrlenW (lpString=".pdf") returned 4
	[0074.862] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0074.862] lstrlenW (lpString=".xls") returned 4
	[0074.862] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0074.862] lstrlenW (lpString=".xlsx") returned 5
	[0074.862] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0074.862] lstrlenW (lpString=".ppt") returned 4
	[0074.862] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0074.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0074.862] lstrlenW (lpString=".zip") returned 4
	[0074.862] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0074.862] lstrlenW (lpString=".rar") returned 4
	[0074.862] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0074.862] lstrlenW (lpString=".bz2") returned 4
	[0074.862] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0074.862] lstrlenW (lpString=".7z") returned 3
	[0074.862] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0074.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0074.862] lstrlenW (lpString=".dbf") returned 4
	[0074.862] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0074.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0074.862] lstrlenW (lpString=".1cd") returned 4
	[0074.862] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0074.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0074.863] lstrlenW (lpString=".jpg") returned 4
	[0074.863] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0074.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0074.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0074.863] lstrlenW (lpString=".doc") returned 4
	[0074.863] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0074.863] lstrlenW (lpString=".docx") returned 5
	[0074.863] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0074.863] lstrlenW (lpString=".pdf") returned 4
	[0074.863] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0074.863] lstrlenW (lpString=".xls") returned 4
	[0074.863] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0074.863] lstrlenW (lpString=".xlsx") returned 5
	[0074.863] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0074.863] lstrlenW (lpString=".ppt") returned 4
	[0074.863] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0074.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0074.863] lstrlenW (lpString=".zip") returned 4
	[0074.863] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0074.863] lstrlenW (lpString=".rar") returned 4
	[0074.863] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0074.863] lstrlenW (lpString=".bz2") returned 4
	[0074.863] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0074.863] lstrlenW (lpString=".7z") returned 3
	[0074.863] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0074.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0074.864] lstrlenW (lpString=".dbf") returned 4
	[0074.864] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0074.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0074.864] lstrlenW (lpString=".1cd") returned 4
	[0074.864] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0074.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0074.864] lstrlenW (lpString=".jpg") returned 4
	[0074.864] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0074.864] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0074.864] lstrlenW (lpString="PublisherMUI.xml") returned 16
	[0074.864] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0075.447] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1450) returned 1
	[0075.447] CloseHandle (hObject=0x178) returned 1
	[0075.447] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020
	[0075.448] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.587] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0075.588] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.588] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0075.737] GetLastError () returned 0x0
	[0075.737] ReadFile (in: hFile=0x188, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x5aa, lpOverlapped=0x0) returned 1
	[0075.742] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0075.743] ReadFile (in: hFile=0x188, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0075.743] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0075.743] SetEndOfFile (hFile=0x1a4) returned 1
	[0075.745] CloseHandle (hObject=0x1a4) returned 1
	[0075.748] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.748] SetEndOfFile (hFile=0x188) returned 1
	[0075.764] CloseHandle (hObject=0x188) returned 1
	[0075.774] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.776] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1
	[0075.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0075.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0075.783] lstrlenW (lpString=".doc") returned 4
	[0075.783] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.783] lstrlenW (lpString=".docx") returned 5
	[0075.783] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0075.783] lstrlenW (lpString=".pdf") returned 4
	[0075.783] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.783] lstrlenW (lpString=".xls") returned 4
	[0075.783] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.783] lstrlenW (lpString=".xlsx") returned 5
	[0075.784] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0075.784] lstrlenW (lpString=".ppt") returned 4
	[0075.784] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0075.784] lstrlenW (lpString=".zip") returned 4
	[0075.784] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.784] lstrlenW (lpString=".rar") returned 4
	[0075.784] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.784] lstrlenW (lpString=".bz2") returned 4
	[0075.784] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.784] lstrlenW (lpString=".7z") returned 3
	[0075.784] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0075.784] lstrlenW (lpString=".dbf") returned 4
	[0075.784] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0075.784] lstrlenW (lpString=".1cd") returned 4
	[0075.784] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0075.784] lstrlenW (lpString=".jpg") returned 4
	[0075.784] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0075.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0075.784] lstrlenW (lpString=".doc") returned 4
	[0075.784] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.784] lstrlenW (lpString=".docx") returned 5
	[0075.785] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0075.785] lstrlenW (lpString=".pdf") returned 4
	[0075.785] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.785] lstrlenW (lpString=".xls") returned 4
	[0075.785] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.785] lstrlenW (lpString=".xlsx") returned 5
	[0075.785] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0075.785] lstrlenW (lpString=".ppt") returned 4
	[0075.785] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0075.785] lstrlenW (lpString=".zip") returned 4
	[0075.785] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.785] lstrlenW (lpString=".rar") returned 4
	[0075.785] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.785] lstrlenW (lpString=".bz2") returned 4
	[0075.785] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.785] lstrlenW (lpString=".7z") returned 3
	[0075.785] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0075.785] lstrlenW (lpString=".dbf") returned 4
	[0075.785] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0075.785] lstrlenW (lpString=".1cd") returned 4
	[0075.785] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0075.785] lstrlenW (lpString=".jpg") returned 4
	[0075.785] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.786] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0075.786] lstrlenW (lpString="OutlookMUI.xml") returned 14
	[0075.786] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.787] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3186) returned 1
	[0075.787] CloseHandle (hObject=0x1ac) returned 1
	[0075.787] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020
	[0075.787] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.787] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.788] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.788] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.788] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0075.788] GetLastError () returned 0x0
	[0075.788] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xc72, lpOverlapped=0x0) returned 1
	[0075.791] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xc80, lpOverlapped=0x0) returned 1
	[0075.792] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0075.792] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0075.792] SetEndOfFile (hFile=0x160) returned 1
	[0075.793] CloseHandle (hObject=0x160) returned 1
	[0075.794] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.794] SetEndOfFile (hFile=0x1ac) returned 1
	[0075.795] CloseHandle (hObject=0x1ac) returned 1
	[0075.795] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.795] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1
	[0075.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0075.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0075.795] lstrlenW (lpString=".doc") returned 4
	[0075.795] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.795] lstrlenW (lpString=".docx") returned 5
	[0075.796] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0075.796] lstrlenW (lpString=".pdf") returned 4
	[0075.796] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.796] lstrlenW (lpString=".xls") returned 4
	[0075.796] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.796] lstrlenW (lpString=".xlsx") returned 5
	[0075.796] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0075.796] lstrlenW (lpString=".ppt") returned 4
	[0075.796] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0075.796] lstrlenW (lpString=".zip") returned 4
	[0075.796] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.796] lstrlenW (lpString=".rar") returned 4
	[0075.796] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.796] lstrlenW (lpString=".bz2") returned 4
	[0075.796] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.796] lstrlenW (lpString=".7z") returned 3
	[0075.796] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0075.796] lstrlenW (lpString=".dbf") returned 4
	[0075.796] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0075.796] lstrlenW (lpString=".1cd") returned 4
	[0075.796] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0075.796] lstrlenW (lpString=".jpg") returned 4
	[0075.796] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0075.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0075.797] lstrlenW (lpString=".doc") returned 4
	[0075.797] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.797] lstrlenW (lpString=".docx") returned 5
	[0075.797] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0075.797] lstrlenW (lpString=".pdf") returned 4
	[0075.797] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.797] lstrlenW (lpString=".xls") returned 4
	[0075.797] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.797] lstrlenW (lpString=".xlsx") returned 5
	[0075.797] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0075.797] lstrlenW (lpString=".ppt") returned 4
	[0075.797] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0075.797] lstrlenW (lpString=".zip") returned 4
	[0075.797] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.797] lstrlenW (lpString=".rar") returned 4
	[0075.797] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.797] lstrlenW (lpString=".bz2") returned 4
	[0075.797] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.797] lstrlenW (lpString=".7z") returned 3
	[0075.797] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0075.797] lstrlenW (lpString=".dbf") returned 4
	[0075.797] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0075.798] lstrlenW (lpString=".1cd") returned 4
	[0075.798] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0075.798] lstrlenW (lpString=".jpg") returned 4
	[0075.798] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.798] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0075.798] lstrlenW (lpString="Setup.xml") returned 9
	[0075.798] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.798] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4207) returned 1
	[0075.799] CloseHandle (hObject=0x1ac) returned 1
	[0075.799] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0075.799] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.799] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.799] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.799] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.799] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0075.799] GetLastError () returned 0x0
	[0075.800] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x106f, lpOverlapped=0x0) returned 1
	[0075.802] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x1070, lpOverlapped=0x0) returned 1
	[0075.803] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0075.803] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0075.803] SetEndOfFile (hFile=0x160) returned 1
	[0075.803] CloseHandle (hObject=0x160) returned 1
	[0075.805] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.805] SetEndOfFile (hFile=0x1ac) returned 1
	[0075.806] CloseHandle (hObject=0x1ac) returned 1
	[0075.806] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.806] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0075.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.807] lstrlenW (lpString=".doc") returned 4
	[0075.807] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.807] lstrlenW (lpString=".docx") returned 5
	[0075.807] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0075.807] lstrlenW (lpString=".pdf") returned 4
	[0075.807] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.807] lstrlenW (lpString=".xls") returned 4
	[0075.807] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.807] lstrlenW (lpString=".xlsx") returned 5
	[0075.807] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0075.807] lstrlenW (lpString=".ppt") returned 4
	[0075.807] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.807] lstrlenW (lpString=".zip") returned 4
	[0075.807] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.807] lstrlenW (lpString=".rar") returned 4
	[0075.807] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.807] lstrlenW (lpString=".bz2") returned 4
	[0075.807] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.807] lstrlenW (lpString=".7z") returned 3
	[0075.807] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.808] lstrlenW (lpString=".dbf") returned 4
	[0075.808] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.808] lstrlenW (lpString=".1cd") returned 4
	[0075.808] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.808] lstrlenW (lpString=".jpg") returned 4
	[0075.808] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.808] lstrlenW (lpString=".doc") returned 4
	[0075.808] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.808] lstrlenW (lpString=".docx") returned 5
	[0075.808] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0075.808] lstrlenW (lpString=".pdf") returned 4
	[0075.808] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.808] lstrlenW (lpString=".xls") returned 4
	[0075.808] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.808] lstrlenW (lpString=".xlsx") returned 5
	[0075.808] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0075.808] lstrlenW (lpString=".ppt") returned 4
	[0075.808] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.808] lstrlenW (lpString=".zip") returned 4
	[0075.808] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.808] lstrlenW (lpString=".rar") returned 4
	[0075.809] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.809] lstrlenW (lpString=".bz2") returned 4
	[0075.809] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.809] lstrlenW (lpString=".7z") returned 3
	[0075.809] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.809] lstrlenW (lpString=".dbf") returned 4
	[0075.809] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.809] lstrlenW (lpString=".1cd") returned 4
	[0075.809] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.809] lstrlenW (lpString=".jpg") returned 4
	[0075.809] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.809] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0075.809] lstrlenW (lpString="Setup.xml") returned 9
	[0075.809] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.810] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2424) returned 1
	[0075.810] CloseHandle (hObject=0x1ac) returned 1
	[0075.810] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0075.810] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.810] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.810] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.810] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.810] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0075.813] GetLastError () returned 0x0
	[0075.813] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x978, lpOverlapped=0x0) returned 1
	[0075.815] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x980, lpOverlapped=0x0) returned 1
	[0075.817] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0075.817] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0075.817] SetEndOfFile (hFile=0x184) returned 1
	[0075.817] CloseHandle (hObject=0x184) returned 1
	[0075.818] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.818] SetEndOfFile (hFile=0x1ac) returned 1
	[0075.819] CloseHandle (hObject=0x1ac) returned 1
	[0075.819] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.819] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0075.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.820] lstrlenW (lpString=".doc") returned 4
	[0075.820] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.820] lstrlenW (lpString=".docx") returned 5
	[0075.820] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0075.820] lstrlenW (lpString=".pdf") returned 4
	[0075.820] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.820] lstrlenW (lpString=".xls") returned 4
	[0075.820] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.820] lstrlenW (lpString=".xlsx") returned 5
	[0075.820] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0075.820] lstrlenW (lpString=".ppt") returned 4
	[0075.820] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.820] lstrlenW (lpString=".zip") returned 4
	[0075.820] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.820] lstrlenW (lpString=".rar") returned 4
	[0075.820] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.820] lstrlenW (lpString=".bz2") returned 4
	[0075.820] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.820] lstrlenW (lpString=".7z") returned 3
	[0075.820] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.821] lstrlenW (lpString=".dbf") returned 4
	[0075.821] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.821] lstrlenW (lpString=".1cd") returned 4
	[0075.821] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.821] lstrlenW (lpString=".jpg") returned 4
	[0075.821] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.821] lstrlenW (lpString=".doc") returned 4
	[0075.821] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.821] lstrlenW (lpString=".docx") returned 5
	[0075.821] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0075.821] lstrlenW (lpString=".pdf") returned 4
	[0075.821] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.821] lstrlenW (lpString=".xls") returned 4
	[0075.821] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.821] lstrlenW (lpString=".xlsx") returned 5
	[0075.821] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0075.821] lstrlenW (lpString=".ppt") returned 4
	[0075.821] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.821] lstrlenW (lpString=".zip") returned 4
	[0075.822] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.822] lstrlenW (lpString=".rar") returned 4
	[0075.822] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.822] lstrlenW (lpString=".bz2") returned 4
	[0075.822] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.822] lstrlenW (lpString=".7z") returned 3
	[0075.822] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.822] lstrlenW (lpString=".dbf") returned 4
	[0075.822] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.822] lstrlenW (lpString=".1cd") returned 4
	[0075.822] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0075.822] lstrlenW (lpString=".jpg") returned 4
	[0075.822] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.822] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0075.822] lstrlenW (lpString="WordMUI.xml") returned 11
	[0075.822] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.823] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1800) returned 1
	[0075.823] CloseHandle (hObject=0x1ac) returned 1
	[0075.823] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020
	[0075.823] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.823] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0075.823] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.823] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.823] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0075.824] GetLastError () returned 0x0
	[0075.824] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x708, lpOverlapped=0x0) returned 1
	[0075.826] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x710, lpOverlapped=0x0) returned 1
	[0075.827] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0075.828] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0075.828] SetEndOfFile (hFile=0x184) returned 1
	[0075.828] CloseHandle (hObject=0x184) returned 1
	[0075.829] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.829] SetEndOfFile (hFile=0x1ac) returned 1
	[0075.830] CloseHandle (hObject=0x1ac) returned 1
	[0075.830] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.830] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1
	[0075.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0075.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0075.831] lstrlenW (lpString=".doc") returned 4
	[0075.831] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.831] lstrlenW (lpString=".docx") returned 5
	[0075.831] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0075.831] lstrlenW (lpString=".pdf") returned 4
	[0075.831] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.831] lstrlenW (lpString=".xls") returned 4
	[0075.831] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.831] lstrlenW (lpString=".xlsx") returned 5
	[0075.831] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0075.831] lstrlenW (lpString=".ppt") returned 4
	[0075.831] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0075.831] lstrlenW (lpString=".zip") returned 4
	[0075.831] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.831] lstrlenW (lpString=".rar") returned 4
	[0075.831] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.831] lstrlenW (lpString=".bz2") returned 4
	[0075.831] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.831] lstrlenW (lpString=".7z") returned 3
	[0075.831] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0075.831] lstrlenW (lpString=".dbf") returned 4
	[0075.831] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0075.832] lstrlenW (lpString=".1cd") returned 4
	[0075.832] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0075.832] lstrlenW (lpString=".jpg") returned 4
	[0075.832] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0075.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0075.832] lstrlenW (lpString=".doc") returned 4
	[0075.832] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.832] lstrlenW (lpString=".docx") returned 5
	[0075.832] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0075.832] lstrlenW (lpString=".pdf") returned 4
	[0075.832] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.832] lstrlenW (lpString=".xls") returned 4
	[0075.832] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.832] lstrlenW (lpString=".xlsx") returned 5
	[0075.832] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0075.832] lstrlenW (lpString=".ppt") returned 4
	[0075.832] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0075.832] lstrlenW (lpString=".zip") returned 4
	[0075.832] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.832] lstrlenW (lpString=".rar") returned 4
	[0075.832] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.832] lstrlenW (lpString=".bz2") returned 4
	[0075.833] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.833] lstrlenW (lpString=".7z") returned 3
	[0075.833] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0075.833] lstrlenW (lpString=".dbf") returned 4
	[0075.833] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0075.833] lstrlenW (lpString=".1cd") returned 4
	[0075.833] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0075.833] lstrlenW (lpString=".jpg") returned 4
	[0075.833] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.833] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0075.833] lstrlenW (lpString="Proof.xml") returned 9
	[0075.833] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0075.835] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1347) returned 1
	[0075.835] CloseHandle (hObject=0x198) returned 1
	[0075.835] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020
	[0075.835] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.835] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0075.836] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.836] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.836] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0075.836] GetLastError () returned 0x0
	[0075.836] ReadFile (in: hFile=0x198, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x543, lpOverlapped=0x0) returned 1
	[0075.841] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0075.842] ReadFile (in: hFile=0x198, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0075.842] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0075.842] SetEndOfFile (hFile=0x1a0) returned 1
	[0075.842] CloseHandle (hObject=0x1a0) returned 1
	[0075.843] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.843] SetEndOfFile (hFile=0x198) returned 1
	[0075.844] CloseHandle (hObject=0x198) returned 1
	[0075.844] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.845] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1
	[0075.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0075.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0075.845] lstrlenW (lpString=".doc") returned 4
	[0075.845] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.845] lstrlenW (lpString=".docx") returned 5
	[0075.845] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0075.845] lstrlenW (lpString=".pdf") returned 4
	[0075.845] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.845] lstrlenW (lpString=".xls") returned 4
	[0075.845] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.845] lstrlenW (lpString=".xlsx") returned 5
	[0075.846] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0075.846] lstrlenW (lpString=".ppt") returned 4
	[0075.846] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0075.846] lstrlenW (lpString=".zip") returned 4
	[0075.846] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.846] lstrlenW (lpString=".rar") returned 4
	[0075.846] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.846] lstrlenW (lpString=".bz2") returned 4
	[0075.846] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.846] lstrlenW (lpString=".7z") returned 3
	[0075.846] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0075.846] lstrlenW (lpString=".dbf") returned 4
	[0075.846] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0075.846] lstrlenW (lpString=".1cd") returned 4
	[0075.846] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0075.846] lstrlenW (lpString=".jpg") returned 4
	[0075.846] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0075.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0075.846] lstrlenW (lpString=".doc") returned 4
	[0075.847] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.847] lstrlenW (lpString=".docx") returned 5
	[0075.847] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0075.847] lstrlenW (lpString=".pdf") returned 4
	[0075.847] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.847] lstrlenW (lpString=".xls") returned 4
	[0075.847] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.847] lstrlenW (lpString=".xlsx") returned 5
	[0075.847] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0075.847] lstrlenW (lpString=".ppt") returned 4
	[0075.847] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0075.847] lstrlenW (lpString=".zip") returned 4
	[0075.847] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.847] lstrlenW (lpString=".rar") returned 4
	[0075.847] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.847] lstrlenW (lpString=".bz2") returned 4
	[0075.847] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.847] lstrlenW (lpString=".7z") returned 3
	[0075.847] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0075.847] lstrlenW (lpString=".dbf") returned 4
	[0075.847] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0075.847] lstrlenW (lpString=".1cd") returned 4
	[0075.847] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0075.848] lstrlenW (lpString=".jpg") returned 4
	[0075.848] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.848] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0075.848] lstrlenW (lpString="Proof.xml") returned 9
	[0075.848] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0075.848] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1457) returned 1
	[0075.848] CloseHandle (hObject=0x198) returned 1
	[0075.848] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020
	[0075.849] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.849] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0075.849] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.849] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.849] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0075.849] GetLastError () returned 0x0
	[0075.849] ReadFile (in: hFile=0x198, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x5b1, lpOverlapped=0x0) returned 1
	[0075.858] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0075.859] ReadFile (in: hFile=0x198, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0075.859] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0075.859] SetEndOfFile (hFile=0x1a0) returned 1
	[0075.860] CloseHandle (hObject=0x1a0) returned 1
	[0075.872] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.872] SetEndOfFile (hFile=0x198) returned 1
	[0075.873] CloseHandle (hObject=0x198) returned 1
	[0075.873] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.874] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1
	[0075.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0075.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0075.874] lstrlenW (lpString=".doc") returned 4
	[0075.874] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.874] lstrlenW (lpString=".docx") returned 5
	[0075.874] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0075.874] lstrlenW (lpString=".pdf") returned 4
	[0075.874] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.874] lstrlenW (lpString=".xls") returned 4
	[0075.874] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.874] lstrlenW (lpString=".xlsx") returned 5
	[0075.874] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0075.874] lstrlenW (lpString=".ppt") returned 4
	[0075.874] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0075.874] lstrlenW (lpString=".zip") returned 4
	[0075.874] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.874] lstrlenW (lpString=".rar") returned 4
	[0075.875] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.875] lstrlenW (lpString=".bz2") returned 4
	[0075.875] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.875] lstrlenW (lpString=".7z") returned 3
	[0075.875] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0075.875] lstrlenW (lpString=".dbf") returned 4
	[0075.875] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0075.875] lstrlenW (lpString=".1cd") returned 4
	[0075.875] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0075.875] lstrlenW (lpString=".jpg") returned 4
	[0075.875] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0075.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0075.875] lstrlenW (lpString=".doc") returned 4
	[0075.875] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.875] lstrlenW (lpString=".docx") returned 5
	[0075.875] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0075.875] lstrlenW (lpString=".pdf") returned 4
	[0075.875] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.875] lstrlenW (lpString=".xls") returned 4
	[0075.875] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.875] lstrlenW (lpString=".xlsx") returned 5
	[0075.876] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0075.876] lstrlenW (lpString=".ppt") returned 4
	[0075.876] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0075.876] lstrlenW (lpString=".zip") returned 4
	[0075.876] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.876] lstrlenW (lpString=".rar") returned 4
	[0075.876] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.876] lstrlenW (lpString=".bz2") returned 4
	[0075.876] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.876] lstrlenW (lpString=".7z") returned 3
	[0075.876] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0075.876] lstrlenW (lpString=".dbf") returned 4
	[0075.876] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0075.876] lstrlenW (lpString=".1cd") returned 4
	[0075.876] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0075.876] lstrlenW (lpString=".jpg") returned 4
	[0075.876] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.876] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0075.877] lstrlenW (lpString="Proofing.xml") returned 12
	[0075.877] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0075.877] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=811) returned 1
	[0075.877] CloseHandle (hObject=0x198) returned 1
	[0075.877] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020
	[0075.877] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.877] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0075.877] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.878] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.878] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0075.878] GetLastError () returned 0x0
	[0075.878] ReadFile (in: hFile=0x198, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x32b, lpOverlapped=0x0) returned 1
	[0075.910] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x330, lpOverlapped=0x0) returned 1
	[0075.911] ReadFile (in: hFile=0x198, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0075.911] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0075.912] SetEndOfFile (hFile=0x1a0) returned 1
	[0075.912] CloseHandle (hObject=0x1a0) returned 1
	[0075.913] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.913] SetEndOfFile (hFile=0x198) returned 1
	[0075.914] CloseHandle (hObject=0x198) returned 1
	[0075.914] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.914] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1
	[0075.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0075.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0075.915] lstrlenW (lpString=".doc") returned 4
	[0075.915] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.915] lstrlenW (lpString=".docx") returned 5
	[0075.915] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0075.915] lstrlenW (lpString=".pdf") returned 4
	[0075.915] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.915] lstrlenW (lpString=".xls") returned 4
	[0075.915] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.915] lstrlenW (lpString=".xlsx") returned 5
	[0075.915] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0075.915] lstrlenW (lpString=".ppt") returned 4
	[0075.915] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0075.915] lstrlenW (lpString=".zip") returned 4
	[0075.915] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.915] lstrlenW (lpString=".rar") returned 4
	[0075.915] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.915] lstrlenW (lpString=".bz2") returned 4
	[0075.915] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.915] lstrlenW (lpString=".7z") returned 3
	[0075.915] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0075.915] lstrlenW (lpString=".dbf") returned 4
	[0075.915] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0075.915] lstrlenW (lpString=".1cd") returned 4
	[0075.916] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0075.916] lstrlenW (lpString=".jpg") returned 4
	[0075.916] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0075.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0075.916] lstrlenW (lpString=".doc") returned 4
	[0075.916] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.916] lstrlenW (lpString=".docx") returned 5
	[0075.916] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0075.916] lstrlenW (lpString=".pdf") returned 4
	[0075.916] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.916] lstrlenW (lpString=".xls") returned 4
	[0075.916] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.916] lstrlenW (lpString=".xlsx") returned 5
	[0075.916] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0075.916] lstrlenW (lpString=".ppt") returned 4
	[0075.916] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0075.916] lstrlenW (lpString=".zip") returned 4
	[0075.916] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.916] lstrlenW (lpString=".rar") returned 4
	[0075.916] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.916] lstrlenW (lpString=".bz2") returned 4
	[0075.916] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.916] lstrlenW (lpString=".7z") returned 3
	[0075.917] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0075.917] lstrlenW (lpString=".dbf") returned 4
	[0075.917] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0075.917] lstrlenW (lpString=".1cd") returned 4
	[0075.917] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0075.917] lstrlenW (lpString=".jpg") returned 4
	[0075.917] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.917] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0075.917] lstrlenW (lpString="Office32MUI.xml") returned 15
	[0075.917] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0075.918] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1383) returned 1
	[0075.918] CloseHandle (hObject=0x198) returned 1
	[0075.918] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020
	[0075.918] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.918] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0075.919] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.919] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.919] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0075.919] GetLastError () returned 0x0
	[0075.919] ReadFile (in: hFile=0x198, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x567, lpOverlapped=0x0) returned 1
	[0075.984] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x570, lpOverlapped=0x0) returned 1
	[0075.985] ReadFile (in: hFile=0x198, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0075.985] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0075.985] SetEndOfFile (hFile=0x1a0) returned 1
	[0075.985] CloseHandle (hObject=0x1a0) returned 1
	[0075.986] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.986] SetEndOfFile (hFile=0x198) returned 1
	[0075.987] CloseHandle (hObject=0x198) returned 1
	[0075.987] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0075.988] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1
	[0075.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0075.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0075.988] lstrlenW (lpString=".doc") returned 4
	[0075.988] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.988] lstrlenW (lpString=".docx") returned 5
	[0075.988] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0075.988] lstrlenW (lpString=".pdf") returned 4
	[0075.988] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.988] lstrlenW (lpString=".xls") returned 4
	[0075.988] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.988] lstrlenW (lpString=".xlsx") returned 5
	[0075.988] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0075.988] lstrlenW (lpString=".ppt") returned 4
	[0075.988] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0075.988] lstrlenW (lpString=".zip") returned 4
	[0075.988] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.988] lstrlenW (lpString=".rar") returned 4
	[0075.988] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.989] lstrlenW (lpString=".bz2") returned 4
	[0075.989] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.989] lstrlenW (lpString=".7z") returned 3
	[0075.989] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0075.989] lstrlenW (lpString=".dbf") returned 4
	[0075.989] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0075.989] lstrlenW (lpString=".1cd") returned 4
	[0075.989] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0075.989] lstrlenW (lpString=".jpg") returned 4
	[0075.989] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0075.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0075.989] lstrlenW (lpString=".doc") returned 4
	[0075.989] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0075.989] lstrlenW (lpString=".docx") returned 5
	[0075.989] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0075.989] lstrlenW (lpString=".pdf") returned 4
	[0075.989] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0075.989] lstrlenW (lpString=".xls") returned 4
	[0075.989] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0075.989] lstrlenW (lpString=".xlsx") returned 5
	[0075.989] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0075.989] lstrlenW (lpString=".ppt") returned 4
	[0075.989] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0075.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0075.989] lstrlenW (lpString=".zip") returned 4
	[0075.989] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0075.989] lstrlenW (lpString=".rar") returned 4
	[0075.989] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0075.989] lstrlenW (lpString=".bz2") returned 4
	[0075.990] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0075.990] lstrlenW (lpString=".7z") returned 3
	[0075.990] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0075.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0075.990] lstrlenW (lpString=".dbf") returned 4
	[0075.990] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0075.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0075.990] lstrlenW (lpString=".1cd") returned 4
	[0075.990] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0075.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0075.990] lstrlenW (lpString=".jpg") returned 4
	[0075.990] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0075.990] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0075.990] lstrlenW (lpString="Setup.xml") returned 9
	[0075.990] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0076.732] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=6241) returned 1
	[0076.732] CloseHandle (hObject=0x194) returned 1
	[0076.733] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0076.733] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0076.733] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0076.733] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.733] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.733] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0078.136] GetLastError () returned 0x0
	[0078.136] ReadFile (in: hFile=0x194, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x1861, lpOverlapped=0x0) returned 1
	[0078.193] WriteFile (in: hFile=0x19c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x1870, lpOverlapped=0x0) returned 1
	[0078.194] ReadFile (in: hFile=0x194, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0078.194] WriteFile (in: hFile=0x19c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0078.194] SetEndOfFile (hFile=0x19c) returned 1
	[0078.194] CloseHandle (hObject=0x19c) returned 1
	[0078.195] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.195] SetEndOfFile (hFile=0x194) returned 1
	[0078.196] CloseHandle (hObject=0x194) returned 1
	[0078.197] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0078.197] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0078.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.197] lstrlenW (lpString=".doc") returned 4
	[0078.197] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.197] lstrlenW (lpString=".docx") returned 5
	[0078.197] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0078.197] lstrlenW (lpString=".pdf") returned 4
	[0078.197] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.197] lstrlenW (lpString=".xls") returned 4
	[0078.197] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.198] lstrlenW (lpString=".xlsx") returned 5
	[0078.198] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0078.198] lstrlenW (lpString=".ppt") returned 4
	[0078.198] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.198] lstrlenW (lpString=".zip") returned 4
	[0078.198] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.198] lstrlenW (lpString=".rar") returned 4
	[0078.198] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.198] lstrlenW (lpString=".bz2") returned 4
	[0078.198] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.198] lstrlenW (lpString=".7z") returned 3
	[0078.198] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.198] lstrlenW (lpString=".dbf") returned 4
	[0078.198] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.198] lstrlenW (lpString=".1cd") returned 4
	[0078.198] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.198] lstrlenW (lpString=".jpg") returned 4
	[0078.198] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.198] lstrlenW (lpString=".doc") returned 4
	[0078.198] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.198] lstrlenW (lpString=".docx") returned 5
	[0078.199] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0078.199] lstrlenW (lpString=".pdf") returned 4
	[0078.199] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.199] lstrlenW (lpString=".xls") returned 4
	[0078.199] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.199] lstrlenW (lpString=".xlsx") returned 5
	[0078.199] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0078.199] lstrlenW (lpString=".ppt") returned 4
	[0078.199] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.199] lstrlenW (lpString=".zip") returned 4
	[0078.199] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.199] lstrlenW (lpString=".rar") returned 4
	[0078.199] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.199] lstrlenW (lpString=".bz2") returned 4
	[0078.199] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.199] lstrlenW (lpString=".7z") returned 3
	[0078.199] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.199] lstrlenW (lpString=".dbf") returned 4
	[0078.199] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.199] lstrlenW (lpString=".1cd") returned 4
	[0078.199] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.199] lstrlenW (lpString=".jpg") returned 4
	[0078.199] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.200] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0078.200] lstrlenW (lpString="branding.xml") returned 12
	[0078.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0078.694] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=596341) returned 1
	[0078.694] CloseHandle (hObject=0x198) returned 1
	[0078.694] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020
	[0078.705] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0078.705] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0079.332] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.332] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.332] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0080.860] GetLastError () returned 0x0
	[0080.860] ReadFile (in: hFile=0x174, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x91975, lpOverlapped=0x0) returned 1
	[0080.934] WriteFile (in: hFile=0x194, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x91980, lpOverlapped=0x0) returned 1
	[0080.944] ReadFile (in: hFile=0x174, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0080.945] WriteFile (in: hFile=0x194, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0080.945] SetEndOfFile (hFile=0x194) returned 1
	[0081.219] CloseHandle (hObject=0x194) returned 1
	[0081.392] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.392] SetEndOfFile (hFile=0x174) returned 1
	[0081.430] CloseHandle (hObject=0x174) returned 1
	[0081.432] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.437] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1
	[0081.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0081.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0081.465] lstrlenW (lpString=".doc") returned 4
	[0081.465] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.465] lstrlenW (lpString=".docx") returned 5
	[0081.465] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0081.465] lstrlenW (lpString=".pdf") returned 4
	[0081.465] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.465] lstrlenW (lpString=".xls") returned 4
	[0081.465] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.465] lstrlenW (lpString=".xlsx") returned 5
	[0081.465] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0081.465] lstrlenW (lpString=".ppt") returned 4
	[0081.465] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0081.465] lstrlenW (lpString=".zip") returned 4
	[0081.465] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.465] lstrlenW (lpString=".rar") returned 4
	[0081.465] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.465] lstrlenW (lpString=".bz2") returned 4
	[0081.465] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.465] lstrlenW (lpString=".7z") returned 3
	[0081.465] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0081.465] lstrlenW (lpString=".dbf") returned 4
	[0081.465] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0081.465] lstrlenW (lpString=".1cd") returned 4
	[0081.465] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0081.466] lstrlenW (lpString=".jpg") returned 4
	[0081.466] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0081.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0081.466] lstrlenW (lpString=".doc") returned 4
	[0081.466] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.466] lstrlenW (lpString=".docx") returned 5
	[0081.466] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0081.466] lstrlenW (lpString=".pdf") returned 4
	[0081.466] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.466] lstrlenW (lpString=".xls") returned 4
	[0081.466] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.466] lstrlenW (lpString=".xlsx") returned 5
	[0081.466] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0081.466] lstrlenW (lpString=".ppt") returned 4
	[0081.466] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0081.466] lstrlenW (lpString=".zip") returned 4
	[0081.466] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.466] lstrlenW (lpString=".rar") returned 4
	[0081.466] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.466] lstrlenW (lpString=".bz2") returned 4
	[0081.466] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.466] lstrlenW (lpString=".7z") returned 3
	[0081.466] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0081.466] lstrlenW (lpString=".dbf") returned 4
	[0081.466] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0081.466] lstrlenW (lpString=".1cd") returned 4
	[0081.466] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0081.467] lstrlenW (lpString=".jpg") returned 4
	[0081.467] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.467] lstrcmpiW (lpString1=".chm", lpString2=".adobe") returned 1
	[0081.467] lstrlenW (lpString="setup.chm") returned 9
	[0081.467] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.486] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=67190) returned 1
	[0081.486] CloseHandle (hObject=0x198) returned 1
	[0081.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020
	[0081.508] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.508] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.633] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.633] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.633] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0081.846] GetLastError () returned 0x0
	[0081.846] ReadFile (in: hFile=0x184, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x10676, lpOverlapped=0x0) returned 1
	[0081.860] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x10680, lpOverlapped=0x0) returned 1
	[0081.864] ReadFile (in: hFile=0x184, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.864] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0081.865] SetEndOfFile (hFile=0x1b0) returned 1
	[0081.874] CloseHandle (hObject=0x1b0) returned 1
	[0081.879] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.879] SetEndOfFile (hFile=0x184) returned 1
	[0081.887] CloseHandle (hObject=0x184) returned 1
	[0081.892] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.892] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1
	[0081.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0081.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0081.895] lstrlenW (lpString=".doc") returned 4
	[0081.895] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0081.895] lstrlenW (lpString=".docx") returned 5
	[0081.896] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1
	[0081.896] lstrlenW (lpString=".pdf") returned 4
	[0081.896] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0081.896] lstrlenW (lpString=".xls") returned 4
	[0081.896] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0081.896] lstrlenW (lpString=".xlsx") returned 5
	[0081.896] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1
	[0081.896] lstrlenW (lpString=".ppt") returned 4
	[0081.896] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0081.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0081.896] lstrlenW (lpString=".zip") returned 4
	[0081.896] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0081.896] lstrlenW (lpString=".rar") returned 4
	[0081.896] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0081.896] lstrlenW (lpString=".bz2") returned 4
	[0081.896] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0081.896] lstrlenW (lpString=".7z") returned 3
	[0081.896] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0081.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0081.896] lstrlenW (lpString=".dbf") returned 4
	[0081.896] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0081.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0081.896] lstrlenW (lpString=".1cd") returned 4
	[0081.896] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0081.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0081.896] lstrlenW (lpString=".jpg") returned 4
	[0081.897] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0081.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0081.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0081.897] lstrlenW (lpString=".doc") returned 4
	[0081.897] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0081.897] lstrlenW (lpString=".docx") returned 5
	[0081.897] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1
	[0081.897] lstrlenW (lpString=".pdf") returned 4
	[0081.897] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0081.897] lstrlenW (lpString=".xls") returned 4
	[0081.897] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0081.897] lstrlenW (lpString=".xlsx") returned 5
	[0081.897] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1
	[0081.897] lstrlenW (lpString=".ppt") returned 4
	[0081.897] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0081.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0081.897] lstrlenW (lpString=".zip") returned 4
	[0081.897] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0081.897] lstrlenW (lpString=".rar") returned 4
	[0081.897] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0081.897] lstrlenW (lpString=".bz2") returned 4
	[0081.897] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0081.897] lstrlenW (lpString=".7z") returned 3
	[0081.897] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0081.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0081.898] lstrlenW (lpString=".dbf") returned 4
	[0081.898] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0081.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0081.898] lstrlenW (lpString=".1cd") returned 4
	[0081.898] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0081.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0081.898] lstrlenW (lpString=".jpg") returned 4
	[0081.898] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0081.898] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0081.898] lstrlenW (lpString="Office32WW.xml") returned 14
	[0081.898] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.899] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4274) returned 1
	[0081.899] CloseHandle (hObject=0x198) returned 1
	[0081.900] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020
	[0081.902] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.903] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.903] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.903] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.903] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0081.904] GetLastError () returned 0x0
	[0081.904] ReadFile (in: hFile=0x198, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0081.906] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0081.907] ReadFile (in: hFile=0x198, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.907] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0081.908] SetEndOfFile (hFile=0x1b0) returned 1
	[0081.908] CloseHandle (hObject=0x1b0) returned 1
	[0081.908] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.908] SetEndOfFile (hFile=0x198) returned 1
	[0081.909] CloseHandle (hObject=0x198) returned 1
	[0081.909] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.909] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1
	[0081.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.910] lstrlenW (lpString=".doc") returned 4
	[0081.910] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.910] lstrlenW (lpString=".docx") returned 5
	[0081.910] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0081.910] lstrlenW (lpString=".pdf") returned 4
	[0081.910] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.910] lstrlenW (lpString=".xls") returned 4
	[0081.910] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.910] lstrlenW (lpString=".xlsx") returned 5
	[0081.910] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0081.910] lstrlenW (lpString=".ppt") returned 4
	[0081.910] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.910] lstrlenW (lpString=".zip") returned 4
	[0081.910] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.910] lstrlenW (lpString=".rar") returned 4
	[0081.910] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.910] lstrlenW (lpString=".bz2") returned 4
	[0081.910] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.910] lstrlenW (lpString=".7z") returned 3
	[0081.910] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.911] lstrlenW (lpString=".dbf") returned 4
	[0081.911] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.911] lstrlenW (lpString=".1cd") returned 4
	[0081.911] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.911] lstrlenW (lpString=".jpg") returned 4
	[0081.911] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.911] lstrlenW (lpString=".doc") returned 4
	[0081.911] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.911] lstrlenW (lpString=".docx") returned 5
	[0081.911] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0081.911] lstrlenW (lpString=".pdf") returned 4
	[0081.911] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.911] lstrlenW (lpString=".xls") returned 4
	[0081.911] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.911] lstrlenW (lpString=".xlsx") returned 5
	[0081.911] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0081.911] lstrlenW (lpString=".ppt") returned 4
	[0081.911] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.911] lstrlenW (lpString=".zip") returned 4
	[0081.911] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.911] lstrlenW (lpString=".rar") returned 4
	[0081.912] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.912] lstrlenW (lpString=".bz2") returned 4
	[0081.912] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.912] lstrlenW (lpString=".7z") returned 3
	[0081.912] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.912] lstrlenW (lpString=".dbf") returned 4
	[0081.912] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.912] lstrlenW (lpString=".1cd") returned 4
	[0081.912] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0081.912] lstrlenW (lpString=".jpg") returned 4
	[0081.912] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.912] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0081.912] lstrlenW (lpString="Setup.xml") returned 9
	[0081.912] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.913] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=20577) returned 1
	[0081.913] CloseHandle (hObject=0x198) returned 1
	[0081.913] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0081.913] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.913] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.913] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.914] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.914] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0081.914] GetLastError () returned 0x0
	[0081.914] ReadFile (in: hFile=0x198, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x5061, lpOverlapped=0x0) returned 1
	[0081.919] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x5070, lpOverlapped=0x0) returned 1
	[0081.921] ReadFile (in: hFile=0x198, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.921] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0081.921] SetEndOfFile (hFile=0x1b0) returned 1
	[0081.922] CloseHandle (hObject=0x1b0) returned 1
	[0081.922] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.922] SetEndOfFile (hFile=0x198) returned 1
	[0081.923] CloseHandle (hObject=0x198) returned 1
	[0081.923] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.923] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0081.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.924] lstrlenW (lpString=".doc") returned 4
	[0081.924] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.924] lstrlenW (lpString=".docx") returned 5
	[0081.924] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0081.924] lstrlenW (lpString=".pdf") returned 4
	[0081.924] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.924] lstrlenW (lpString=".xls") returned 4
	[0081.924] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.924] lstrlenW (lpString=".xlsx") returned 5
	[0081.924] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0081.924] lstrlenW (lpString=".ppt") returned 4
	[0081.924] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.924] lstrlenW (lpString=".zip") returned 4
	[0081.924] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.924] lstrlenW (lpString=".rar") returned 4
	[0081.924] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.924] lstrlenW (lpString=".bz2") returned 4
	[0081.924] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.924] lstrlenW (lpString=".7z") returned 3
	[0081.924] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.925] lstrlenW (lpString=".dbf") returned 4
	[0081.925] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.925] lstrlenW (lpString=".1cd") returned 4
	[0081.925] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.925] lstrlenW (lpString=".jpg") returned 4
	[0081.925] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.925] lstrlenW (lpString=".doc") returned 4
	[0081.925] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.925] lstrlenW (lpString=".docx") returned 5
	[0081.925] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0081.925] lstrlenW (lpString=".pdf") returned 4
	[0081.925] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.925] lstrlenW (lpString=".xls") returned 4
	[0081.925] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.925] lstrlenW (lpString=".xlsx") returned 5
	[0081.925] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0081.925] lstrlenW (lpString=".ppt") returned 4
	[0081.925] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.925] lstrlenW (lpString=".zip") returned 4
	[0081.925] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.926] lstrlenW (lpString=".rar") returned 4
	[0081.926] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.926] lstrlenW (lpString=".bz2") returned 4
	[0081.926] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.926] lstrlenW (lpString=".7z") returned 3
	[0081.926] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.926] lstrlenW (lpString=".dbf") returned 4
	[0081.926] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.926] lstrlenW (lpString=".1cd") returned 4
	[0081.926] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0081.926] lstrlenW (lpString=".jpg") returned 4
	[0081.926] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.926] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0081.926] lstrlenW (lpString="VisiorWW.xml") returned 12
	[0081.926] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.943] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=8723) returned 1
	[0081.943] CloseHandle (hObject=0x184) returned 1
	[0081.943] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020
	[0081.943] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.943] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.943] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.943] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.943] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0081.944] GetLastError () returned 0x0
	[0081.944] ReadFile (in: hFile=0x184, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x2213, lpOverlapped=0x0) returned 1
	[0081.955] WriteFile (in: hFile=0x194, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x2220, lpOverlapped=0x0) returned 1
	[0081.957] ReadFile (in: hFile=0x184, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.957] WriteFile (in: hFile=0x194, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0081.957] SetEndOfFile (hFile=0x194) returned 1
	[0081.957] CloseHandle (hObject=0x194) returned 1
	[0081.957] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.958] SetEndOfFile (hFile=0x184) returned 1
	[0081.959] CloseHandle (hObject=0x184) returned 1
	[0081.959] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.959] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1
	[0081.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0081.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0081.959] lstrlenW (lpString=".doc") returned 4
	[0081.959] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.959] lstrlenW (lpString=".docx") returned 5
	[0081.960] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0081.960] lstrlenW (lpString=".pdf") returned 4
	[0081.960] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.960] lstrlenW (lpString=".xls") returned 4
	[0081.960] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.960] lstrlenW (lpString=".xlsx") returned 5
	[0081.960] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0081.960] lstrlenW (lpString=".ppt") returned 4
	[0081.960] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0081.960] lstrlenW (lpString=".zip") returned 4
	[0081.960] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.960] lstrlenW (lpString=".rar") returned 4
	[0081.960] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.960] lstrlenW (lpString=".bz2") returned 4
	[0081.960] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.960] lstrlenW (lpString=".7z") returned 3
	[0081.960] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0081.960] lstrlenW (lpString=".dbf") returned 4
	[0081.960] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0081.960] lstrlenW (lpString=".1cd") returned 4
	[0081.960] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0081.960] lstrlenW (lpString=".jpg") returned 4
	[0081.960] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0081.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0081.961] lstrlenW (lpString=".doc") returned 4
	[0081.961] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.961] lstrlenW (lpString=".docx") returned 5
	[0081.961] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0081.961] lstrlenW (lpString=".pdf") returned 4
	[0081.961] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.961] lstrlenW (lpString=".xls") returned 4
	[0081.961] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.961] lstrlenW (lpString=".xlsx") returned 5
	[0081.961] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0081.961] lstrlenW (lpString=".ppt") returned 4
	[0081.961] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0081.961] lstrlenW (lpString=".zip") returned 4
	[0081.961] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.961] lstrlenW (lpString=".rar") returned 4
	[0081.961] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.961] lstrlenW (lpString=".bz2") returned 4
	[0081.961] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.961] lstrlenW (lpString=".7z") returned 3
	[0081.961] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0081.961] lstrlenW (lpString=".dbf") returned 4
	[0081.961] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0081.962] lstrlenW (lpString=".1cd") returned 4
	[0081.962] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0081.962] lstrlenW (lpString=".jpg") returned 4
	[0081.962] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.962] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0081.962] lstrlenW (lpString="MS.PNG") returned 6
	[0081.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.971] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1682) returned 1
	[0081.971] CloseHandle (hObject=0x184) returned 1
	[0081.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20
	[0081.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0082.062] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.062] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0082.127] GetLastError () returned 0x0
	[0082.127] ReadFile (in: hFile=0x188, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x692, lpOverlapped=0x0) returned 1
	[0082.184] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x6a0, lpOverlapped=0x0) returned 1
	[0082.192] ReadFile (in: hFile=0x188, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0082.192] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0082.192] SetEndOfFile (hFile=0x1a8) returned 1
	[0082.192] CloseHandle (hObject=0x1a8) returned 1
	[0082.201] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.201] SetEndOfFile (hFile=0x188) returned 1
	[0082.283] CloseHandle (hObject=0x188) returned 1
	[0082.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0082.286] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1
	[0082.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0082.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0082.288] lstrlenW (lpString=".doc") returned 4
	[0082.288] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0082.288] lstrlenW (lpString=".docx") returned 5
	[0082.289] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1
	[0082.289] lstrlenW (lpString=".pdf") returned 4
	[0082.289] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0082.289] lstrlenW (lpString=".xls") returned 4
	[0082.289] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0082.289] lstrlenW (lpString=".xlsx") returned 5
	[0082.289] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1
	[0082.289] lstrlenW (lpString=".ppt") returned 4
	[0082.289] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0082.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0082.289] lstrlenW (lpString=".zip") returned 4
	[0082.289] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0082.289] lstrlenW (lpString=".rar") returned 4
	[0082.289] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0082.289] lstrlenW (lpString=".bz2") returned 4
	[0082.289] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0082.289] lstrlenW (lpString=".7z") returned 3
	[0082.289] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0082.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0082.289] lstrlenW (lpString=".dbf") returned 4
	[0082.289] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0082.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0082.289] lstrlenW (lpString=".1cd") returned 4
	[0082.289] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0082.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0082.289] lstrlenW (lpString=".jpg") returned 4
	[0082.289] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0082.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0082.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0082.289] lstrlenW (lpString=".doc") returned 4
	[0082.290] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0082.290] lstrlenW (lpString=".docx") returned 5
	[0082.290] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1
	[0082.290] lstrlenW (lpString=".pdf") returned 4
	[0082.290] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0082.290] lstrlenW (lpString=".xls") returned 4
	[0082.290] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0082.290] lstrlenW (lpString=".xlsx") returned 5
	[0082.290] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1
	[0082.290] lstrlenW (lpString=".ppt") returned 4
	[0082.290] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0082.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0082.290] lstrlenW (lpString=".zip") returned 4
	[0082.290] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0082.290] lstrlenW (lpString=".rar") returned 4
	[0082.290] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0082.290] lstrlenW (lpString=".bz2") returned 4
	[0082.290] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0082.290] lstrlenW (lpString=".7z") returned 3
	[0082.290] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0082.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0082.290] lstrlenW (lpString=".dbf") returned 4
	[0082.290] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0082.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0082.290] lstrlenW (lpString=".1cd") returned 4
	[0082.290] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0082.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0082.290] lstrlenW (lpString=".jpg") returned 4
	[0082.290] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0082.291] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0082.291] lstrlenW (lpString="Content.xml") returned 11
	[0082.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0082.716] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=27045) returned 1
	[0082.716] CloseHandle (hObject=0x19c) returned 1
	[0082.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20
	[0082.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0082.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0082.815] lstrlenW (lpString=".doc") returned 4
	[0082.815] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.815] lstrlenW (lpString=".docx") returned 5
	[0082.815] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0082.815] lstrlenW (lpString=".pdf") returned 4
	[0082.815] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.815] lstrlenW (lpString=".xls") returned 4
	[0082.815] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.815] lstrlenW (lpString=".xlsx") returned 5
	[0082.815] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0082.815] lstrlenW (lpString=".ppt") returned 4
	[0082.815] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0082.815] lstrlenW (lpString=".zip") returned 4
	[0082.816] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.816] lstrlenW (lpString=".rar") returned 4
	[0082.816] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.816] lstrlenW (lpString=".bz2") returned 4
	[0082.816] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.816] lstrlenW (lpString=".7z") returned 3
	[0082.816] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0082.816] lstrlenW (lpString=".dbf") returned 4
	[0082.816] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0082.816] lstrlenW (lpString=".1cd") returned 4
	[0082.816] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0082.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0082.816] lstrlenW (lpString=".jpg") returned 4
	[0082.816] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0082.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0082.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0082.816] lstrlenW (lpString=".doc") returned 4
	[0082.816] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.816] lstrlenW (lpString=".docx") returned 5
	[0082.816] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0082.816] lstrlenW (lpString=".pdf") returned 4
	[0082.816] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.816] lstrlenW (lpString=".xls") returned 4
	[0082.817] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.817] lstrlenW (lpString=".xlsx") returned 5
	[0082.817] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0082.817] lstrlenW (lpString=".ppt") returned 4
	[0082.817] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0082.817] lstrlenW (lpString=".zip") returned 4
	[0082.817] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.817] lstrlenW (lpString=".rar") returned 4
	[0082.817] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.817] lstrlenW (lpString=".bz2") returned 4
	[0082.817] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.817] lstrlenW (lpString=".7z") returned 3
	[0082.817] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0082.817] lstrlenW (lpString=".dbf") returned 4
	[0082.817] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0082.817] lstrlenW (lpString=".1cd") returned 4
	[0082.817] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0082.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0082.817] lstrlenW (lpString=".jpg") returned 4
	[0082.817] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0082.818] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0082.818] lstrlenW (lpString="kor-kor.xml") returned 11
	[0082.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0082.942] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=392) returned 1
	[0082.942] CloseHandle (hObject=0x1a8) returned 1
	[0082.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20
	[0082.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0083.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0083.140] lstrlenW (lpString=".doc") returned 4
	[0083.140] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.140] lstrlenW (lpString=".docx") returned 5
	[0083.140] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0083.140] lstrlenW (lpString=".pdf") returned 4
	[0083.140] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.140] lstrlenW (lpString=".xls") returned 4
	[0083.140] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.140] lstrlenW (lpString=".xlsx") returned 5
	[0083.140] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0083.140] lstrlenW (lpString=".ppt") returned 4
	[0083.140] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0083.140] lstrlenW (lpString=".zip") returned 4
	[0083.141] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.141] lstrlenW (lpString=".rar") returned 4
	[0083.141] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.141] lstrlenW (lpString=".bz2") returned 4
	[0083.141] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.141] lstrlenW (lpString=".7z") returned 3
	[0083.141] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0083.141] lstrlenW (lpString=".dbf") returned 4
	[0083.141] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0083.141] lstrlenW (lpString=".1cd") returned 4
	[0083.141] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0083.141] lstrlenW (lpString=".jpg") returned 4
	[0083.141] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0083.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0083.141] lstrlenW (lpString=".doc") returned 4
	[0083.141] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.141] lstrlenW (lpString=".docx") returned 5
	[0083.141] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0083.141] lstrlenW (lpString=".pdf") returned 4
	[0083.141] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.141] lstrlenW (lpString=".xls") returned 4
	[0083.141] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.141] lstrlenW (lpString=".xlsx") returned 5
	[0083.141] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0083.141] lstrlenW (lpString=".ppt") returned 4
	[0083.141] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0083.141] lstrlenW (lpString=".zip") returned 4
	[0083.142] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.142] lstrlenW (lpString=".rar") returned 4
	[0083.142] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.142] lstrlenW (lpString=".bz2") returned 4
	[0083.142] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.142] lstrlenW (lpString=".7z") returned 3
	[0083.142] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0083.142] lstrlenW (lpString=".dbf") returned 4
	[0083.142] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0083.142] lstrlenW (lpString=".1cd") returned 4
	[0083.142] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0083.142] lstrlenW (lpString=".jpg") returned 4
	[0083.142] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.142] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0083.142] lstrlenW (lpString="oskmenubase.xml") returned 15
	[0083.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0083.267] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=471) returned 1
	[0083.267] CloseHandle (hObject=0x1a4) returned 1
	[0083.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20
	[0083.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0083.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0083.285] lstrlenW (lpString=".doc") returned 4
	[0083.285] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.285] lstrlenW (lpString=".docx") returned 5
	[0083.285] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0083.285] lstrlenW (lpString=".pdf") returned 4
	[0083.285] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.285] lstrlenW (lpString=".xls") returned 4
	[0083.285] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.285] lstrlenW (lpString=".xlsx") returned 5
	[0083.285] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0083.285] lstrlenW (lpString=".ppt") returned 4
	[0083.285] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0083.285] lstrlenW (lpString=".zip") returned 4
	[0083.285] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.285] lstrlenW (lpString=".rar") returned 4
	[0083.285] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.286] lstrlenW (lpString=".bz2") returned 4
	[0083.286] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.286] lstrlenW (lpString=".7z") returned 3
	[0083.286] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0083.286] lstrlenW (lpString=".dbf") returned 4
	[0083.286] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0083.286] lstrlenW (lpString=".1cd") returned 4
	[0083.286] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0083.286] lstrlenW (lpString=".jpg") returned 4
	[0083.286] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0083.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0083.286] lstrlenW (lpString=".doc") returned 4
	[0083.286] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.286] lstrlenW (lpString=".docx") returned 5
	[0083.286] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0083.286] lstrlenW (lpString=".pdf") returned 4
	[0083.286] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.286] lstrlenW (lpString=".xls") returned 4
	[0083.286] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.286] lstrlenW (lpString=".xlsx") returned 5
	[0083.286] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0083.287] lstrlenW (lpString=".ppt") returned 4
	[0083.287] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0083.287] lstrlenW (lpString=".zip") returned 4
	[0083.287] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.287] lstrlenW (lpString=".rar") returned 4
	[0083.287] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.287] lstrlenW (lpString=".bz2") returned 4
	[0083.287] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.287] lstrlenW (lpString=".7z") returned 3
	[0083.287] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0083.287] lstrlenW (lpString=".dbf") returned 4
	[0083.287] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0083.287] lstrlenW (lpString=".1cd") returned 4
	[0083.287] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0083.287] lstrlenW (lpString=".jpg") returned 4
	[0083.287] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.287] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0083.288] lstrlenW (lpString="oskpred.xml") returned 11
	[0083.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0083.299] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=215) returned 1
	[0083.300] CloseHandle (hObject=0x1ac) returned 1
	[0083.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20
	[0083.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0083.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0083.473] lstrlenW (lpString=".doc") returned 4
	[0083.473] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.473] lstrlenW (lpString=".docx") returned 5
	[0083.473] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0083.473] lstrlenW (lpString=".pdf") returned 4
	[0083.473] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.473] lstrlenW (lpString=".xls") returned 4
	[0083.473] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.473] lstrlenW (lpString=".xlsx") returned 5
	[0083.473] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0083.473] lstrlenW (lpString=".ppt") returned 4
	[0083.473] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0083.474] lstrlenW (lpString=".zip") returned 4
	[0083.474] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.474] lstrlenW (lpString=".rar") returned 4
	[0083.474] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.474] lstrlenW (lpString=".bz2") returned 4
	[0083.474] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.474] lstrlenW (lpString=".7z") returned 3
	[0083.474] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0083.474] lstrlenW (lpString=".dbf") returned 4
	[0083.474] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0083.474] lstrlenW (lpString=".1cd") returned 4
	[0083.474] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0083.474] lstrlenW (lpString=".jpg") returned 4
	[0083.474] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0083.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0083.474] lstrlenW (lpString=".doc") returned 4
	[0083.474] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.474] lstrlenW (lpString=".docx") returned 5
	[0083.474] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0083.474] lstrlenW (lpString=".pdf") returned 4
	[0083.475] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.475] lstrlenW (lpString=".xls") returned 4
	[0083.475] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.475] lstrlenW (lpString=".xlsx") returned 5
	[0083.475] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0083.475] lstrlenW (lpString=".ppt") returned 4
	[0083.475] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0083.475] lstrlenW (lpString=".zip") returned 4
	[0083.475] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.475] lstrlenW (lpString=".rar") returned 4
	[0083.475] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.475] lstrlenW (lpString=".bz2") returned 4
	[0083.475] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.475] lstrlenW (lpString=".7z") returned 3
	[0083.475] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0083.475] lstrlenW (lpString=".dbf") returned 4
	[0083.475] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0083.475] lstrlenW (lpString=".1cd") returned 4
	[0083.475] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0083.475] lstrlenW (lpString=".jpg") returned 4
	[0083.475] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.476] lstrcmpiW (lpString1=".xml", lpString2=".adobe") returned 1
	[0083.476] lstrlenW (lpString="symbase.xml") returned 11
	[0083.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0083.823] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2764) returned 1
	[0083.823] CloseHandle (hObject=0x160) returned 1
	[0083.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20
	[0083.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84
	[0083.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84
	[0083.858] lstrlenW (lpString=".doc") returned 4
	[0083.858] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.858] lstrlenW (lpString=".docx") returned 5
	[0083.858] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0083.858] lstrlenW (lpString=".pdf") returned 4
	[0083.858] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.858] lstrlenW (lpString=".xls") returned 4
	[0083.858] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.858] lstrlenW (lpString=".xlsx") returned 5
	[0083.858] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0083.858] lstrlenW (lpString=".ppt") returned 4
	[0083.858] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84
	[0083.858] lstrlenW (lpString=".zip") returned 4
	[0083.858] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.858] lstrlenW (lpString=".rar") returned 4
	[0083.858] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.858] lstrlenW (lpString=".bz2") returned 4
	[0083.858] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.859] lstrlenW (lpString=".7z") returned 3
	[0083.859] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84
	[0083.859] lstrlenW (lpString=".dbf") returned 4
	[0083.859] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84
	[0083.859] lstrlenW (lpString=".1cd") returned 4
	[0083.859] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84
	[0083.859] lstrlenW (lpString=".jpg") returned 4
	[0083.859] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84
	[0083.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84
	[0083.859] lstrlenW (lpString=".doc") returned 4
	[0083.859] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.859] lstrlenW (lpString=".docx") returned 5
	[0083.859] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0083.859] lstrlenW (lpString=".pdf") returned 4
	[0083.859] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.859] lstrlenW (lpString=".xls") returned 4
	[0083.859] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.859] lstrlenW (lpString=".xlsx") returned 5
	[0083.859] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0083.859] lstrlenW (lpString=".ppt") returned 4
	[0083.859] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84
	[0083.859] lstrlenW (lpString=".zip") returned 4
	[0083.859] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.859] lstrlenW (lpString=".rar") returned 4
	[0083.859] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.859] lstrlenW (lpString=".bz2") returned 4
	[0083.859] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.860] lstrlenW (lpString=".7z") returned 3
	[0083.860] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84
	[0083.860] lstrlenW (lpString=".dbf") returned 4
	[0083.860] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84
	[0083.860] lstrlenW (lpString=".1cd") returned 4
	[0083.860] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84
	[0083.860] lstrlenW (lpString=".jpg") returned 4
	[0083.860] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.860] lstrcmpiW (lpString1=".dat", lpString2=".adobe") returned 1
	[0083.860] lstrlenW (lpString="hwrcommonlm.dat") returned 15
	[0083.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.861] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=46624) returned 1
	[0083.861] CloseHandle (hObject=0x1a8) returned 1
	[0083.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20
	[0083.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0083.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0083.861] lstrlenW (lpString=".doc") returned 4
	[0083.861] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0083.861] lstrlenW (lpString=".docx") returned 5
	[0083.862] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0083.862] lstrlenW (lpString=".pdf") returned 4
	[0083.862] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0083.862] lstrlenW (lpString=".xls") returned 4
	[0083.862] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0083.862] lstrlenW (lpString=".xlsx") returned 5
	[0083.862] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0083.862] lstrlenW (lpString=".ppt") returned 4
	[0083.862] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0083.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0083.862] lstrlenW (lpString=".zip") returned 4
	[0083.862] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0083.862] lstrlenW (lpString=".rar") returned 4
	[0083.862] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0083.862] lstrlenW (lpString=".bz2") returned 4
	[0083.862] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0083.862] lstrlenW (lpString=".7z") returned 3
	[0083.862] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0083.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0083.862] lstrlenW (lpString=".dbf") returned 4
	[0083.862] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0083.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0083.862] lstrlenW (lpString=".1cd") returned 4
	[0083.862] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0083.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0083.862] lstrlenW (lpString=".jpg") returned 4
	[0083.862] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0083.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0083.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0083.863] lstrlenW (lpString=".doc") returned 4
	[0083.863] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0083.863] lstrlenW (lpString=".docx") returned 5
	[0083.863] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0083.863] lstrlenW (lpString=".pdf") returned 4
	[0083.863] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0083.863] lstrlenW (lpString=".xls") returned 4
	[0083.863] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0083.863] lstrlenW (lpString=".xlsx") returned 5
	[0083.863] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0083.863] lstrlenW (lpString=".ppt") returned 4
	[0083.863] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0083.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0083.863] lstrlenW (lpString=".zip") returned 4
	[0083.863] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0083.863] lstrlenW (lpString=".rar") returned 4
	[0083.863] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0083.863] lstrlenW (lpString=".bz2") returned 4
	[0083.863] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0083.863] lstrlenW (lpString=".7z") returned 3
	[0083.863] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0083.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0083.863] lstrlenW (lpString=".dbf") returned 4
	[0083.863] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0083.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0083.863] lstrlenW (lpString=".1cd") returned 4
	[0083.863] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0083.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0083.863] lstrlenW (lpString=".jpg") returned 4
	[0083.863] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0083.864] lstrcmpiW (lpString1=".dat", lpString2=".adobe") returned 1
	[0083.864] lstrlenW (lpString="hwrenalm.dat") returned 12
	[0083.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.866] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=747280) returned 1
	[0083.867] CloseHandle (hObject=0x1a8) returned 1
	[0083.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20
	[0083.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63
	[0083.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63
	[0083.867] lstrlenW (lpString=".doc") returned 4
	[0083.867] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0083.867] lstrlenW (lpString=".docx") returned 5
	[0083.867] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0083.867] lstrlenW (lpString=".pdf") returned 4
	[0083.867] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0083.867] lstrlenW (lpString=".xls") returned 4
	[0083.867] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0083.867] lstrlenW (lpString=".xlsx") returned 5
	[0083.867] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0083.867] lstrlenW (lpString=".ppt") returned 4
	[0083.867] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0083.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63
	[0083.868] lstrlenW (lpString=".zip") returned 4
	[0083.868] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0083.868] lstrlenW (lpString=".rar") returned 4
	[0083.868] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0083.868] lstrlenW (lpString=".bz2") returned 4
	[0083.868] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0083.868] lstrlenW (lpString=".7z") returned 3
	[0083.868] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0083.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63
	[0083.868] lstrlenW (lpString=".dbf") returned 4
	[0083.868] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0083.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63
	[0083.868] lstrlenW (lpString=".1cd") returned 4
	[0083.868] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0083.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63
	[0083.868] lstrlenW (lpString=".jpg") returned 4
	[0083.868] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0083.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63
	[0083.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63
	[0083.868] lstrlenW (lpString=".doc") returned 4
	[0083.868] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0083.868] lstrlenW (lpString=".docx") returned 5
	[0083.868] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0083.868] lstrlenW (lpString=".pdf") returned 4
	[0083.868] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0083.868] lstrlenW (lpString=".xls") returned 4
	[0083.868] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0083.868] lstrlenW (lpString=".xlsx") returned 5
	[0083.868] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0083.869] lstrlenW (lpString=".ppt") returned 4
	[0083.869] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0083.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63
	[0083.869] lstrlenW (lpString=".zip") returned 4
	[0083.869] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0083.869] lstrlenW (lpString=".rar") returned 4
	[0083.869] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0083.869] lstrlenW (lpString=".bz2") returned 4
	[0083.869] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0083.869] lstrlenW (lpString=".7z") returned 3
	[0083.869] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0083.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63
	[0083.869] lstrlenW (lpString=".dbf") returned 4
	[0083.869] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0083.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63
	[0083.869] lstrlenW (lpString=".1cd") returned 4
	[0083.869] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0083.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63
	[0083.869] lstrlenW (lpString=".jpg") returned 4
	[0083.869] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0083.869] lstrcmpiW (lpString1=".dat", lpString2=".adobe") returned 1
	[0083.869] lstrlenW (lpString="hwrenclm.dat") returned 12
	[0083.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.870] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=815680) returned 1
	[0083.870] CloseHandle (hObject=0x1a8) returned 1
	[0083.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20
	[0083.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0083.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0083.870] lstrlenW (lpString=".doc") returned 4
	[0083.870] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0083.871] lstrlenW (lpString=".docx") returned 5
	[0083.871] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0083.871] lstrlenW (lpString=".pdf") returned 4
	[0083.871] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0083.871] lstrlenW (lpString=".xls") returned 4
	[0083.871] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0083.871] lstrlenW (lpString=".xlsx") returned 5
	[0083.871] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0083.871] lstrlenW (lpString=".ppt") returned 4
	[0083.871] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0083.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0083.871] lstrlenW (lpString=".zip") returned 4
	[0083.871] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0083.871] lstrlenW (lpString=".rar") returned 4
	[0083.871] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0083.871] lstrlenW (lpString=".bz2") returned 4
	[0083.871] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0083.871] lstrlenW (lpString=".7z") returned 3
	[0083.871] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0083.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0083.871] lstrlenW (lpString=".dbf") returned 4
	[0083.871] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0083.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0083.871] lstrlenW (lpString=".1cd") returned 4
	[0083.871] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0083.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0083.871] lstrlenW (lpString=".jpg") returned 4
	[0083.871] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0083.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0083.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0083.872] lstrlenW (lpString=".doc") returned 4
	[0083.872] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0083.872] lstrlenW (lpString=".docx") returned 5
	[0083.872] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0083.872] lstrlenW (lpString=".pdf") returned 4
	[0083.872] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0083.872] lstrlenW (lpString=".xls") returned 4
	[0083.872] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0083.872] lstrlenW (lpString=".xlsx") returned 5
	[0083.872] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0083.872] lstrlenW (lpString=".ppt") returned 4
	[0083.873] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0083.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0083.873] lstrlenW (lpString=".zip") returned 4
	[0083.873] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0083.873] lstrlenW (lpString=".rar") returned 4
	[0083.873] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0083.873] lstrlenW (lpString=".bz2") returned 4
	[0083.873] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0083.873] lstrlenW (lpString=".7z") returned 3
	[0083.873] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0083.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0083.873] lstrlenW (lpString=".dbf") returned 4
	[0083.873] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0083.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0083.873] lstrlenW (lpString=".1cd") returned 4
	[0083.873] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0083.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0083.873] lstrlenW (lpString=".jpg") returned 4
	[0083.873] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0083.873] lstrcmpiW (lpString1=".dat", lpString2=".adobe") returned 1
	[0083.873] lstrlenW (lpString="hwrlatinlm.dat") returned 14
	[0083.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.874] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1100368) returned 1
	[0083.874] CloseHandle (hObject=0x1a8) returned 1
	[0083.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20
	[0083.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0083.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0083.875] lstrlenW (lpString=".doc") returned 4
	[0083.875] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0083.875] lstrlenW (lpString=".docx") returned 5
	[0083.875] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0083.875] lstrlenW (lpString=".pdf") returned 4
	[0083.875] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0083.875] lstrlenW (lpString=".xls") returned 4
	[0083.875] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0083.875] lstrlenW (lpString=".xlsx") returned 5
	[0083.875] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0083.875] lstrlenW (lpString=".ppt") returned 4
	[0083.875] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0083.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0083.875] lstrlenW (lpString=".zip") returned 4
	[0083.875] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0083.875] lstrlenW (lpString=".rar") returned 4
	[0083.875] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0083.875] lstrlenW (lpString=".bz2") returned 4
	[0083.875] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0083.875] lstrlenW (lpString=".7z") returned 3
	[0083.875] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0083.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0083.875] lstrlenW (lpString=".dbf") returned 4
	[0083.875] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0083.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0083.875] lstrlenW (lpString=".1cd") returned 4
	[0083.875] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0083.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0083.875] lstrlenW (lpString=".jpg") returned 4
	[0083.875] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0083.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0083.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0083.876] lstrlenW (lpString=".doc") returned 4
	[0083.876] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0083.876] lstrlenW (lpString=".docx") returned 5
	[0083.876] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0083.876] lstrlenW (lpString=".pdf") returned 4
	[0083.876] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0083.876] lstrlenW (lpString=".xls") returned 4
	[0083.876] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0083.876] lstrlenW (lpString=".xlsx") returned 5
	[0083.876] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0083.876] lstrlenW (lpString=".ppt") returned 4
	[0083.876] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0083.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0083.876] lstrlenW (lpString=".zip") returned 4
	[0083.876] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0083.876] lstrlenW (lpString=".rar") returned 4
	[0083.876] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0083.876] lstrlenW (lpString=".bz2") returned 4
	[0083.876] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0083.876] lstrlenW (lpString=".7z") returned 3
	[0083.876] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0083.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0083.876] lstrlenW (lpString=".dbf") returned 4
	[0083.876] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0083.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0083.876] lstrlenW (lpString=".1cd") returned 4
	[0083.876] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0083.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0083.877] lstrlenW (lpString=".jpg") returned 4
	[0083.877] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0083.877] lstrcmpiW (lpString1=".dat", lpString2=".adobe") returned 1
	[0083.877] lstrlenW (lpString="hwruklm.dat") returned 11
	[0083.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.878] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3053984) returned 1
	[0083.878] CloseHandle (hObject=0x1a8) returned 1
	[0083.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0x20
	[0083.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0083.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0083.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0083.879] lstrlenW (lpString=".doc") returned 4
	[0083.879] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0083.879] lstrlenW (lpString=".docx") returned 5
	[0083.879] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0083.879] lstrlenW (lpString=".pdf") returned 4
	[0083.879] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0083.879] lstrlenW (lpString=".xls") returned 4
	[0083.879] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0083.879] lstrlenW (lpString=".xlsx") returned 5
	[0083.879] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0083.879] lstrlenW (lpString=".ppt") returned 4
	[0083.879] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0083.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0083.879] lstrlenW (lpString=".zip") returned 4
	[0083.879] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0083.879] lstrlenW (lpString=".rar") returned 4
	[0083.879] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0083.879] lstrlenW (lpString=".bz2") returned 4
	[0083.879] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0083.879] lstrlenW (lpString=".7z") returned 3
	[0083.879] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0083.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0083.879] lstrlenW (lpString=".dbf") returned 4
	[0083.879] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0083.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0083.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0083.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0084.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0084.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.631] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fc6c | out: lpNewFilePointer=0x0) returned 1
	[0084.631] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.631] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x319fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x319fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.637] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x319fc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.637] ReadFile (in: hFile=0x1b0, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x319fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x319fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.641] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x319fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0084.641] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x319fc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.641] ReadFile (in: hFile=0x1b0, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x319fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x319fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.664] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.664] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x319fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0084.698] SetEndOfFile (hFile=0x1b0) returned 1
	[0084.698] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0084.703] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fc7c | out: lpNewFilePointer=0x0) returned 1
	[0084.703] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x319fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x319fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0084.705] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x319fc7c | out: lpNewFilePointer=0x0) returned 1
	[0084.705] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x319fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x319fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0084.708] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x319fc7c | out: lpNewFilePointer=0x0) returned 1
	[0084.708] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x319fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x319fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0084.711] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0084.711] CloseHandle (hObject=0x1b0) returned 1
	[0084.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0084.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0084.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0084.712] lstrlenW (lpString=".doc") returned 4
	[0084.712] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0084.712] lstrlenW (lpString=".docx") returned 5
	[0084.712] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1
	[0084.712] lstrlenW (lpString=".pdf") returned 4
	[0084.712] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0084.712] lstrlenW (lpString=".xls") returned 4
	[0084.712] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0084.712] lstrlenW (lpString=".xlsx") returned 5
	[0084.712] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1
	[0084.712] lstrlenW (lpString=".ppt") returned 4
	[0084.712] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0084.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0084.712] lstrlenW (lpString=".zip") returned 4
	[0084.712] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0084.712] lstrlenW (lpString=".rar") returned 4
	[0084.713] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0084.713] lstrlenW (lpString=".bz2") returned 4
	[0084.713] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0084.713] lstrlenW (lpString=".7z") returned 3
	[0084.713] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0084.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0084.713] lstrlenW (lpString=".dbf") returned 4
	[0084.713] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0084.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0084.713] lstrlenW (lpString=".1cd") returned 4
	[0084.713] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0084.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0084.713] lstrlenW (lpString=".jpg") returned 4
	[0084.713] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0084.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0084.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0084.713] lstrlenW (lpString=".doc") returned 4
	[0084.713] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0084.713] lstrlenW (lpString=".docx") returned 5
	[0084.713] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1
	[0084.714] lstrlenW (lpString=".pdf") returned 4
	[0084.714] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0084.714] lstrlenW (lpString=".xls") returned 4
	[0084.714] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0084.714] lstrlenW (lpString=".xlsx") returned 5
	[0084.714] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1
	[0084.714] lstrlenW (lpString=".ppt") returned 4
	[0084.714] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0084.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0084.714] lstrlenW (lpString=".zip") returned 4
	[0084.714] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0084.714] lstrlenW (lpString=".rar") returned 4
	[0084.714] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0084.714] lstrlenW (lpString=".bz2") returned 4
	[0084.714] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0084.714] lstrlenW (lpString=".7z") returned 3
	[0084.714] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0084.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0084.714] lstrlenW (lpString=".dbf") returned 4
	[0084.714] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0084.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0084.714] lstrlenW (lpString=".1cd") returned 4
	[0084.714] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0084.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0084.714] lstrlenW (lpString=".jpg") returned 4
	[0084.715] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0084.715] lstrcmpiW (lpString1=".HTM", lpString2=".adobe") returned 1
	[0084.715] lstrlenW (lpString="README.HTM") returned 10
	[0084.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.718] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1941) returned 1
	[0084.718] CloseHandle (hObject=0x1b0) returned 1
	[0084.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20
	[0084.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.719] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.719] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.720] GetLastError () returned 0x0
	[0084.720] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x795, lpOverlapped=0x0) returned 1
	[0084.727] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x7a0, lpOverlapped=0x0) returned 1
	[0084.729] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.729] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0084.730] SetEndOfFile (hFile=0x1ac) returned 1
	[0084.730] CloseHandle (hObject=0x1ac) returned 1
	[0084.730] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.730] SetEndOfFile (hFile=0x1b0) returned 1
	[0084.731] CloseHandle (hObject=0x1b0) returned 1
	[0084.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0084.732] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1
	[0084.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0084.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0084.732] lstrlenW (lpString=".doc") returned 4
	[0084.732] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0084.732] lstrlenW (lpString=".docx") returned 5
	[0084.733] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1
	[0084.733] lstrlenW (lpString=".pdf") returned 4
	[0084.733] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0084.733] lstrlenW (lpString=".xls") returned 4
	[0084.733] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0084.733] lstrlenW (lpString=".xlsx") returned 5
	[0084.733] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1
	[0084.733] lstrlenW (lpString=".ppt") returned 4
	[0084.733] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0084.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0084.733] lstrlenW (lpString=".zip") returned 4
	[0084.733] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0084.733] lstrlenW (lpString=".rar") returned 4
	[0084.733] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0084.733] lstrlenW (lpString=".bz2") returned 4
	[0084.733] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0084.733] lstrlenW (lpString=".7z") returned 3
	[0084.733] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0084.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0084.733] lstrlenW (lpString=".dbf") returned 4
	[0084.733] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0084.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0084.733] lstrlenW (lpString=".1cd") returned 4
	[0084.733] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0084.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0084.734] lstrlenW (lpString=".jpg") returned 4
	[0084.734] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0084.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0084.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0084.734] lstrlenW (lpString=".doc") returned 4
	[0084.734] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0084.734] lstrlenW (lpString=".docx") returned 5
	[0084.734] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1
	[0084.734] lstrlenW (lpString=".pdf") returned 4
	[0084.734] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0084.734] lstrlenW (lpString=".xls") returned 4
	[0084.734] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0084.734] lstrlenW (lpString=".xlsx") returned 5
	[0084.734] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1
	[0084.734] lstrlenW (lpString=".ppt") returned 4
	[0084.734] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0084.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0084.734] lstrlenW (lpString=".zip") returned 4
	[0084.734] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0084.734] lstrlenW (lpString=".rar") returned 4
	[0084.734] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0084.734] lstrlenW (lpString=".bz2") returned 4
	[0084.735] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0084.735] lstrlenW (lpString=".7z") returned 3
	[0084.735] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0084.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0084.735] lstrlenW (lpString=".dbf") returned 4
	[0084.735] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0084.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0084.735] lstrlenW (lpString=".1cd") returned 4
	[0084.735] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0084.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0084.735] lstrlenW (lpString=".jpg") returned 4
	[0084.735] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0084.735] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0084.735] lstrlenW (lpString="AccessMUI.XML") returned 13
	[0084.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.737] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1349) returned 1
	[0084.737] CloseHandle (hObject=0x1b0) returned 1
	[0084.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20
	[0084.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.741] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.741] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.742] GetLastError () returned 0x0
	[0084.742] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x545, lpOverlapped=0x0) returned 1
	[0084.748] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0084.750] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.750] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0084.750] SetEndOfFile (hFile=0x1ac) returned 1
	[0084.750] CloseHandle (hObject=0x1ac) returned 1
	[0084.750] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.750] SetEndOfFile (hFile=0x1b0) returned 1
	[0084.751] CloseHandle (hObject=0x1b0) returned 1
	[0084.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0084.752] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1
	[0084.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0084.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0084.752] lstrlenW (lpString=".doc") returned 4
	[0084.752] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.752] lstrlenW (lpString=".docx") returned 5
	[0084.752] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0084.752] lstrlenW (lpString=".pdf") returned 4
	[0084.752] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.752] lstrlenW (lpString=".xls") returned 4
	[0084.753] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.753] lstrlenW (lpString=".xlsx") returned 5
	[0084.753] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0084.753] lstrlenW (lpString=".ppt") returned 4
	[0084.753] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0084.753] lstrlenW (lpString=".zip") returned 4
	[0084.753] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.753] lstrlenW (lpString=".rar") returned 4
	[0084.753] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.753] lstrlenW (lpString=".bz2") returned 4
	[0084.753] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.753] lstrlenW (lpString=".7z") returned 3
	[0084.753] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0084.753] lstrlenW (lpString=".dbf") returned 4
	[0084.753] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0084.753] lstrlenW (lpString=".1cd") returned 4
	[0084.753] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0084.753] lstrlenW (lpString=".jpg") returned 4
	[0084.753] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0084.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0084.754] lstrlenW (lpString=".doc") returned 4
	[0084.754] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.754] lstrlenW (lpString=".docx") returned 5
	[0084.754] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0084.754] lstrlenW (lpString=".pdf") returned 4
	[0084.754] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.754] lstrlenW (lpString=".xls") returned 4
	[0084.754] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.754] lstrlenW (lpString=".xlsx") returned 5
	[0084.754] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0084.754] lstrlenW (lpString=".ppt") returned 4
	[0084.754] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0084.754] lstrlenW (lpString=".zip") returned 4
	[0084.754] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.754] lstrlenW (lpString=".rar") returned 4
	[0084.754] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.754] lstrlenW (lpString=".bz2") returned 4
	[0084.754] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.754] lstrlenW (lpString=".7z") returned 3
	[0084.754] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0084.754] lstrlenW (lpString=".dbf") returned 4
	[0084.754] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0084.755] lstrlenW (lpString=".1cd") returned 4
	[0084.755] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0084.755] lstrlenW (lpString=".jpg") returned 4
	[0084.755] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.755] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0084.755] lstrlenW (lpString="AccessMUISet.XML") returned 16
	[0084.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.756] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=819) returned 1
	[0084.756] CloseHandle (hObject=0x1b0) returned 1
	[0084.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20
	[0084.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.757] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.757] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.758] GetLastError () returned 0x0
	[0084.758] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x333, lpOverlapped=0x0) returned 1
	[0084.760] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x340, lpOverlapped=0x0) returned 1
	[0084.763] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.763] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0084.763] SetEndOfFile (hFile=0x1ac) returned 1
	[0084.764] CloseHandle (hObject=0x1ac) returned 1
	[0084.764] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.764] SetEndOfFile (hFile=0x1b0) returned 1
	[0084.765] CloseHandle (hObject=0x1b0) returned 1
	[0084.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0084.765] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1
	[0084.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0084.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0084.766] lstrlenW (lpString=".doc") returned 4
	[0084.766] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.766] lstrlenW (lpString=".docx") returned 5
	[0084.766] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0084.766] lstrlenW (lpString=".pdf") returned 4
	[0084.766] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.766] lstrlenW (lpString=".xls") returned 4
	[0084.766] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.766] lstrlenW (lpString=".xlsx") returned 5
	[0084.766] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0084.766] lstrlenW (lpString=".ppt") returned 4
	[0084.766] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0084.766] lstrlenW (lpString=".zip") returned 4
	[0084.767] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.767] lstrlenW (lpString=".rar") returned 4
	[0084.767] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.767] lstrlenW (lpString=".bz2") returned 4
	[0084.767] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.767] lstrlenW (lpString=".7z") returned 3
	[0084.767] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0084.767] lstrlenW (lpString=".dbf") returned 4
	[0084.767] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0084.767] lstrlenW (lpString=".1cd") returned 4
	[0084.767] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0084.767] lstrlenW (lpString=".jpg") returned 4
	[0084.767] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0084.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0084.767] lstrlenW (lpString=".doc") returned 4
	[0084.767] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.767] lstrlenW (lpString=".docx") returned 5
	[0084.767] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0084.767] lstrlenW (lpString=".pdf") returned 4
	[0084.768] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.768] lstrlenW (lpString=".xls") returned 4
	[0084.768] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.768] lstrlenW (lpString=".xlsx") returned 5
	[0084.768] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0084.768] lstrlenW (lpString=".ppt") returned 4
	[0084.768] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0084.768] lstrlenW (lpString=".zip") returned 4
	[0084.768] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.768] lstrlenW (lpString=".rar") returned 4
	[0084.768] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.768] lstrlenW (lpString=".bz2") returned 4
	[0084.768] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.768] lstrlenW (lpString=".7z") returned 3
	[0084.768] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0084.768] lstrlenW (lpString=".dbf") returned 4
	[0084.768] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0084.769] lstrlenW (lpString=".1cd") returned 4
	[0084.769] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0084.769] lstrlenW (lpString=".jpg") returned 4
	[0084.769] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.769] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0084.769] lstrlenW (lpString="SETUP.XML") returned 9
	[0084.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.771] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2624) returned 1
	[0084.771] CloseHandle (hObject=0x1ac) returned 1
	[0084.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20
	[0084.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.772] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.772] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0084.773] GetLastError () returned 0x0
	[0084.773] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xa40, lpOverlapped=0x0) returned 1
	[0084.775] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xa50, lpOverlapped=0x0) returned 1
	[0084.776] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.776] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0084.776] SetEndOfFile (hFile=0x160) returned 1
	[0084.776] CloseHandle (hObject=0x160) returned 1
	[0084.777] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.777] SetEndOfFile (hFile=0x1ac) returned 1
	[0084.778] CloseHandle (hObject=0x1ac) returned 1
	[0084.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0084.778] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1
	[0084.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0084.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0084.778] lstrlenW (lpString=".doc") returned 4
	[0084.778] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.779] lstrlenW (lpString=".docx") returned 5
	[0084.779] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0084.779] lstrlenW (lpString=".pdf") returned 4
	[0084.779] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.779] lstrlenW (lpString=".xls") returned 4
	[0084.779] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.779] lstrlenW (lpString=".xlsx") returned 5
	[0084.779] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0084.779] lstrlenW (lpString=".ppt") returned 4
	[0084.779] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0084.779] lstrlenW (lpString=".zip") returned 4
	[0084.779] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.779] lstrlenW (lpString=".rar") returned 4
	[0084.779] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.779] lstrlenW (lpString=".bz2") returned 4
	[0084.779] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.779] lstrlenW (lpString=".7z") returned 3
	[0084.779] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0084.779] lstrlenW (lpString=".dbf") returned 4
	[0084.779] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0084.779] lstrlenW (lpString=".1cd") returned 4
	[0084.779] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0084.779] lstrlenW (lpString=".jpg") returned 4
	[0084.780] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0084.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0084.780] lstrlenW (lpString=".doc") returned 4
	[0084.780] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.780] lstrlenW (lpString=".docx") returned 5
	[0084.780] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0084.780] lstrlenW (lpString=".pdf") returned 4
	[0084.780] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.780] lstrlenW (lpString=".xls") returned 4
	[0084.780] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.780] lstrlenW (lpString=".xlsx") returned 5
	[0084.780] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0084.780] lstrlenW (lpString=".ppt") returned 4
	[0084.780] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0084.780] lstrlenW (lpString=".zip") returned 4
	[0084.780] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.780] lstrlenW (lpString=".rar") returned 4
	[0084.780] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.780] lstrlenW (lpString=".bz2") returned 4
	[0084.780] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.780] lstrlenW (lpString=".7z") returned 3
	[0084.780] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0084.780] lstrlenW (lpString=".dbf") returned 4
	[0084.780] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0084.781] lstrlenW (lpString=".1cd") returned 4
	[0084.781] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0084.781] lstrlenW (lpString=".jpg") returned 4
	[0084.781] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.781] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0084.781] lstrlenW (lpString="ExcelMUI.XML") returned 12
	[0084.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.782] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1565) returned 1
	[0084.782] CloseHandle (hObject=0x1ac) returned 1
	[0084.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20
	[0084.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.783] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.783] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0084.783] GetLastError () returned 0x0
	[0084.783] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x61d, lpOverlapped=0x0) returned 1
	[0084.786] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x620, lpOverlapped=0x0) returned 1
	[0084.788] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.788] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0084.788] SetEndOfFile (hFile=0x160) returned 1
	[0084.788] CloseHandle (hObject=0x160) returned 1
	[0084.788] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.788] SetEndOfFile (hFile=0x1ac) returned 1
	[0084.789] CloseHandle (hObject=0x1ac) returned 1
	[0084.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0084.790] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1
	[0084.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0084.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0084.790] lstrlenW (lpString=".doc") returned 4
	[0084.790] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.790] lstrlenW (lpString=".docx") returned 5
	[0084.790] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0084.790] lstrlenW (lpString=".pdf") returned 4
	[0084.790] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.790] lstrlenW (lpString=".xls") returned 4
	[0084.790] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.790] lstrlenW (lpString=".xlsx") returned 5
	[0084.790] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0084.791] lstrlenW (lpString=".ppt") returned 4
	[0084.791] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0084.791] lstrlenW (lpString=".zip") returned 4
	[0084.791] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.791] lstrlenW (lpString=".rar") returned 4
	[0084.791] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.791] lstrlenW (lpString=".bz2") returned 4
	[0084.791] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.791] lstrlenW (lpString=".7z") returned 3
	[0084.791] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0084.791] lstrlenW (lpString=".dbf") returned 4
	[0084.791] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0084.791] lstrlenW (lpString=".1cd") returned 4
	[0084.791] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0084.791] lstrlenW (lpString=".jpg") returned 4
	[0084.791] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0084.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0084.791] lstrlenW (lpString=".doc") returned 4
	[0084.792] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.792] lstrlenW (lpString=".docx") returned 5
	[0084.792] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0084.792] lstrlenW (lpString=".pdf") returned 4
	[0084.792] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.792] lstrlenW (lpString=".xls") returned 4
	[0084.792] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.792] lstrlenW (lpString=".xlsx") returned 5
	[0084.792] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0084.792] lstrlenW (lpString=".ppt") returned 4
	[0084.792] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0084.792] lstrlenW (lpString=".zip") returned 4
	[0084.792] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.792] lstrlenW (lpString=".rar") returned 4
	[0084.792] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.792] lstrlenW (lpString=".bz2") returned 4
	[0084.792] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.792] lstrlenW (lpString=".7z") returned 3
	[0084.792] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0084.792] lstrlenW (lpString=".dbf") returned 4
	[0084.792] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0084.792] lstrlenW (lpString=".1cd") returned 4
	[0084.792] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0084.793] lstrlenW (lpString=".jpg") returned 4
	[0084.793] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.793] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0084.793] lstrlenW (lpString="SETUP.XML") returned 9
	[0084.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.795] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2296) returned 1
	[0084.795] CloseHandle (hObject=0x1b0) returned 1
	[0084.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20
	[0084.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.796] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.796] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.799] GetLastError () returned 0x0
	[0084.799] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x8f8, lpOverlapped=0x0) returned 1
	[0084.800] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x900, lpOverlapped=0x0) returned 1
	[0084.802] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.802] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0084.802] SetEndOfFile (hFile=0x1ac) returned 1
	[0084.802] CloseHandle (hObject=0x1ac) returned 1
	[0084.802] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.802] SetEndOfFile (hFile=0x1b0) returned 1
	[0084.804] CloseHandle (hObject=0x1b0) returned 1
	[0084.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0084.804] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1
	[0084.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0084.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0084.804] lstrlenW (lpString=".doc") returned 4
	[0084.804] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.804] lstrlenW (lpString=".docx") returned 5
	[0084.804] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0084.804] lstrlenW (lpString=".pdf") returned 4
	[0084.805] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.805] lstrlenW (lpString=".xls") returned 4
	[0084.805] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.805] lstrlenW (lpString=".xlsx") returned 5
	[0084.805] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0084.805] lstrlenW (lpString=".ppt") returned 4
	[0084.805] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0084.805] lstrlenW (lpString=".zip") returned 4
	[0084.805] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.805] lstrlenW (lpString=".rar") returned 4
	[0084.805] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.805] lstrlenW (lpString=".bz2") returned 4
	[0084.805] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.805] lstrlenW (lpString=".7z") returned 3
	[0084.805] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0084.805] lstrlenW (lpString=".dbf") returned 4
	[0084.805] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0084.805] lstrlenW (lpString=".1cd") returned 4
	[0084.805] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0084.805] lstrlenW (lpString=".jpg") returned 4
	[0084.805] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0084.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0084.806] lstrlenW (lpString=".doc") returned 4
	[0084.806] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.806] lstrlenW (lpString=".docx") returned 5
	[0084.806] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0084.806] lstrlenW (lpString=".pdf") returned 4
	[0084.806] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.806] lstrlenW (lpString=".xls") returned 4
	[0084.806] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.806] lstrlenW (lpString=".xlsx") returned 5
	[0084.806] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0084.806] lstrlenW (lpString=".ppt") returned 4
	[0084.806] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0084.806] lstrlenW (lpString=".zip") returned 4
	[0084.806] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.806] lstrlenW (lpString=".rar") returned 4
	[0084.806] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.806] lstrlenW (lpString=".bz2") returned 4
	[0084.806] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.806] lstrlenW (lpString=".7z") returned 3
	[0084.806] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0084.806] lstrlenW (lpString=".dbf") returned 4
	[0084.807] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0084.807] lstrlenW (lpString=".1cd") returned 4
	[0084.807] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0084.807] lstrlenW (lpString=".jpg") returned 4
	[0084.807] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.807] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0084.807] lstrlenW (lpString="GrooveMUI.XML") returned 13
	[0084.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.808] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=913) returned 1
	[0084.808] CloseHandle (hObject=0x1b0) returned 1
	[0084.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20
	[0084.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.809] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.809] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.827] GetLastError () returned 0x0
	[0084.827] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x391, lpOverlapped=0x0) returned 1
	[0084.831] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x3a0, lpOverlapped=0x0) returned 1
	[0084.833] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.833] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0084.833] SetEndOfFile (hFile=0x1ac) returned 1
	[0084.833] CloseHandle (hObject=0x1ac) returned 1
	[0084.833] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.833] SetEndOfFile (hFile=0x1b0) returned 1
	[0084.835] CloseHandle (hObject=0x1b0) returned 1
	[0084.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0084.835] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1
	[0084.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0084.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0084.835] lstrlenW (lpString=".doc") returned 4
	[0084.835] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.835] lstrlenW (lpString=".docx") returned 5
	[0084.836] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0084.836] lstrlenW (lpString=".pdf") returned 4
	[0084.836] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.836] lstrlenW (lpString=".xls") returned 4
	[0084.836] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.836] lstrlenW (lpString=".xlsx") returned 5
	[0084.836] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0084.836] lstrlenW (lpString=".ppt") returned 4
	[0084.836] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0084.836] lstrlenW (lpString=".zip") returned 4
	[0084.836] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.836] lstrlenW (lpString=".rar") returned 4
	[0084.836] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.836] lstrlenW (lpString=".bz2") returned 4
	[0084.836] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.836] lstrlenW (lpString=".7z") returned 3
	[0084.836] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0084.836] lstrlenW (lpString=".dbf") returned 4
	[0084.836] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0084.836] lstrlenW (lpString=".1cd") returned 4
	[0084.836] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0084.837] lstrlenW (lpString=".jpg") returned 4
	[0084.837] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0084.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0084.837] lstrlenW (lpString=".doc") returned 4
	[0084.837] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.837] lstrlenW (lpString=".docx") returned 5
	[0084.837] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0084.837] lstrlenW (lpString=".pdf") returned 4
	[0084.837] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.837] lstrlenW (lpString=".xls") returned 4
	[0084.837] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.837] lstrlenW (lpString=".xlsx") returned 5
	[0084.837] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0084.837] lstrlenW (lpString=".ppt") returned 4
	[0084.837] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0084.837] lstrlenW (lpString=".zip") returned 4
	[0084.837] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.837] lstrlenW (lpString=".rar") returned 4
	[0084.837] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.837] lstrlenW (lpString=".bz2") returned 4
	[0084.837] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.838] lstrlenW (lpString=".7z") returned 3
	[0084.838] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0084.838] lstrlenW (lpString=".dbf") returned 4
	[0084.838] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0084.838] lstrlenW (lpString=".1cd") returned 4
	[0084.838] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0084.838] lstrlenW (lpString=".jpg") returned 4
	[0084.838] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.838] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0084.838] lstrlenW (lpString="SETUP.XML") returned 9
	[0084.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.840] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1452) returned 1
	[0084.840] CloseHandle (hObject=0x1b0) returned 1
	[0084.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20
	[0084.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.840] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.841] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.841] GetLastError () returned 0x0
	[0084.841] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x5ac, lpOverlapped=0x0) returned 1
	[0084.843] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0084.845] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.845] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0084.845] SetEndOfFile (hFile=0x1ac) returned 1
	[0084.845] CloseHandle (hObject=0x1ac) returned 1
	[0084.845] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.845] SetEndOfFile (hFile=0x1b0) returned 1
	[0084.846] CloseHandle (hObject=0x1b0) returned 1
	[0084.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0084.847] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1
	[0084.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0084.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0084.847] lstrlenW (lpString=".doc") returned 4
	[0084.847] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.847] lstrlenW (lpString=".docx") returned 5
	[0084.847] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0084.848] lstrlenW (lpString=".pdf") returned 4
	[0084.848] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.848] lstrlenW (lpString=".xls") returned 4
	[0084.848] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.848] lstrlenW (lpString=".xlsx") returned 5
	[0084.848] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0084.848] lstrlenW (lpString=".ppt") returned 4
	[0084.848] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0084.848] lstrlenW (lpString=".zip") returned 4
	[0084.848] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.848] lstrlenW (lpString=".rar") returned 4
	[0084.848] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.848] lstrlenW (lpString=".bz2") returned 4
	[0084.848] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.848] lstrlenW (lpString=".7z") returned 3
	[0084.848] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0084.849] lstrlenW (lpString=".dbf") returned 4
	[0084.849] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0084.849] lstrlenW (lpString=".1cd") returned 4
	[0084.849] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0084.849] lstrlenW (lpString=".jpg") returned 4
	[0084.849] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0084.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0084.849] lstrlenW (lpString=".doc") returned 4
	[0084.849] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.849] lstrlenW (lpString=".docx") returned 5
	[0084.849] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0084.849] lstrlenW (lpString=".pdf") returned 4
	[0084.849] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.850] lstrlenW (lpString=".xls") returned 4
	[0084.850] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.850] lstrlenW (lpString=".xlsx") returned 5
	[0084.850] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0084.850] lstrlenW (lpString=".ppt") returned 4
	[0084.850] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0084.850] lstrlenW (lpString=".zip") returned 4
	[0084.850] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.850] lstrlenW (lpString=".rar") returned 4
	[0084.850] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.850] lstrlenW (lpString=".bz2") returned 4
	[0084.850] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.850] lstrlenW (lpString=".7z") returned 3
	[0084.850] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0084.850] lstrlenW (lpString=".dbf") returned 4
	[0084.850] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0084.851] lstrlenW (lpString=".1cd") returned 4
	[0084.851] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0084.851] lstrlenW (lpString=".jpg") returned 4
	[0084.851] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.851] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0084.851] lstrlenW (lpString="InfoPathMUI.XML") returned 15
	[0084.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.852] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1231) returned 1
	[0084.852] CloseHandle (hObject=0x1b0) returned 1
	[0084.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20
	[0084.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.853] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.853] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.855] GetLastError () returned 0x0
	[0084.855] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x4cf, lpOverlapped=0x0) returned 1
	[0084.857] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x4d0, lpOverlapped=0x0) returned 1
	[0084.858] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.859] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0084.859] SetEndOfFile (hFile=0x1ac) returned 1
	[0084.859] CloseHandle (hObject=0x1ac) returned 1
	[0084.859] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.859] SetEndOfFile (hFile=0x1b0) returned 1
	[0084.860] CloseHandle (hObject=0x1b0) returned 1
	[0084.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0084.861] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1
	[0084.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0084.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0084.861] lstrlenW (lpString=".doc") returned 4
	[0084.861] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.861] lstrlenW (lpString=".docx") returned 5
	[0084.861] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0084.861] lstrlenW (lpString=".pdf") returned 4
	[0084.862] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.862] lstrlenW (lpString=".xls") returned 4
	[0084.862] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.862] lstrlenW (lpString=".xlsx") returned 5
	[0084.862] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0084.862] lstrlenW (lpString=".ppt") returned 4
	[0084.862] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0084.862] lstrlenW (lpString=".zip") returned 4
	[0084.862] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.862] lstrlenW (lpString=".rar") returned 4
	[0084.862] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.862] lstrlenW (lpString=".bz2") returned 4
	[0084.862] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.862] lstrlenW (lpString=".7z") returned 3
	[0084.862] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0084.863] lstrlenW (lpString=".dbf") returned 4
	[0084.863] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0084.863] lstrlenW (lpString=".1cd") returned 4
	[0084.863] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0084.863] lstrlenW (lpString=".jpg") returned 4
	[0084.863] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0084.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0084.863] lstrlenW (lpString=".doc") returned 4
	[0084.863] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.863] lstrlenW (lpString=".docx") returned 5
	[0084.863] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0084.863] lstrlenW (lpString=".pdf") returned 4
	[0084.863] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.863] lstrlenW (lpString=".xls") returned 4
	[0084.864] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.864] lstrlenW (lpString=".xlsx") returned 5
	[0084.864] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0084.864] lstrlenW (lpString=".ppt") returned 4
	[0084.864] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0084.864] lstrlenW (lpString=".zip") returned 4
	[0084.864] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.864] lstrlenW (lpString=".rar") returned 4
	[0084.864] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.864] lstrlenW (lpString=".bz2") returned 4
	[0084.864] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.864] lstrlenW (lpString=".7z") returned 3
	[0084.864] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0084.864] lstrlenW (lpString=".dbf") returned 4
	[0084.864] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0084.865] lstrlenW (lpString=".1cd") returned 4
	[0084.865] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0084.865] lstrlenW (lpString=".jpg") returned 4
	[0084.865] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.865] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0084.865] lstrlenW (lpString="SETUP.XML") returned 9
	[0084.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.866] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1852) returned 1
	[0084.866] CloseHandle (hObject=0x1b0) returned 1
	[0084.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20
	[0084.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.867] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.867] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.867] GetLastError () returned 0x0
	[0084.868] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x73c, lpOverlapped=0x0) returned 1
	[0084.872] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x740, lpOverlapped=0x0) returned 1
	[0084.874] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.874] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0084.874] SetEndOfFile (hFile=0x1ac) returned 1
	[0084.874] CloseHandle (hObject=0x1ac) returned 1
	[0084.875] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.875] SetEndOfFile (hFile=0x1b0) returned 1
	[0084.876] CloseHandle (hObject=0x1b0) returned 1
	[0084.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0084.877] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1
	[0084.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0084.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0084.877] lstrlenW (lpString=".doc") returned 4
	[0084.877] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.877] lstrlenW (lpString=".docx") returned 5
	[0084.877] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0084.877] lstrlenW (lpString=".pdf") returned 4
	[0084.877] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.877] lstrlenW (lpString=".xls") returned 4
	[0084.878] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.878] lstrlenW (lpString=".xlsx") returned 5
	[0084.878] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0084.878] lstrlenW (lpString=".ppt") returned 4
	[0084.878] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0084.878] lstrlenW (lpString=".zip") returned 4
	[0084.878] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.878] lstrlenW (lpString=".rar") returned 4
	[0084.878] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.878] lstrlenW (lpString=".bz2") returned 4
	[0084.878] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.878] lstrlenW (lpString=".7z") returned 3
	[0084.878] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0084.878] lstrlenW (lpString=".dbf") returned 4
	[0084.878] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0084.879] lstrlenW (lpString=".1cd") returned 4
	[0084.879] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0084.879] lstrlenW (lpString=".jpg") returned 4
	[0084.879] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0084.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0084.879] lstrlenW (lpString=".doc") returned 4
	[0084.879] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.879] lstrlenW (lpString=".docx") returned 5
	[0084.879] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0084.879] lstrlenW (lpString=".pdf") returned 4
	[0084.879] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.879] lstrlenW (lpString=".xls") returned 4
	[0084.879] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.879] lstrlenW (lpString=".xlsx") returned 5
	[0084.880] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0084.880] lstrlenW (lpString=".ppt") returned 4
	[0084.880] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0084.880] lstrlenW (lpString=".zip") returned 4
	[0084.880] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.880] lstrlenW (lpString=".rar") returned 4
	[0084.880] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.880] lstrlenW (lpString=".bz2") returned 4
	[0084.880] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.880] lstrlenW (lpString=".7z") returned 3
	[0084.880] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0084.880] lstrlenW (lpString=".dbf") returned 4
	[0084.880] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0084.880] lstrlenW (lpString=".1cd") returned 4
	[0084.881] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0084.881] lstrlenW (lpString=".jpg") returned 4
	[0084.881] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.881] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0084.881] lstrlenW (lpString="BRANDING.XML") returned 12
	[0084.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.883] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=596341) returned 1
	[0084.883] CloseHandle (hObject=0x1b0) returned 1
	[0084.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20
	[0084.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.889] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.890] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0084.890] GetLastError () returned 0x0
	[0084.890] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x91975, lpOverlapped=0x0) returned 1
	[0084.911] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x91980, lpOverlapped=0x0) returned 1
	[0084.928] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.928] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0084.929] SetEndOfFile (hFile=0x1ac) returned 1
	[0084.929] CloseHandle (hObject=0x1ac) returned 1
	[0084.929] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.929] SetEndOfFile (hFile=0x1b0) returned 1
	[0084.939] CloseHandle (hObject=0x1b0) returned 1
	[0084.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0084.939] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1
	[0084.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0084.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0084.940] lstrlenW (lpString=".doc") returned 4
	[0084.940] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.940] lstrlenW (lpString=".docx") returned 5
	[0084.940] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1
	[0084.940] lstrlenW (lpString=".pdf") returned 4
	[0084.940] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.940] lstrlenW (lpString=".xls") returned 4
	[0084.940] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.940] lstrlenW (lpString=".xlsx") returned 5
	[0084.940] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1
	[0084.940] lstrlenW (lpString=".ppt") returned 4
	[0084.940] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0084.940] lstrlenW (lpString=".zip") returned 4
	[0084.941] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.941] lstrlenW (lpString=".rar") returned 4
	[0084.941] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.941] lstrlenW (lpString=".bz2") returned 4
	[0084.941] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.941] lstrlenW (lpString=".7z") returned 3
	[0084.941] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0084.941] lstrlenW (lpString=".dbf") returned 4
	[0084.941] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0084.941] lstrlenW (lpString=".1cd") returned 4
	[0084.941] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0084.941] lstrlenW (lpString=".jpg") returned 4
	[0084.941] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0084.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0084.942] lstrlenW (lpString=".doc") returned 4
	[0084.942] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0084.942] lstrlenW (lpString=".docx") returned 5
	[0084.942] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1
	[0084.942] lstrlenW (lpString=".pdf") returned 4
	[0084.942] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0084.942] lstrlenW (lpString=".xls") returned 4
	[0084.942] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0084.942] lstrlenW (lpString=".xlsx") returned 5
	[0084.942] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1
	[0084.942] lstrlenW (lpString=".ppt") returned 4
	[0084.942] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0084.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0084.942] lstrlenW (lpString=".zip") returned 4
	[0084.942] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0084.942] lstrlenW (lpString=".rar") returned 4
	[0084.942] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0084.942] lstrlenW (lpString=".bz2") returned 4
	[0084.942] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0084.942] lstrlenW (lpString=".7z") returned 3
	[0084.942] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0084.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0084.942] lstrlenW (lpString=".dbf") returned 4
	[0084.942] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0084.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0084.943] lstrlenW (lpString=".1cd") returned 4
	[0084.943] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0084.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0084.943] lstrlenW (lpString=".jpg") returned 4
	[0084.943] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0084.943] lstrcmpiW (lpString1=".CHM", lpString2=".adobe") returned 1
	[0084.943] lstrlenW (lpString="OCT.CHM") returned 7
	[0084.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0084.945] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=71236) returned 1
	[0084.945] CloseHandle (hObject=0x160) returned 1
	[0084.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20
	[0084.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0084.946] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.946] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.947] GetLastError () returned 0x0
	[0084.947] ReadFile (in: hFile=0x160, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x11644, lpOverlapped=0x0) returned 1
	[0084.951] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x11650, lpOverlapped=0x0) returned 1
	[0084.954] ReadFile (in: hFile=0x160, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.954] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0084.954] SetEndOfFile (hFile=0x1b0) returned 1
	[0084.954] CloseHandle (hObject=0x1b0) returned 1
	[0084.954] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.954] SetEndOfFile (hFile=0x160) returned 1
	[0084.956] CloseHandle (hObject=0x160) returned 1
	[0084.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0084.957] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1
	[0084.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0084.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0084.957] lstrlenW (lpString=".doc") returned 4
	[0084.957] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0084.957] lstrlenW (lpString=".docx") returned 5
	[0084.957] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1
	[0084.957] lstrlenW (lpString=".pdf") returned 4
	[0084.957] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0084.957] lstrlenW (lpString=".xls") returned 4
	[0084.957] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0084.957] lstrlenW (lpString=".xlsx") returned 5
	[0084.957] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1
	[0084.958] lstrlenW (lpString=".ppt") returned 4
	[0084.958] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0084.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0084.958] lstrlenW (lpString=".zip") returned 4
	[0084.958] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0084.958] lstrlenW (lpString=".rar") returned 4
	[0084.958] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0084.958] lstrlenW (lpString=".bz2") returned 4
	[0084.958] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0084.958] lstrlenW (lpString=".7z") returned 3
	[0084.958] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0084.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0084.958] lstrlenW (lpString=".dbf") returned 4
	[0084.958] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0084.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0084.958] lstrlenW (lpString=".1cd") returned 4
	[0084.958] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0084.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0084.958] lstrlenW (lpString=".jpg") returned 4
	[0084.958] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0084.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0084.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0084.958] lstrlenW (lpString=".doc") returned 4
	[0084.958] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0084.959] lstrlenW (lpString=".docx") returned 5
	[0084.959] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1
	[0084.959] lstrlenW (lpString=".pdf") returned 4
	[0084.959] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0084.959] lstrlenW (lpString=".xls") returned 4
	[0084.959] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0084.959] lstrlenW (lpString=".xlsx") returned 5
	[0084.959] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1
	[0084.959] lstrlenW (lpString=".ppt") returned 4
	[0084.959] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0084.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0084.959] lstrlenW (lpString=".zip") returned 4
	[0084.959] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0084.959] lstrlenW (lpString=".rar") returned 4
	[0084.959] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0084.959] lstrlenW (lpString=".bz2") returned 4
	[0084.959] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0084.959] lstrlenW (lpString=".7z") returned 3
	[0084.959] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0084.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0084.959] lstrlenW (lpString=".dbf") returned 4
	[0084.959] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0084.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0084.959] lstrlenW (lpString=".1cd") returned 4
	[0084.959] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0084.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0084.960] lstrlenW (lpString=".jpg") returned 4
	[0084.960] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0084.960] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0084.960] lstrlenW (lpString="OfficeMUI.XML") returned 13
	[0084.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0084.961] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5557) returned 1
	[0084.961] CloseHandle (hObject=0x160) returned 1
	[0084.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20
	[0084.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0084.962] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.962] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.963] GetLastError () returned 0x0
	[0084.963] ReadFile (in: hFile=0x160, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x15b5, lpOverlapped=0x0) returned 1
	[0084.996] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x15c0, lpOverlapped=0x0) returned 1
	[0084.998] ReadFile (in: hFile=0x160, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.998] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0084.998] SetEndOfFile (hFile=0x1b0) returned 1
	[0085.001] CloseHandle (hObject=0x1b0) returned 1
	[0085.001] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.002] SetEndOfFile (hFile=0x160) returned 1
	[0085.003] CloseHandle (hObject=0x160) returned 1
	[0085.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.003] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1
	[0085.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0085.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0085.004] lstrlenW (lpString=".doc") returned 4
	[0085.004] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.004] lstrlenW (lpString=".docx") returned 5
	[0085.004] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0085.004] lstrlenW (lpString=".pdf") returned 4
	[0085.004] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.004] lstrlenW (lpString=".xls") returned 4
	[0085.004] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.004] lstrlenW (lpString=".xlsx") returned 5
	[0085.004] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0085.004] lstrlenW (lpString=".ppt") returned 4
	[0085.005] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0085.005] lstrlenW (lpString=".zip") returned 4
	[0085.005] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.005] lstrlenW (lpString=".rar") returned 4
	[0085.005] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.005] lstrlenW (lpString=".bz2") returned 4
	[0085.005] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.005] lstrlenW (lpString=".7z") returned 3
	[0085.005] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0085.005] lstrlenW (lpString=".dbf") returned 4
	[0085.005] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0085.005] lstrlenW (lpString=".1cd") returned 4
	[0085.005] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0085.005] lstrlenW (lpString=".jpg") returned 4
	[0085.005] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0085.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0085.005] lstrlenW (lpString=".doc") returned 4
	[0085.005] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.006] lstrlenW (lpString=".docx") returned 5
	[0085.006] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0085.006] lstrlenW (lpString=".pdf") returned 4
	[0085.006] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.006] lstrlenW (lpString=".xls") returned 4
	[0085.006] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.006] lstrlenW (lpString=".xlsx") returned 5
	[0085.006] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0085.006] lstrlenW (lpString=".ppt") returned 4
	[0085.006] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0085.006] lstrlenW (lpString=".zip") returned 4
	[0085.006] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.006] lstrlenW (lpString=".rar") returned 4
	[0085.006] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.006] lstrlenW (lpString=".bz2") returned 4
	[0085.006] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.006] lstrlenW (lpString=".7z") returned 3
	[0085.006] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0085.006] lstrlenW (lpString=".dbf") returned 4
	[0085.006] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0085.006] lstrlenW (lpString=".1cd") returned 4
	[0085.007] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0085.007] lstrlenW (lpString=".jpg") returned 4
	[0085.007] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.007] lstrcmpiW (lpString1=".CHM", lpString2=".adobe") returned 1
	[0085.007] lstrlenW (lpString="SETUP.CHM") returned 9
	[0085.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0085.034] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=67190) returned 1
	[0085.034] CloseHandle (hObject=0x1ac) returned 1
	[0085.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20
	[0085.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0085.169] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.169] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0085.300] GetLastError () returned 0x0
	[0085.300] ReadFile (in: hFile=0x188, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x10676, lpOverlapped=0x0) returned 1
	[0085.438] WriteFile (in: hFile=0x194, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x10680, lpOverlapped=0x0) returned 1
	[0085.440] ReadFile (in: hFile=0x188, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.440] WriteFile (in: hFile=0x194, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0085.441] SetEndOfFile (hFile=0x194) returned 1
	[0085.441] CloseHandle (hObject=0x194) returned 1
	[0085.442] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.442] SetEndOfFile (hFile=0x188) returned 1
	[0085.444] CloseHandle (hObject=0x188) returned 1
	[0085.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.444] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1
	[0085.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0085.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0085.445] lstrlenW (lpString=".doc") returned 4
	[0085.445] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0085.445] lstrlenW (lpString=".docx") returned 5
	[0085.445] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1
	[0085.445] lstrlenW (lpString=".pdf") returned 4
	[0085.445] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0085.445] lstrlenW (lpString=".xls") returned 4
	[0085.445] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0085.445] lstrlenW (lpString=".xlsx") returned 5
	[0085.445] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1
	[0085.445] lstrlenW (lpString=".ppt") returned 4
	[0085.445] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0085.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0085.445] lstrlenW (lpString=".zip") returned 4
	[0085.445] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0085.445] lstrlenW (lpString=".rar") returned 4
	[0085.445] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0085.445] lstrlenW (lpString=".bz2") returned 4
	[0085.445] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0085.445] lstrlenW (lpString=".7z") returned 3
	[0085.446] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0085.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0085.446] lstrlenW (lpString=".dbf") returned 4
	[0085.446] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0085.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0085.446] lstrlenW (lpString=".1cd") returned 4
	[0085.446] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0085.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0085.446] lstrlenW (lpString=".jpg") returned 4
	[0085.446] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0085.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0085.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0085.446] lstrlenW (lpString=".doc") returned 4
	[0085.446] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0085.446] lstrlenW (lpString=".docx") returned 5
	[0085.446] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1
	[0085.446] lstrlenW (lpString=".pdf") returned 4
	[0085.446] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0085.446] lstrlenW (lpString=".xls") returned 4
	[0085.446] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0085.446] lstrlenW (lpString=".xlsx") returned 5
	[0085.446] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1
	[0085.446] lstrlenW (lpString=".ppt") returned 4
	[0085.447] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0085.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0085.447] lstrlenW (lpString=".zip") returned 4
	[0085.447] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0085.447] lstrlenW (lpString=".rar") returned 4
	[0085.447] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0085.447] lstrlenW (lpString=".bz2") returned 4
	[0085.447] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0085.447] lstrlenW (lpString=".7z") returned 3
	[0085.447] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0085.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0085.447] lstrlenW (lpString=".dbf") returned 4
	[0085.447] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0085.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0085.447] lstrlenW (lpString=".1cd") returned 4
	[0085.447] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0085.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0085.447] lstrlenW (lpString=".jpg") returned 4
	[0085.447] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0085.447] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.448] lstrlenW (lpString="Proof.XML") returned 9
	[0085.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0085.460] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1457) returned 1
	[0085.460] CloseHandle (hObject=0x188) returned 1
	[0085.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20
	[0085.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0085.461] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.461] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0085.462] GetLastError () returned 0x0
	[0085.462] ReadFile (in: hFile=0x188, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x5b1, lpOverlapped=0x0) returned 1
	[0085.474] WriteFile (in: hFile=0x194, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0085.476] ReadFile (in: hFile=0x188, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.476] WriteFile (in: hFile=0x194, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0085.476] SetEndOfFile (hFile=0x194) returned 1
	[0085.476] CloseHandle (hObject=0x194) returned 1
	[0085.476] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.476] SetEndOfFile (hFile=0x188) returned 1
	[0085.477] CloseHandle (hObject=0x188) returned 1
	[0085.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.478] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1
	[0085.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0085.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0085.478] lstrlenW (lpString=".doc") returned 4
	[0085.478] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.478] lstrlenW (lpString=".docx") returned 5
	[0085.478] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0085.478] lstrlenW (lpString=".pdf") returned 4
	[0085.479] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.479] lstrlenW (lpString=".xls") returned 4
	[0085.479] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.479] lstrlenW (lpString=".xlsx") returned 5
	[0085.479] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0085.479] lstrlenW (lpString=".ppt") returned 4
	[0085.479] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0085.479] lstrlenW (lpString=".zip") returned 4
	[0085.479] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.479] lstrlenW (lpString=".rar") returned 4
	[0085.479] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.479] lstrlenW (lpString=".bz2") returned 4
	[0085.479] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.479] lstrlenW (lpString=".7z") returned 3
	[0085.479] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0085.479] lstrlenW (lpString=".dbf") returned 4
	[0085.479] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0085.479] lstrlenW (lpString=".1cd") returned 4
	[0085.479] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0085.479] lstrlenW (lpString=".jpg") returned 4
	[0085.479] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0085.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0085.480] lstrlenW (lpString=".doc") returned 4
	[0085.480] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.480] lstrlenW (lpString=".docx") returned 5
	[0085.480] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0085.480] lstrlenW (lpString=".pdf") returned 4
	[0085.480] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.480] lstrlenW (lpString=".xls") returned 4
	[0085.480] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.480] lstrlenW (lpString=".xlsx") returned 5
	[0085.480] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0085.480] lstrlenW (lpString=".ppt") returned 4
	[0085.480] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0085.480] lstrlenW (lpString=".zip") returned 4
	[0085.480] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.480] lstrlenW (lpString=".rar") returned 4
	[0085.480] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.480] lstrlenW (lpString=".bz2") returned 4
	[0085.480] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.480] lstrlenW (lpString=".7z") returned 3
	[0085.480] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0085.480] lstrlenW (lpString=".dbf") returned 4
	[0085.480] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0085.481] lstrlenW (lpString=".1cd") returned 4
	[0085.481] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0085.481] lstrlenW (lpString=".jpg") returned 4
	[0085.481] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.481] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.481] lstrlenW (lpString="SETUP.XML") returned 9
	[0085.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0085.482] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5884) returned 1
	[0085.482] CloseHandle (hObject=0x188) returned 1
	[0085.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20
	[0085.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0085.482] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.482] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0085.564] GetLastError () returned 0x0
	[0085.564] ReadFile (in: hFile=0x188, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x16fc, lpOverlapped=0x0) returned 1
	[0085.576] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x1700, lpOverlapped=0x0) returned 1
	[0085.578] ReadFile (in: hFile=0x188, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.578] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0085.578] SetEndOfFile (hFile=0x1ac) returned 1
	[0085.578] CloseHandle (hObject=0x1ac) returned 1
	[0085.579] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.579] SetEndOfFile (hFile=0x188) returned 1
	[0085.580] CloseHandle (hObject=0x188) returned 1
	[0085.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0085.580] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1
	[0085.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0085.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0085.581] lstrlenW (lpString=".doc") returned 4
	[0085.581] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.581] lstrlenW (lpString=".docx") returned 5
	[0085.581] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.581] lstrlenW (lpString=".pdf") returned 4
	[0085.581] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.581] lstrlenW (lpString=".xls") returned 4
	[0085.581] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.581] lstrlenW (lpString=".xlsx") returned 5
	[0085.581] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.581] lstrlenW (lpString=".ppt") returned 4
	[0085.581] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0085.581] lstrlenW (lpString=".zip") returned 4
	[0085.581] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.581] lstrlenW (lpString=".rar") returned 4
	[0085.581] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.581] lstrlenW (lpString=".bz2") returned 4
	[0085.581] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.581] lstrlenW (lpString=".7z") returned 3
	[0085.581] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0085.582] lstrlenW (lpString=".dbf") returned 4
	[0085.582] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0085.582] lstrlenW (lpString=".1cd") returned 4
	[0085.582] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0085.582] lstrlenW (lpString=".jpg") returned 4
	[0085.582] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0085.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0085.582] lstrlenW (lpString=".doc") returned 4
	[0085.582] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0085.582] lstrlenW (lpString=".docx") returned 5
	[0085.582] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0085.582] lstrlenW (lpString=".pdf") returned 4
	[0085.582] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0085.582] lstrlenW (lpString=".xls") returned 4
	[0085.582] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0085.582] lstrlenW (lpString=".xlsx") returned 5
	[0085.582] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0085.582] lstrlenW (lpString=".ppt") returned 4
	[0085.582] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0085.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0085.582] lstrlenW (lpString=".zip") returned 4
	[0085.582] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0085.583] lstrlenW (lpString=".rar") returned 4
	[0085.583] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0085.583] lstrlenW (lpString=".bz2") returned 4
	[0085.583] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0085.583] lstrlenW (lpString=".7z") returned 3
	[0085.583] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0085.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0085.583] lstrlenW (lpString=".dbf") returned 4
	[0085.583] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0085.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0085.583] lstrlenW (lpString=".1cd") returned 4
	[0085.583] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0085.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0085.583] lstrlenW (lpString=".jpg") returned 4
	[0085.583] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0085.583] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0085.583] lstrlenW (lpString="SETUP.XML") returned 9
	[0085.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0085.617] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=31094) returned 1
	[0085.618] CloseHandle (hObject=0x1a4) returned 1
	[0085.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20
	[0085.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0085.929] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.929] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.020] GetLastError () returned 0x0
	[0086.020] ReadFile (in: hFile=0x194, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x7976, lpOverlapped=0x0) returned 1
	[0086.029] WriteFile (in: hFile=0x19c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x7980, lpOverlapped=0x0) returned 1
	[0086.030] ReadFile (in: hFile=0x194, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.030] WriteFile (in: hFile=0x19c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0086.030] SetEndOfFile (hFile=0x19c) returned 1
	[0086.031] CloseHandle (hObject=0x19c) returned 1
	[0086.031] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.031] SetEndOfFile (hFile=0x194) returned 1
	[0086.032] CloseHandle (hObject=0x194) returned 1
	[0086.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.032] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1
	[0086.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0086.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0086.032] lstrlenW (lpString=".doc") returned 4
	[0086.032] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.032] lstrlenW (lpString=".docx") returned 5
	[0086.032] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0086.032] lstrlenW (lpString=".pdf") returned 4
	[0086.032] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.033] lstrlenW (lpString=".xls") returned 4
	[0086.033] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.033] lstrlenW (lpString=".xlsx") returned 5
	[0086.033] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0086.033] lstrlenW (lpString=".ppt") returned 4
	[0086.033] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0086.033] lstrlenW (lpString=".zip") returned 4
	[0086.033] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.033] lstrlenW (lpString=".rar") returned 4
	[0086.033] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.033] lstrlenW (lpString=".bz2") returned 4
	[0086.033] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.033] lstrlenW (lpString=".7z") returned 3
	[0086.033] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0086.033] lstrlenW (lpString=".dbf") returned 4
	[0086.033] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0086.033] lstrlenW (lpString=".1cd") returned 4
	[0086.033] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0086.033] lstrlenW (lpString=".jpg") returned 4
	[0086.033] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0086.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0086.033] lstrlenW (lpString=".doc") returned 4
	[0086.033] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.033] lstrlenW (lpString=".docx") returned 5
	[0086.033] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0086.033] lstrlenW (lpString=".pdf") returned 4
	[0086.033] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.033] lstrlenW (lpString=".xls") returned 4
	[0086.034] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.034] lstrlenW (lpString=".xlsx") returned 5
	[0086.034] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0086.034] lstrlenW (lpString=".ppt") returned 4
	[0086.034] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0086.034] lstrlenW (lpString=".zip") returned 4
	[0086.034] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.034] lstrlenW (lpString=".rar") returned 4
	[0086.034] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.034] lstrlenW (lpString=".bz2") returned 4
	[0086.034] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.034] lstrlenW (lpString=".7z") returned 3
	[0086.034] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0086.034] lstrlenW (lpString=".dbf") returned 4
	[0086.034] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0086.034] lstrlenW (lpString=".1cd") returned 4
	[0086.034] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0086.034] lstrlenW (lpString=".jpg") returned 4
	[0086.034] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.034] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0086.034] lstrlenW (lpString="VisiorWW.XML") returned 12
	[0086.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0086.046] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=8723) returned 1
	[0086.046] CloseHandle (hObject=0x1a4) returned 1
	[0086.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20
	[0086.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.224] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.224] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.229] GetLastError () returned 0x0
	[0086.229] ReadFile (in: hFile=0x19c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x2213, lpOverlapped=0x0) returned 1
	[0086.239] WriteFile (in: hFile=0x194, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x2220, lpOverlapped=0x0) returned 1
	[0086.240] ReadFile (in: hFile=0x19c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.241] WriteFile (in: hFile=0x194, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0086.241] SetEndOfFile (hFile=0x194) returned 1
	[0086.241] CloseHandle (hObject=0x194) returned 1
	[0086.241] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.241] SetEndOfFile (hFile=0x19c) returned 1
	[0086.242] CloseHandle (hObject=0x19c) returned 1
	[0086.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.243] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1
	[0086.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0086.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0086.243] lstrlenW (lpString=".doc") returned 4
	[0086.243] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.243] lstrlenW (lpString=".docx") returned 5
	[0086.243] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0086.243] lstrlenW (lpString=".pdf") returned 4
	[0086.243] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.243] lstrlenW (lpString=".xls") returned 4
	[0086.243] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.243] lstrlenW (lpString=".xlsx") returned 5
	[0086.243] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0086.243] lstrlenW (lpString=".ppt") returned 4
	[0086.243] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0086.244] lstrlenW (lpString=".zip") returned 4
	[0086.244] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.244] lstrlenW (lpString=".rar") returned 4
	[0086.244] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.244] lstrlenW (lpString=".bz2") returned 4
	[0086.244] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.244] lstrlenW (lpString=".7z") returned 3
	[0086.244] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0086.244] lstrlenW (lpString=".dbf") returned 4
	[0086.244] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0086.244] lstrlenW (lpString=".1cd") returned 4
	[0086.244] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0086.244] lstrlenW (lpString=".jpg") returned 4
	[0086.244] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0086.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0086.244] lstrlenW (lpString=".doc") returned 4
	[0086.244] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.244] lstrlenW (lpString=".docx") returned 5
	[0086.244] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0086.244] lstrlenW (lpString=".pdf") returned 4
	[0086.245] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.245] lstrlenW (lpString=".xls") returned 4
	[0086.245] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.245] lstrlenW (lpString=".xlsx") returned 5
	[0086.245] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0086.245] lstrlenW (lpString=".ppt") returned 4
	[0086.245] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0086.245] lstrlenW (lpString=".zip") returned 4
	[0086.245] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.245] lstrlenW (lpString=".rar") returned 4
	[0086.245] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.245] lstrlenW (lpString=".bz2") returned 4
	[0086.245] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.245] lstrlenW (lpString=".7z") returned 3
	[0086.245] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0086.245] lstrlenW (lpString=".dbf") returned 4
	[0086.245] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0086.245] lstrlenW (lpString=".1cd") returned 4
	[0086.245] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0086.245] lstrlenW (lpString=".jpg") returned 4
	[0086.245] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.246] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0086.246] lstrlenW (lpString="DATES.XML") returned 9
	[0086.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.251] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=8918) returned 1
	[0086.251] CloseHandle (hObject=0x194) returned 1
	[0086.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20
	[0086.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0086.376] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.376] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.623] GetLastError () returned 0x0
	[0086.623] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x22d6, lpOverlapped=0x0) returned 1
	[0086.637] WriteFile (in: hFile=0x194, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x22e0, lpOverlapped=0x0) returned 1
	[0086.638] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.638] WriteFile (in: hFile=0x194, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0086.638] SetEndOfFile (hFile=0x194) returned 1
	[0086.717] CloseHandle (hObject=0x194) returned 1
	[0086.719] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.719] SetEndOfFile (hFile=0x1ac) returned 1
	[0086.726] CloseHandle (hObject=0x1ac) returned 1
	[0086.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.747] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1
	[0086.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0086.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0086.757] lstrlenW (lpString=".doc") returned 4
	[0086.757] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.757] lstrlenW (lpString=".docx") returned 5
	[0086.757] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1
	[0086.757] lstrlenW (lpString=".pdf") returned 4
	[0086.757] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.757] lstrlenW (lpString=".xls") returned 4
	[0086.757] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.757] lstrlenW (lpString=".xlsx") returned 5
	[0086.757] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1
	[0086.757] lstrlenW (lpString=".ppt") returned 4
	[0086.757] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0086.757] lstrlenW (lpString=".zip") returned 4
	[0086.757] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.757] lstrlenW (lpString=".rar") returned 4
	[0086.757] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.758] lstrlenW (lpString=".bz2") returned 4
	[0086.758] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.758] lstrlenW (lpString=".7z") returned 3
	[0086.758] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0086.758] lstrlenW (lpString=".dbf") returned 4
	[0086.758] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0086.758] lstrlenW (lpString=".1cd") returned 4
	[0086.758] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0086.758] lstrlenW (lpString=".jpg") returned 4
	[0086.758] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0086.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0086.758] lstrlenW (lpString=".doc") returned 4
	[0086.758] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0086.758] lstrlenW (lpString=".docx") returned 5
	[0086.758] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1
	[0086.758] lstrlenW (lpString=".pdf") returned 4
	[0086.758] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0086.758] lstrlenW (lpString=".xls") returned 4
	[0086.758] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0086.758] lstrlenW (lpString=".xlsx") returned 5
	[0086.758] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1
	[0086.759] lstrlenW (lpString=".ppt") returned 4
	[0086.759] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0086.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0086.759] lstrlenW (lpString=".zip") returned 4
	[0086.759] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0086.759] lstrlenW (lpString=".rar") returned 4
	[0086.759] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0086.759] lstrlenW (lpString=".bz2") returned 4
	[0086.759] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0086.759] lstrlenW (lpString=".7z") returned 3
	[0086.759] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0086.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0086.759] lstrlenW (lpString=".dbf") returned 4
	[0086.759] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0086.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0086.759] lstrlenW (lpString=".1cd") returned 4
	[0086.759] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0086.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0086.759] lstrlenW (lpString=".jpg") returned 4
	[0086.759] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0086.759] lstrcmpiW (lpString1=".XML", lpString2=".adobe") returned 1
	[0086.760] lstrlenW (lpString="TIME.XML") returned 8
	[0086.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.786] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=8564) returned 1
	[0086.786] CloseHandle (hObject=0x174) returned 1
	[0086.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20
	[0087.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0087.026] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.026] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.060] GetLastError () returned 0x0
	[0087.060] ReadFile (in: hFile=0x19c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x2174, lpOverlapped=0x0) returned 1
	[0087.070] WriteFile (in: hFile=0x174, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x2180, lpOverlapped=0x0) returned 1
	[0087.071] ReadFile (in: hFile=0x19c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.071] WriteFile (in: hFile=0x174, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0087.072] SetEndOfFile (hFile=0x174) returned 1
	[0087.072] CloseHandle (hObject=0x174) returned 1
	[0087.072] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.072] SetEndOfFile (hFile=0x19c) returned 1
	[0087.073] CloseHandle (hObject=0x19c) returned 1
	[0087.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0087.074] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1
	[0087.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0087.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0087.074] lstrlenW (lpString=".doc") returned 4
	[0087.074] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0087.074] lstrlenW (lpString=".docx") returned 5
	[0087.074] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1
	[0087.074] lstrlenW (lpString=".pdf") returned 4
	[0087.074] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0087.074] lstrlenW (lpString=".xls") returned 4
	[0087.075] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0087.075] lstrlenW (lpString=".xlsx") returned 5
	[0087.075] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1
	[0087.075] lstrlenW (lpString=".ppt") returned 4
	[0087.075] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0087.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0087.075] lstrlenW (lpString=".zip") returned 4
	[0087.075] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0087.075] lstrlenW (lpString=".rar") returned 4
	[0087.075] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0087.075] lstrlenW (lpString=".bz2") returned 4
	[0087.075] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0087.075] lstrlenW (lpString=".7z") returned 3
	[0087.075] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0087.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0087.075] lstrlenW (lpString=".dbf") returned 4
	[0087.075] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0087.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0087.075] lstrlenW (lpString=".1cd") returned 4
	[0087.075] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0087.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0087.075] lstrlenW (lpString=".jpg") returned 4
	[0087.075] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0087.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0087.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0087.076] lstrlenW (lpString=".doc") returned 4
	[0087.076] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0087.076] lstrlenW (lpString=".docx") returned 5
	[0087.076] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1
	[0087.076] lstrlenW (lpString=".pdf") returned 4
	[0087.076] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0087.076] lstrlenW (lpString=".xls") returned 4
	[0087.076] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0087.076] lstrlenW (lpString=".xlsx") returned 5
	[0087.076] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1
	[0087.076] lstrlenW (lpString=".ppt") returned 4
	[0087.076] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0087.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0087.076] lstrlenW (lpString=".zip") returned 4
	[0087.076] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0087.076] lstrlenW (lpString=".rar") returned 4
	[0087.076] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0087.076] lstrlenW (lpString=".bz2") returned 4
	[0087.076] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0087.076] lstrlenW (lpString=".7z") returned 3
	[0087.076] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0087.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0087.076] lstrlenW (lpString=".dbf") returned 4
	[0087.076] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0087.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0087.076] lstrlenW (lpString=".1cd") returned 4
	[0087.076] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0087.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0087.077] lstrlenW (lpString=".jpg") returned 4
	[0087.077] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0087.077] lstrcmpiW (lpString1=".wmf", lpString2=".adobe") returned 1
	[0087.077] lstrlenW (lpString="grid_(cm).wmf") returned 13
	[0087.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0087.132] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2920) returned 1
	[0087.132] CloseHandle (hObject=0x194) returned 1
	[0087.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20
	[0087.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0087.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0087.238] lstrlenW (lpString=".doc") returned 4
	[0087.239] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1
	[0087.239] lstrlenW (lpString=".docx") returned 5
	[0087.239] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1
	[0087.239] lstrlenW (lpString=".pdf") returned 4
	[0087.239] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1
	[0087.239] lstrlenW (lpString=".xls") returned 4
	[0087.239] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1
	[0087.239] lstrlenW (lpString=".xlsx") returned 5
	[0087.239] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1
	[0087.239] lstrlenW (lpString=".ppt") returned 4
	[0087.239] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1
	[0087.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0087.239] lstrlenW (lpString=".zip") returned 4
	[0087.239] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1
	[0087.239] lstrlenW (lpString=".rar") returned 4
	[0087.239] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1
	[0087.239] lstrlenW (lpString=".bz2") returned 4
	[0087.239] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1
	[0087.239] lstrlenW (lpString=".7z") returned 3
	[0087.239] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1
	[0087.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0087.239] lstrlenW (lpString=".dbf") returned 4
	[0087.239] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1
	[0087.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0087.239] lstrlenW (lpString=".1cd") returned 4
	[0087.239] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1
	[0087.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0087.239] lstrlenW (lpString=".jpg") returned 4
	[0087.240] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1
	[0087.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0087.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0087.240] lstrlenW (lpString=".doc") returned 4
	[0087.240] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1
	[0087.240] lstrlenW (lpString=".docx") returned 5
	[0087.240] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1
	[0087.240] lstrlenW (lpString=".pdf") returned 4
	[0087.240] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1
	[0087.240] lstrlenW (lpString=".xls") returned 4
	[0087.240] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1
	[0087.240] lstrlenW (lpString=".xlsx") returned 5
	[0087.240] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1
	[0087.240] lstrlenW (lpString=".ppt") returned 4
	[0087.240] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1
	[0087.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0087.240] lstrlenW (lpString=".zip") returned 4
	[0087.240] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1
	[0087.240] lstrlenW (lpString=".rar") returned 4
	[0087.240] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1
	[0087.240] lstrlenW (lpString=".bz2") returned 4
	[0087.240] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1
	[0087.240] lstrlenW (lpString=".7z") returned 3
	[0087.241] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1
	[0087.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0087.241] lstrlenW (lpString=".dbf") returned 4
	[0087.241] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1
	[0087.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0087.241] lstrlenW (lpString=".1cd") returned 4
	[0087.241] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1
	[0087.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0087.241] lstrlenW (lpString=".jpg") returned 4
	[0087.241] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1
	[0087.241] lstrcmpiW (lpString1=".emf", lpString2=".adobe") returned 1
	[0087.241] lstrlenW (lpString="Memo.emf") returned 8
	[0087.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.272] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=152300) returned 1
	[0087.272] CloseHandle (hObject=0x1ac) returned 1
	[0087.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf")) returned 0x20
	[0087.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0087.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0087.321] lstrlenW (lpString=".doc") returned 4
	[0087.321] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0087.321] lstrlenW (lpString=".docx") returned 5
	[0087.321] lstrcmpiW (lpString1=".docx", lpString2="o.emf") returned -1
	[0087.321] lstrlenW (lpString=".pdf") returned 4
	[0087.321] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0087.321] lstrlenW (lpString=".xls") returned 4
	[0087.321] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0087.321] lstrlenW (lpString=".xlsx") returned 5
	[0087.321] lstrcmpiW (lpString1=".xlsx", lpString2="o.emf") returned -1
	[0087.321] lstrlenW (lpString=".ppt") returned 4
	[0087.321] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0087.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0087.321] lstrlenW (lpString=".zip") returned 4
	[0087.321] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0087.321] lstrlenW (lpString=".rar") returned 4
	[0087.321] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0087.321] lstrlenW (lpString=".bz2") returned 4
	[0087.321] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0087.321] lstrlenW (lpString=".7z") returned 3
	[0087.321] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0087.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0087.321] lstrlenW (lpString=".dbf") returned 4
	[0087.322] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0087.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0087.322] lstrlenW (lpString=".1cd") returned 4
	[0087.322] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0087.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0087.322] lstrlenW (lpString=".jpg") returned 4
	[0087.322] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0087.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0087.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0087.322] lstrlenW (lpString=".doc") returned 4
	[0087.322] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0087.322] lstrlenW (lpString=".docx") returned 5
	[0087.322] lstrcmpiW (lpString1=".docx", lpString2="o.emf") returned -1
	[0087.322] lstrlenW (lpString=".pdf") returned 4
	[0087.322] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0087.322] lstrlenW (lpString=".xls") returned 4
	[0087.322] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0087.322] lstrlenW (lpString=".xlsx") returned 5
	[0087.322] lstrcmpiW (lpString1=".xlsx", lpString2="o.emf") returned -1
	[0087.322] lstrlenW (lpString=".ppt") returned 4
	[0087.322] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0087.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0087.322] lstrlenW (lpString=".zip") returned 4
	[0087.322] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0087.322] lstrlenW (lpString=".rar") returned 4
	[0087.322] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0087.323] lstrlenW (lpString=".bz2") returned 4
	[0087.323] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0087.323] lstrlenW (lpString=".7z") returned 3
	[0087.323] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0087.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0087.323] lstrlenW (lpString=".dbf") returned 4
	[0087.323] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0087.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0087.323] lstrlenW (lpString=".1cd") returned 4
	[0087.323] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0087.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0087.323] lstrlenW (lpString=".jpg") returned 4
	[0087.323] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0087.323] lstrcmpiW (lpString1=".jpg", lpString2=".adobe") returned 1
	[0087.323] lstrlenW (lpString="Notebook.jpg") returned 12
	[0087.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.361] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2950) returned 1
	[0087.361] CloseHandle (hObject=0x174) returned 1
	[0087.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20
	[0087.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70
	[0087.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70
	[0087.426] lstrlenW (lpString=".doc") returned 4
	[0087.426] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0087.426] lstrlenW (lpString=".docx") returned 5
	[0087.426] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1
	[0087.427] lstrlenW (lpString=".pdf") returned 4
	[0087.427] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0087.427] lstrlenW (lpString=".xls") returned 4
	[0087.427] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0087.427] lstrlenW (lpString=".xlsx") returned 5
	[0087.427] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1
	[0087.427] lstrlenW (lpString=".ppt") returned 4
	[0087.427] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0087.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70
	[0087.427] lstrlenW (lpString=".zip") returned 4
	[0087.427] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0087.427] lstrlenW (lpString=".rar") returned 4
	[0087.427] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0087.427] lstrlenW (lpString=".bz2") returned 4
	[0087.427] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0087.427] lstrlenW (lpString=".7z") returned 3
	[0087.427] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0087.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70
	[0087.427] lstrlenW (lpString=".dbf") returned 4
	[0087.427] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0087.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70
	[0087.427] lstrlenW (lpString=".1cd") returned 4
	[0087.427] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0087.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70
	[0087.427] lstrlenW (lpString=".jpg") returned 4
	[0087.427] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0087.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70
	[0087.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70
	[0087.428] lstrlenW (lpString=".doc") returned 4
	[0087.428] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0087.428] lstrlenW (lpString=".docx") returned 5
	[0087.428] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1
	[0087.428] lstrlenW (lpString=".pdf") returned 4
	[0087.428] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0087.428] lstrlenW (lpString=".xls") returned 4
	[0087.428] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0087.428] lstrlenW (lpString=".xlsx") returned 5
	[0087.428] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1
	[0087.428] lstrlenW (lpString=".ppt") returned 4
	[0087.428] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0087.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70
	[0087.428] lstrlenW (lpString=".zip") returned 4
	[0087.428] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0087.428] lstrlenW (lpString=".rar") returned 4
	[0087.428] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0087.428] lstrlenW (lpString=".bz2") returned 4
	[0087.428] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0087.428] lstrlenW (lpString=".7z") returned 3
	[0087.428] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0087.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70
	[0087.428] lstrlenW (lpString=".dbf") returned 4
	[0087.428] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0087.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70
	[0087.429] lstrlenW (lpString=".1cd") returned 4
	[0087.429] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0087.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70
	[0087.429] lstrlenW (lpString=".jpg") returned 4
	[0087.429] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0087.429] lstrcmpiW (lpString1=".jpg", lpString2=".adobe") returned 1
	[0087.429] lstrlenW (lpString="Peacock.jpg") returned 11
	[0087.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0087.714] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5115) returned 1
	[0087.714] CloseHandle (hObject=0x160) returned 1
	[0087.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20
	[0087.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69
	[0087.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69
	[0087.857] lstrlenW (lpString=".doc") returned 4
	[0087.857] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0087.857] lstrlenW (lpString=".docx") returned 5
	[0087.857] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1
	[0087.857] lstrlenW (lpString=".pdf") returned 4
	[0087.857] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0087.857] lstrlenW (lpString=".xls") returned 4
	[0087.857] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0087.857] lstrlenW (lpString=".xlsx") returned 5
	[0087.857] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1
	[0087.857] lstrlenW (lpString=".ppt") returned 4
	[0087.857] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0087.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69
	[0087.857] lstrlenW (lpString=".zip") returned 4
	[0087.857] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0087.857] lstrlenW (lpString=".rar") returned 4
	[0087.857] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0087.857] lstrlenW (lpString=".bz2") returned 4
	[0087.857] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0087.857] lstrlenW (lpString=".7z") returned 3
	[0087.857] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0087.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69
	[0087.857] lstrlenW (lpString=".dbf") returned 4
	[0087.857] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0087.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69
	[0087.857] lstrlenW (lpString=".1cd") returned 4
	[0087.858] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0087.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69
	[0087.858] lstrlenW (lpString=".jpg") returned 4
	[0087.858] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0087.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69
	[0087.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69
	[0087.858] lstrlenW (lpString=".doc") returned 4
	[0087.858] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0087.858] lstrlenW (lpString=".docx") returned 5
	[0087.858] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1
	[0087.858] lstrlenW (lpString=".pdf") returned 4
	[0087.858] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0087.858] lstrlenW (lpString=".xls") returned 4
	[0087.858] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0087.858] lstrlenW (lpString=".xlsx") returned 5
	[0087.858] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1
	[0087.858] lstrlenW (lpString=".ppt") returned 4
	[0087.858] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0087.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69
	[0087.858] lstrlenW (lpString=".zip") returned 4
	[0087.858] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0087.858] lstrlenW (lpString=".rar") returned 4
	[0087.858] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0087.858] lstrlenW (lpString=".bz2") returned 4
	[0087.858] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0087.859] lstrlenW (lpString=".7z") returned 3
	[0087.859] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0087.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69
	[0087.859] lstrlenW (lpString=".dbf") returned 4
	[0087.859] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0087.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69
	[0087.859] lstrlenW (lpString=".1cd") returned 4
	[0087.859] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0087.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69
	[0087.859] lstrlenW (lpString=".jpg") returned 4
	[0087.859] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0087.859] lstrcmpiW (lpString1=".htm", lpString2=".adobe") returned 1
	[0087.859] lstrlenW (lpString="Roses.htm") returned 9
	[0087.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.882] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=233) returned 1
	[0087.882] CloseHandle (hObject=0x1ac) returned 1
	[0087.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20
	[0087.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67
	[0087.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67
	[0087.959] lstrlenW (lpString=".doc") returned 4
	[0087.959] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0087.959] lstrlenW (lpString=".docx") returned 5
	[0087.959] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0087.959] lstrlenW (lpString=".pdf") returned 4
	[0087.959] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0087.959] lstrlenW (lpString=".xls") returned 4
	[0087.959] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0087.959] lstrlenW (lpString=".xlsx") returned 5
	[0087.959] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0087.959] lstrlenW (lpString=".ppt") returned 4
	[0087.959] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0087.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67
	[0087.960] lstrlenW (lpString=".zip") returned 4
	[0087.960] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0087.960] lstrlenW (lpString=".rar") returned 4
	[0087.960] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0087.960] lstrlenW (lpString=".bz2") returned 4
	[0087.960] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0087.960] lstrlenW (lpString=".7z") returned 3
	[0087.960] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0087.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67
	[0087.960] lstrlenW (lpString=".dbf") returned 4
	[0087.960] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0087.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67
	[0087.960] lstrlenW (lpString=".1cd") returned 4
	[0087.960] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0087.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67
	[0087.960] lstrlenW (lpString=".jpg") returned 4
	[0087.960] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0087.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67
	[0087.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67
	[0087.960] lstrlenW (lpString=".doc") returned 4
	[0087.960] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0087.960] lstrlenW (lpString=".docx") returned 5
	[0087.960] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0087.960] lstrlenW (lpString=".pdf") returned 4
	[0087.961] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0087.961] lstrlenW (lpString=".xls") returned 4
	[0087.961] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0087.961] lstrlenW (lpString=".xlsx") returned 5
	[0087.961] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0087.961] lstrlenW (lpString=".ppt") returned 4
	[0087.961] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0087.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67
	[0087.961] lstrlenW (lpString=".zip") returned 4
	[0087.961] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0087.961] lstrlenW (lpString=".rar") returned 4
	[0087.961] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0087.961] lstrlenW (lpString=".bz2") returned 4
	[0087.961] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0087.961] lstrlenW (lpString=".7z") returned 3
	[0087.961] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0087.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67
	[0087.961] lstrlenW (lpString=".dbf") returned 4
	[0087.961] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0087.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67
	[0087.961] lstrlenW (lpString=".1cd") returned 4
	[0087.961] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0087.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67
	[0087.961] lstrlenW (lpString=".jpg") returned 4
	[0087.961] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0087.962] lstrcmpiW (lpString1=".htm", lpString2=".adobe") returned 1
	[0087.962] lstrlenW (lpString="Shades of Blue.htm") returned 18
	[0087.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.034] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=237) returned 1
	[0088.034] CloseHandle (hObject=0x188) returned 1
	[0088.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20
	[0088.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76
	[0088.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76
	[0088.145] lstrlenW (lpString=".doc") returned 4
	[0088.145] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0088.145] lstrlenW (lpString=".docx") returned 5
	[0088.145] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1
	[0088.145] lstrlenW (lpString=".pdf") returned 4
	[0088.145] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0088.145] lstrlenW (lpString=".xls") returned 4
	[0088.145] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0088.145] lstrlenW (lpString=".xlsx") returned 5
	[0088.145] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1
	[0088.145] lstrlenW (lpString=".ppt") returned 4
	[0088.145] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0088.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76
	[0088.146] lstrlenW (lpString=".zip") returned 4
	[0088.146] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0088.146] lstrlenW (lpString=".rar") returned 4
	[0088.146] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0088.146] lstrlenW (lpString=".bz2") returned 4
	[0088.146] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0088.146] lstrlenW (lpString=".7z") returned 3
	[0088.146] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0088.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76
	[0088.146] lstrlenW (lpString=".dbf") returned 4
	[0088.146] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0088.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76
	[0088.146] lstrlenW (lpString=".1cd") returned 4
	[0088.146] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0088.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76
	[0088.146] lstrlenW (lpString=".jpg") returned 4
	[0088.146] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0088.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76
	[0088.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76
	[0088.146] lstrlenW (lpString=".doc") returned 4
	[0088.146] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0088.146] lstrlenW (lpString=".docx") returned 5
	[0088.146] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1
	[0088.146] lstrlenW (lpString=".pdf") returned 4
	[0088.146] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0088.146] lstrlenW (lpString=".xls") returned 4
	[0088.147] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0088.147] lstrlenW (lpString=".xlsx") returned 5
	[0088.147] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1
	[0088.147] lstrlenW (lpString=".ppt") returned 4
	[0088.147] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0088.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76
	[0088.147] lstrlenW (lpString=".zip") returned 4
	[0088.147] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0088.147] lstrlenW (lpString=".rar") returned 4
	[0088.147] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0088.147] lstrlenW (lpString=".bz2") returned 4
	[0088.147] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0088.147] lstrlenW (lpString=".7z") returned 3
	[0088.147] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0088.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76
	[0088.147] lstrlenW (lpString=".dbf") returned 4
	[0088.147] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0088.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76
	[0088.147] lstrlenW (lpString=".1cd") returned 4
	[0088.147] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0088.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76
	[0088.147] lstrlenW (lpString=".jpg") returned 4
	[0088.147] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0088.148] lstrcmpiW (lpString1=".htm", lpString2=".adobe") returned 1
	[0088.148] lstrlenW (lpString="Soft Blue.htm") returned 13
	[0088.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.234] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=232) returned 1
	[0088.234] CloseHandle (hObject=0x188) returned 1
	[0088.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20
	[0088.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0088.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0088.331] lstrlenW (lpString=".doc") returned 4
	[0088.331] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0088.331] lstrlenW (lpString=".docx") returned 5
	[0088.331] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1
	[0088.331] lstrlenW (lpString=".pdf") returned 4
	[0088.331] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0088.331] lstrlenW (lpString=".xls") returned 4
	[0088.331] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0088.331] lstrlenW (lpString=".xlsx") returned 5
	[0088.331] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1
	[0088.331] lstrlenW (lpString=".ppt") returned 4
	[0088.331] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0088.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0088.331] lstrlenW (lpString=".zip") returned 4
	[0088.331] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0088.331] lstrlenW (lpString=".rar") returned 4
	[0088.331] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0088.331] lstrlenW (lpString=".bz2") returned 4
	[0088.331] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0088.331] lstrlenW (lpString=".7z") returned 3
	[0088.331] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0088.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0088.331] lstrlenW (lpString=".dbf") returned 4
	[0088.331] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0088.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0088.331] lstrlenW (lpString=".1cd") returned 4
	[0088.332] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0088.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0088.332] lstrlenW (lpString=".jpg") returned 4
	[0088.332] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0088.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0088.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0088.332] lstrlenW (lpString=".doc") returned 4
	[0088.332] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0088.332] lstrlenW (lpString=".docx") returned 5
	[0088.332] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1
	[0088.332] lstrlenW (lpString=".pdf") returned 4
	[0088.332] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0088.332] lstrlenW (lpString=".xls") returned 4
	[0088.332] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0088.332] lstrlenW (lpString=".xlsx") returned 5
	[0088.332] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1
	[0088.332] lstrlenW (lpString=".ppt") returned 4
	[0088.332] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0088.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0088.332] lstrlenW (lpString=".zip") returned 4
	[0088.332] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0088.332] lstrlenW (lpString=".rar") returned 4
	[0088.332] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0088.332] lstrlenW (lpString=".bz2") returned 4
	[0088.332] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0088.333] lstrlenW (lpString=".7z") returned 3
	[0088.333] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0088.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0088.333] lstrlenW (lpString=".dbf") returned 4
	[0088.333] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0088.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0088.333] lstrlenW (lpString=".1cd") returned 4
	[0088.333] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0088.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0088.333] lstrlenW (lpString=".jpg") returned 4
	[0088.333] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0088.333] lstrcmpiW (lpString1=".gif", lpString2=".adobe") returned 1
	[0088.333] lstrlenW (lpString="Stucco.gif") returned 10
	[0088.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0088.366] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1864) returned 1
	[0088.366] CloseHandle (hObject=0x1ac) returned 1
	[0088.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif")) returned 0x20
	[0088.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0088.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0088.409] lstrlenW (lpString=".doc") returned 4
	[0088.409] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0088.409] lstrlenW (lpString=".docx") returned 5
	[0088.409] lstrcmpiW (lpString1=".docx", lpString2="o.gif") returned -1
	[0088.409] lstrlenW (lpString=".pdf") returned 4
	[0088.409] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0088.409] lstrlenW (lpString=".xls") returned 4
	[0088.409] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0088.410] lstrlenW (lpString=".xlsx") returned 5
	[0088.410] lstrcmpiW (lpString1=".xlsx", lpString2="o.gif") returned -1
	[0088.410] lstrlenW (lpString=".ppt") returned 4
	[0088.410] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0088.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0088.410] lstrlenW (lpString=".zip") returned 4
	[0088.410] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0088.410] lstrlenW (lpString=".rar") returned 4
	[0088.410] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0088.410] lstrlenW (lpString=".bz2") returned 4
	[0088.410] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0088.410] lstrlenW (lpString=".7z") returned 3
	[0088.410] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0088.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0088.410] lstrlenW (lpString=".dbf") returned 4
	[0088.410] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0088.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0088.410] lstrlenW (lpString=".1cd") returned 4
	[0088.410] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0088.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0088.410] lstrlenW (lpString=".jpg") returned 4
	[0088.410] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0088.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0088.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0088.410] lstrlenW (lpString=".doc") returned 4
	[0088.411] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0088.411] lstrlenW (lpString=".docx") returned 5
	[0088.411] lstrcmpiW (lpString1=".docx", lpString2="o.gif") returned -1
	[0088.411] lstrlenW (lpString=".pdf") returned 4
	[0088.411] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0088.411] lstrlenW (lpString=".xls") returned 4
	[0088.411] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0088.411] lstrlenW (lpString=".xlsx") returned 5
	[0088.411] lstrcmpiW (lpString1=".xlsx", lpString2="o.gif") returned -1
	[0088.411] lstrlenW (lpString=".ppt") returned 4
	[0088.411] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0088.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0088.411] lstrlenW (lpString=".zip") returned 4
	[0088.411] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0088.411] lstrlenW (lpString=".rar") returned 4
	[0088.411] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0088.411] lstrlenW (lpString=".bz2") returned 4
	[0088.411] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0088.411] lstrlenW (lpString=".7z") returned 3
	[0088.411] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0088.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0088.411] lstrlenW (lpString=".dbf") returned 4
	[0088.411] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0088.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0088.411] lstrlenW (lpString=".1cd") returned 4
	[0088.411] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0088.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0088.411] lstrlenW (lpString=".jpg") returned 4
	[0088.411] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0088.412] lstrcmpiW (lpString1=".jpg", lpString2=".adobe") returned 1
	[0088.412] lstrlenW (lpString="White_Chocolate.jpg") returned 19
	[0088.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.446] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3168) returned 1
	[0088.446] CloseHandle (hObject=0x160) returned 1
	[0088.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg")) returned 0x20
	[0088.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77
	[0088.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77
	[0088.562] lstrlenW (lpString=".doc") returned 4
	[0088.562] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0088.562] lstrlenW (lpString=".docx") returned 5
	[0088.562] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1
	[0088.562] lstrlenW (lpString=".pdf") returned 4
	[0088.562] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0088.563] lstrlenW (lpString=".xls") returned 4
	[0088.563] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0088.563] lstrlenW (lpString=".xlsx") returned 5
	[0088.563] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1
	[0088.563] lstrlenW (lpString=".ppt") returned 4
	[0088.563] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0088.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77
	[0088.563] lstrlenW (lpString=".zip") returned 4
	[0088.563] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0088.563] lstrlenW (lpString=".rar") returned 4
	[0088.563] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0088.563] lstrlenW (lpString=".bz2") returned 4
	[0088.563] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0088.563] lstrlenW (lpString=".7z") returned 3
	[0088.563] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0088.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77
	[0088.563] lstrlenW (lpString=".dbf") returned 4
	[0088.563] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0088.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77
	[0088.563] lstrlenW (lpString=".1cd") returned 4
	[0088.563] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0088.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77
	[0088.563] lstrlenW (lpString=".jpg") returned 4
	[0088.563] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0088.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77
	[0088.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77
	[0088.564] lstrlenW (lpString=".doc") returned 4
	[0088.564] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0088.564] lstrlenW (lpString=".docx") returned 5
	[0088.564] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1
	[0088.564] lstrlenW (lpString=".pdf") returned 4
	[0088.564] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0088.564] lstrlenW (lpString=".xls") returned 4
	[0088.564] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0088.564] lstrlenW (lpString=".xlsx") returned 5
	[0088.564] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1
	[0088.564] lstrlenW (lpString=".ppt") returned 4
	[0088.564] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0088.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77
	[0088.564] lstrlenW (lpString=".zip") returned 4
	[0088.564] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0088.564] lstrlenW (lpString=".rar") returned 4
	[0088.564] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0088.564] lstrlenW (lpString=".bz2") returned 4
	[0088.564] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0088.564] lstrlenW (lpString=".7z") returned 3
	[0088.564] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0088.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77
	[0088.564] lstrlenW (lpString=".dbf") returned 4
	[0088.564] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0088.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77
	[0088.564] lstrlenW (lpString=".1cd") returned 4
	[0088.565] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0088.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77
	[0088.565] lstrlenW (lpString=".jpg") returned 4
	[0088.565] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0088.565] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.565] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.579] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=33009) returned 1
	[0088.579] CloseHandle (hObject=0x188) returned 1
	[0088.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20
	[0088.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.579] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.579] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.580] GetLastError () returned 0x0
	[0088.580] ReadFile (in: hFile=0x188, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x80f1, lpOverlapped=0x0) returned 1
	[0088.592] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x8100, lpOverlapped=0x0) returned 1
	[0088.594] ReadFile (in: hFile=0x188, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.594] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.595] SetEndOfFile (hFile=0x160) returned 1
	[0088.595] CloseHandle (hObject=0x160) returned 1
	[0088.595] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.595] SetEndOfFile (hFile=0x188) returned 1
	[0088.596] CloseHandle (hObject=0x188) returned 1
	[0088.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.597] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1
	[0088.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0088.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0088.597] lstrlenW (lpString=".doc") returned 4
	[0088.597] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.597] lstrlenW (lpString=".docx") returned 5
	[0088.597] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.597] lstrlenW (lpString=".pdf") returned 4
	[0088.597] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.597] lstrlenW (lpString=".xls") returned 4
	[0088.597] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.597] lstrlenW (lpString=".xlsx") returned 5
	[0088.598] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.598] lstrlenW (lpString=".ppt") returned 4
	[0088.598] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0088.598] lstrlenW (lpString=".zip") returned 4
	[0088.598] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.598] lstrlenW (lpString=".rar") returned 4
	[0088.598] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.598] lstrlenW (lpString=".bz2") returned 4
	[0088.598] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.598] lstrlenW (lpString=".7z") returned 3
	[0088.598] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0088.598] lstrlenW (lpString=".dbf") returned 4
	[0088.598] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0088.598] lstrlenW (lpString=".1cd") returned 4
	[0088.598] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0088.598] lstrlenW (lpString=".jpg") returned 4
	[0088.599] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0088.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0088.599] lstrlenW (lpString=".doc") returned 4
	[0088.599] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.599] lstrlenW (lpString=".docx") returned 5
	[0088.599] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.599] lstrlenW (lpString=".pdf") returned 4
	[0088.599] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.599] lstrlenW (lpString=".xls") returned 4
	[0088.599] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.599] lstrlenW (lpString=".xlsx") returned 5
	[0088.599] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.599] lstrlenW (lpString=".ppt") returned 4
	[0088.599] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0088.599] lstrlenW (lpString=".zip") returned 4
	[0088.599] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.599] lstrlenW (lpString=".rar") returned 4
	[0088.599] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.599] lstrlenW (lpString=".bz2") returned 4
	[0088.599] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.599] lstrlenW (lpString=".7z") returned 3
	[0088.599] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0088.600] lstrlenW (lpString=".dbf") returned 4
	[0088.600] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0088.600] lstrlenW (lpString=".1cd") returned 4
	[0088.600] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0088.600] lstrlenW (lpString=".jpg") returned 4
	[0088.600] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.600] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.600] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.613] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=27407) returned 1
	[0088.613] CloseHandle (hObject=0x174) returned 1
	[0088.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20
	[0088.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.614] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.614] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0088.614] GetLastError () returned 0x0
	[0088.614] ReadFile (in: hFile=0x174, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x6b0f, lpOverlapped=0x0) returned 1
	[0088.626] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x6b10, lpOverlapped=0x0) returned 1
	[0088.627] ReadFile (in: hFile=0x174, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.628] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.628] SetEndOfFile (hFile=0x1b4) returned 1
	[0088.628] CloseHandle (hObject=0x1b4) returned 1
	[0088.628] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.628] SetEndOfFile (hFile=0x174) returned 1
	[0088.629] CloseHandle (hObject=0x174) returned 1
	[0088.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.630] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1
	[0088.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0088.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0088.630] lstrlenW (lpString=".doc") returned 4
	[0088.630] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.630] lstrlenW (lpString=".docx") returned 5
	[0088.630] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.630] lstrlenW (lpString=".pdf") returned 4
	[0088.630] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.630] lstrlenW (lpString=".xls") returned 4
	[0088.630] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.630] lstrlenW (lpString=".xlsx") returned 5
	[0088.630] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.630] lstrlenW (lpString=".ppt") returned 4
	[0088.631] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0088.631] lstrlenW (lpString=".zip") returned 4
	[0088.631] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.631] lstrlenW (lpString=".rar") returned 4
	[0088.631] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.631] lstrlenW (lpString=".bz2") returned 4
	[0088.631] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.631] lstrlenW (lpString=".7z") returned 3
	[0088.631] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0088.631] lstrlenW (lpString=".dbf") returned 4
	[0088.631] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0088.631] lstrlenW (lpString=".1cd") returned 4
	[0088.631] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0088.631] lstrlenW (lpString=".jpg") returned 4
	[0088.631] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0088.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0088.631] lstrlenW (lpString=".doc") returned 4
	[0088.631] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.631] lstrlenW (lpString=".docx") returned 5
	[0088.631] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.631] lstrlenW (lpString=".pdf") returned 4
	[0088.632] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.632] lstrlenW (lpString=".xls") returned 4
	[0088.632] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.632] lstrlenW (lpString=".xlsx") returned 5
	[0088.632] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.632] lstrlenW (lpString=".ppt") returned 4
	[0088.632] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0088.632] lstrlenW (lpString=".zip") returned 4
	[0088.632] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.632] lstrlenW (lpString=".rar") returned 4
	[0088.632] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.632] lstrlenW (lpString=".bz2") returned 4
	[0088.632] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.632] lstrlenW (lpString=".7z") returned 3
	[0088.632] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0088.632] lstrlenW (lpString=".dbf") returned 4
	[0088.632] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0088.632] lstrlenW (lpString=".1cd") returned 4
	[0088.632] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0088.632] lstrlenW (lpString=".jpg") returned 4
	[0088.632] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.633] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.633] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0088.658] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=31837) returned 1
	[0088.658] CloseHandle (hObject=0x1b4) returned 1
	[0088.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20
	[0088.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0088.659] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.659] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.659] GetLastError () returned 0x0
	[0088.659] ReadFile (in: hFile=0x1b4, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x7c5d, lpOverlapped=0x0) returned 1
	[0088.673] WriteFile (in: hFile=0x188, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x7c60, lpOverlapped=0x0) returned 1
	[0088.675] ReadFile (in: hFile=0x1b4, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.675] WriteFile (in: hFile=0x188, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.675] SetEndOfFile (hFile=0x188) returned 1
	[0088.675] CloseHandle (hObject=0x188) returned 1
	[0088.675] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.675] SetEndOfFile (hFile=0x1b4) returned 1
	[0088.677] CloseHandle (hObject=0x1b4) returned 1
	[0088.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.677] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1
	[0088.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0088.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0088.677] lstrlenW (lpString=".doc") returned 4
	[0088.677] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.678] lstrlenW (lpString=".docx") returned 5
	[0088.678] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.678] lstrlenW (lpString=".pdf") returned 4
	[0088.678] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.678] lstrlenW (lpString=".xls") returned 4
	[0088.678] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.678] lstrlenW (lpString=".xlsx") returned 5
	[0088.678] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.678] lstrlenW (lpString=".ppt") returned 4
	[0088.678] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0088.678] lstrlenW (lpString=".zip") returned 4
	[0088.678] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.678] lstrlenW (lpString=".rar") returned 4
	[0088.678] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.678] lstrlenW (lpString=".bz2") returned 4
	[0088.678] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.678] lstrlenW (lpString=".7z") returned 3
	[0088.678] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0088.678] lstrlenW (lpString=".dbf") returned 4
	[0088.678] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0088.678] lstrlenW (lpString=".1cd") returned 4
	[0088.678] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0088.678] lstrlenW (lpString=".jpg") returned 4
	[0088.679] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0088.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0088.679] lstrlenW (lpString=".doc") returned 4
	[0088.679] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.679] lstrlenW (lpString=".docx") returned 5
	[0088.679] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.679] lstrlenW (lpString=".pdf") returned 4
	[0088.679] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.679] lstrlenW (lpString=".xls") returned 4
	[0088.679] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.679] lstrlenW (lpString=".xlsx") returned 5
	[0088.679] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.679] lstrlenW (lpString=".ppt") returned 4
	[0088.679] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0088.679] lstrlenW (lpString=".zip") returned 4
	[0088.679] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.679] lstrlenW (lpString=".rar") returned 4
	[0088.679] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.679] lstrlenW (lpString=".bz2") returned 4
	[0088.679] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.679] lstrlenW (lpString=".7z") returned 3
	[0088.679] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0088.679] lstrlenW (lpString=".dbf") returned 4
	[0088.680] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0088.680] lstrlenW (lpString=".1cd") returned 4
	[0088.680] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0088.680] lstrlenW (lpString=".jpg") returned 4
	[0088.680] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.680] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.680] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0088.716] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=43276) returned 1
	[0088.716] CloseHandle (hObject=0x198) returned 1
	[0088.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20
	[0088.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0088.717] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.717] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.718] GetLastError () returned 0x0
	[0088.718] ReadFile (in: hFile=0x198, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xa90c, lpOverlapped=0x0) returned 1
	[0088.731] WriteFile (in: hFile=0x188, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xa910, lpOverlapped=0x0) returned 1
	[0088.733] ReadFile (in: hFile=0x198, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.733] WriteFile (in: hFile=0x188, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.733] SetEndOfFile (hFile=0x188) returned 1
	[0088.733] CloseHandle (hObject=0x188) returned 1
	[0088.733] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.733] SetEndOfFile (hFile=0x198) returned 1
	[0088.735] CloseHandle (hObject=0x198) returned 1
	[0088.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.735] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1
	[0088.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0088.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0088.735] lstrlenW (lpString=".doc") returned 4
	[0088.736] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.736] lstrlenW (lpString=".docx") returned 5
	[0088.736] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.736] lstrlenW (lpString=".pdf") returned 4
	[0088.736] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.736] lstrlenW (lpString=".xls") returned 4
	[0088.736] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.736] lstrlenW (lpString=".xlsx") returned 5
	[0088.736] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.736] lstrlenW (lpString=".ppt") returned 4
	[0088.736] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0088.736] lstrlenW (lpString=".zip") returned 4
	[0088.736] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.736] lstrlenW (lpString=".rar") returned 4
	[0088.736] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.736] lstrlenW (lpString=".bz2") returned 4
	[0088.736] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.736] lstrlenW (lpString=".7z") returned 3
	[0088.736] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0088.736] lstrlenW (lpString=".dbf") returned 4
	[0088.736] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0088.736] lstrlenW (lpString=".1cd") returned 4
	[0088.736] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0088.737] lstrlenW (lpString=".jpg") returned 4
	[0088.737] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0088.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0088.737] lstrlenW (lpString=".doc") returned 4
	[0088.737] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.737] lstrlenW (lpString=".docx") returned 5
	[0088.737] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.737] lstrlenW (lpString=".pdf") returned 4
	[0088.737] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.737] lstrlenW (lpString=".xls") returned 4
	[0088.737] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.737] lstrlenW (lpString=".xlsx") returned 5
	[0088.737] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.737] lstrlenW (lpString=".ppt") returned 4
	[0088.737] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0088.737] lstrlenW (lpString=".zip") returned 4
	[0088.737] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.737] lstrlenW (lpString=".rar") returned 4
	[0088.737] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.737] lstrlenW (lpString=".bz2") returned 4
	[0088.737] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.737] lstrlenW (lpString=".7z") returned 3
	[0088.737] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0088.738] lstrlenW (lpString=".dbf") returned 4
	[0088.738] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0088.738] lstrlenW (lpString=".1cd") returned 4
	[0088.738] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0088.738] lstrlenW (lpString=".jpg") returned 4
	[0088.738] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.738] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.738] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0088.769] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=29925) returned 1
	[0088.769] CloseHandle (hObject=0x1b0) returned 1
	[0088.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20
	[0088.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0088.857] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.857] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0088.870] GetLastError () returned 0x0
	[0088.870] ReadFile (in: hFile=0x1a8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x74e5, lpOverlapped=0x0) returned 1
	[0088.880] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x74f0, lpOverlapped=0x0) returned 1
	[0088.881] ReadFile (in: hFile=0x1a8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.882] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.882] SetEndOfFile (hFile=0x184) returned 1
	[0088.882] CloseHandle (hObject=0x184) returned 1
	[0088.882] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.882] SetEndOfFile (hFile=0x1a8) returned 1
	[0088.883] CloseHandle (hObject=0x1a8) returned 1
	[0088.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.883] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1
	[0088.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0088.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0088.884] lstrlenW (lpString=".doc") returned 4
	[0088.884] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.884] lstrlenW (lpString=".docx") returned 5
	[0088.884] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.884] lstrlenW (lpString=".pdf") returned 4
	[0088.884] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.884] lstrlenW (lpString=".xls") returned 4
	[0088.884] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.884] lstrlenW (lpString=".xlsx") returned 5
	[0088.884] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.884] lstrlenW (lpString=".ppt") returned 4
	[0088.884] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0088.884] lstrlenW (lpString=".zip") returned 4
	[0088.884] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.884] lstrlenW (lpString=".rar") returned 4
	[0088.884] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.884] lstrlenW (lpString=".bz2") returned 4
	[0088.884] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.884] lstrlenW (lpString=".7z") returned 3
	[0088.884] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0088.884] lstrlenW (lpString=".dbf") returned 4
	[0088.884] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0088.884] lstrlenW (lpString=".1cd") returned 4
	[0088.884] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0088.884] lstrlenW (lpString=".jpg") returned 4
	[0088.884] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0088.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0088.885] lstrlenW (lpString=".doc") returned 4
	[0088.885] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.885] lstrlenW (lpString=".docx") returned 5
	[0088.885] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.885] lstrlenW (lpString=".pdf") returned 4
	[0088.885] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.885] lstrlenW (lpString=".xls") returned 4
	[0088.885] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.885] lstrlenW (lpString=".xlsx") returned 5
	[0088.885] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.885] lstrlenW (lpString=".ppt") returned 4
	[0088.885] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0088.885] lstrlenW (lpString=".zip") returned 4
	[0088.885] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.885] lstrlenW (lpString=".rar") returned 4
	[0088.885] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.885] lstrlenW (lpString=".bz2") returned 4
	[0088.885] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.885] lstrlenW (lpString=".7z") returned 3
	[0088.885] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0088.885] lstrlenW (lpString=".dbf") returned 4
	[0088.885] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0088.885] lstrlenW (lpString=".1cd") returned 4
	[0088.885] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0088.885] lstrlenW (lpString=".jpg") returned 4
	[0088.885] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.885] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.886] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.915] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=25106) returned 1
	[0088.915] CloseHandle (hObject=0x188) returned 1
	[0088.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20
	[0088.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.927] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.927] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.934] GetLastError () returned 0x0
	[0088.934] ReadFile (in: hFile=0x174, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x6212, lpOverlapped=0x0) returned 1
	[0088.941] WriteFile (in: hFile=0x188, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x6220, lpOverlapped=0x0) returned 1
	[0088.943] ReadFile (in: hFile=0x174, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.943] WriteFile (in: hFile=0x188, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.943] SetEndOfFile (hFile=0x188) returned 1
	[0088.943] CloseHandle (hObject=0x188) returned 1
	[0088.944] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.944] SetEndOfFile (hFile=0x174) returned 1
	[0088.945] CloseHandle (hObject=0x174) returned 1
	[0088.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.945] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1
	[0088.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0088.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0088.946] lstrlenW (lpString=".doc") returned 4
	[0088.946] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.946] lstrlenW (lpString=".docx") returned 5
	[0088.946] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.946] lstrlenW (lpString=".pdf") returned 4
	[0088.946] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.946] lstrlenW (lpString=".xls") returned 4
	[0088.946] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.946] lstrlenW (lpString=".xlsx") returned 5
	[0088.946] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.946] lstrlenW (lpString=".ppt") returned 4
	[0088.946] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0088.946] lstrlenW (lpString=".zip") returned 4
	[0088.946] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.946] lstrlenW (lpString=".rar") returned 4
	[0088.946] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.946] lstrlenW (lpString=".bz2") returned 4
	[0088.946] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.946] lstrlenW (lpString=".7z") returned 3
	[0088.947] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0088.947] lstrlenW (lpString=".dbf") returned 4
	[0088.947] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0088.947] lstrlenW (lpString=".1cd") returned 4
	[0088.947] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0088.947] lstrlenW (lpString=".jpg") returned 4
	[0088.947] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0088.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0088.947] lstrlenW (lpString=".doc") returned 4
	[0088.947] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.947] lstrlenW (lpString=".docx") returned 5
	[0088.947] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.947] lstrlenW (lpString=".pdf") returned 4
	[0088.947] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.947] lstrlenW (lpString=".xls") returned 4
	[0088.947] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.947] lstrlenW (lpString=".xlsx") returned 5
	[0088.947] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.947] lstrlenW (lpString=".ppt") returned 4
	[0088.947] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0088.948] lstrlenW (lpString=".zip") returned 4
	[0088.948] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.948] lstrlenW (lpString=".rar") returned 4
	[0088.948] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.948] lstrlenW (lpString=".bz2") returned 4
	[0088.948] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.948] lstrlenW (lpString=".7z") returned 3
	[0088.948] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0088.948] lstrlenW (lpString=".dbf") returned 4
	[0088.948] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0088.948] lstrlenW (lpString=".1cd") returned 4
	[0088.948] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0088.948] lstrlenW (lpString=".jpg") returned 4
	[0088.948] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.948] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.948] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.949] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=26402) returned 1
	[0088.949] CloseHandle (hObject=0x174) returned 1
	[0088.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20
	[0088.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0088.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.950] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.950] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0088.950] GetLastError () returned 0x0
	[0088.951] ReadFile (in: hFile=0x174, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x6722, lpOverlapped=0x0) returned 1
	[0088.963] WriteFile (in: hFile=0x188, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x6730, lpOverlapped=0x0) returned 1
	[0088.965] ReadFile (in: hFile=0x174, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.965] WriteFile (in: hFile=0x188, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.965] SetEndOfFile (hFile=0x188) returned 1
	[0088.966] CloseHandle (hObject=0x188) returned 1
	[0088.966] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.966] SetEndOfFile (hFile=0x174) returned 1
	[0088.967] CloseHandle (hObject=0x174) returned 1
	[0088.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0088.968] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1
	[0088.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0088.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0088.968] lstrlenW (lpString=".doc") returned 4
	[0088.968] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.968] lstrlenW (lpString=".docx") returned 5
	[0088.968] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.968] lstrlenW (lpString=".pdf") returned 4
	[0088.968] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.968] lstrlenW (lpString=".xls") returned 4
	[0088.968] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.968] lstrlenW (lpString=".xlsx") returned 5
	[0088.969] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.969] lstrlenW (lpString=".ppt") returned 4
	[0088.969] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0088.969] lstrlenW (lpString=".zip") returned 4
	[0088.969] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.969] lstrlenW (lpString=".rar") returned 4
	[0088.969] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.969] lstrlenW (lpString=".bz2") returned 4
	[0088.969] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.969] lstrlenW (lpString=".7z") returned 3
	[0088.969] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0088.969] lstrlenW (lpString=".dbf") returned 4
	[0088.969] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0088.969] lstrlenW (lpString=".1cd") returned 4
	[0088.969] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0088.969] lstrlenW (lpString=".jpg") returned 4
	[0088.969] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0088.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0088.970] lstrlenW (lpString=".doc") returned 4
	[0088.970] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0088.970] lstrlenW (lpString=".docx") returned 5
	[0088.970] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0088.970] lstrlenW (lpString=".pdf") returned 4
	[0088.970] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0088.970] lstrlenW (lpString=".xls") returned 4
	[0088.970] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0088.970] lstrlenW (lpString=".xlsx") returned 5
	[0088.970] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0088.970] lstrlenW (lpString=".ppt") returned 4
	[0088.970] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0088.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0088.970] lstrlenW (lpString=".zip") returned 4
	[0088.970] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0088.970] lstrlenW (lpString=".rar") returned 4
	[0088.970] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0088.970] lstrlenW (lpString=".bz2") returned 4
	[0088.970] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0088.970] lstrlenW (lpString=".7z") returned 3
	[0088.970] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0088.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0088.971] lstrlenW (lpString=".dbf") returned 4
	[0088.971] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0088.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0088.971] lstrlenW (lpString=".1cd") returned 4
	[0088.971] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0088.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0088.971] lstrlenW (lpString=".jpg") returned 4
	[0088.971] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0088.971] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0088.971] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0088.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0089.019] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=32433) returned 1
	[0089.019] CloseHandle (hObject=0x184) returned 1
	[0089.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20
	[0089.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0089.020] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.020] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0089.020] GetLastError () returned 0x0
	[0089.020] ReadFile (in: hFile=0x184, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x7eb1, lpOverlapped=0x0) returned 1
	[0089.032] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x7ec0, lpOverlapped=0x0) returned 1
	[0089.033] ReadFile (in: hFile=0x184, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.033] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.033] SetEndOfFile (hFile=0x1b8) returned 1
	[0089.033] CloseHandle (hObject=0x1b8) returned 1
	[0089.033] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.034] SetEndOfFile (hFile=0x184) returned 1
	[0089.034] CloseHandle (hObject=0x184) returned 1
	[0089.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.035] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1
	[0089.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0089.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0089.035] lstrlenW (lpString=".doc") returned 4
	[0089.035] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.035] lstrlenW (lpString=".docx") returned 5
	[0089.035] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.035] lstrlenW (lpString=".pdf") returned 4
	[0089.035] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.035] lstrlenW (lpString=".xls") returned 4
	[0089.035] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.035] lstrlenW (lpString=".xlsx") returned 5
	[0089.035] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.035] lstrlenW (lpString=".ppt") returned 4
	[0089.035] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0089.035] lstrlenW (lpString=".zip") returned 4
	[0089.036] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.036] lstrlenW (lpString=".rar") returned 4
	[0089.036] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.036] lstrlenW (lpString=".bz2") returned 4
	[0089.036] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.036] lstrlenW (lpString=".7z") returned 3
	[0089.036] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0089.036] lstrlenW (lpString=".dbf") returned 4
	[0089.036] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0089.036] lstrlenW (lpString=".1cd") returned 4
	[0089.036] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0089.036] lstrlenW (lpString=".jpg") returned 4
	[0089.036] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0089.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0089.036] lstrlenW (lpString=".doc") returned 4
	[0089.036] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.036] lstrlenW (lpString=".docx") returned 5
	[0089.036] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.036] lstrlenW (lpString=".pdf") returned 4
	[0089.036] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.036] lstrlenW (lpString=".xls") returned 4
	[0089.036] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.036] lstrlenW (lpString=".xlsx") returned 5
	[0089.036] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.036] lstrlenW (lpString=".ppt") returned 4
	[0089.036] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0089.036] lstrlenW (lpString=".zip") returned 4
	[0089.037] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.037] lstrlenW (lpString=".rar") returned 4
	[0089.037] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.037] lstrlenW (lpString=".bz2") returned 4
	[0089.037] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.037] lstrlenW (lpString=".7z") returned 3
	[0089.037] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0089.037] lstrlenW (lpString=".dbf") returned 4
	[0089.037] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0089.037] lstrlenW (lpString=".1cd") returned 4
	[0089.037] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0089.037] lstrlenW (lpString=".jpg") returned 4
	[0089.037] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.037] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0089.037] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0089.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0089.179] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=60724) returned 1
	[0089.179] CloseHandle (hObject=0x1bc) returned 1
	[0089.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20
	[0089.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0089.180] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.180] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0089.180] GetLastError () returned 0x0
	[0089.180] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xed34, lpOverlapped=0x0) returned 1
	[0089.209] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xed40, lpOverlapped=0x0) returned 1
	[0089.212] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.212] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.212] SetEndOfFile (hFile=0x184) returned 1
	[0089.212] CloseHandle (hObject=0x184) returned 1
	[0089.212] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.212] SetEndOfFile (hFile=0x1bc) returned 1
	[0089.213] CloseHandle (hObject=0x1bc) returned 1
	[0089.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.214] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1
	[0089.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0089.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0089.214] lstrlenW (lpString=".doc") returned 4
	[0089.214] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.214] lstrlenW (lpString=".docx") returned 5
	[0089.214] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.214] lstrlenW (lpString=".pdf") returned 4
	[0089.214] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.214] lstrlenW (lpString=".xls") returned 4
	[0089.214] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.214] lstrlenW (lpString=".xlsx") returned 5
	[0089.214] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.214] lstrlenW (lpString=".ppt") returned 4
	[0089.214] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0089.214] lstrlenW (lpString=".zip") returned 4
	[0089.214] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.214] lstrlenW (lpString=".rar") returned 4
	[0089.214] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.215] lstrlenW (lpString=".bz2") returned 4
	[0089.215] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.215] lstrlenW (lpString=".7z") returned 3
	[0089.215] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0089.215] lstrlenW (lpString=".dbf") returned 4
	[0089.215] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0089.215] lstrlenW (lpString=".1cd") returned 4
	[0089.215] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0089.215] lstrlenW (lpString=".jpg") returned 4
	[0089.215] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0089.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0089.215] lstrlenW (lpString=".doc") returned 4
	[0089.215] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.215] lstrlenW (lpString=".docx") returned 5
	[0089.215] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.215] lstrlenW (lpString=".pdf") returned 4
	[0089.215] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.215] lstrlenW (lpString=".xls") returned 4
	[0089.215] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.215] lstrlenW (lpString=".xlsx") returned 5
	[0089.215] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.215] lstrlenW (lpString=".ppt") returned 4
	[0089.215] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0089.216] lstrlenW (lpString=".zip") returned 4
	[0089.216] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.216] lstrlenW (lpString=".rar") returned 4
	[0089.216] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.216] lstrlenW (lpString=".bz2") returned 4
	[0089.216] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.216] lstrlenW (lpString=".7z") returned 3
	[0089.216] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0089.216] lstrlenW (lpString=".dbf") returned 4
	[0089.216] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0089.216] lstrlenW (lpString=".1cd") returned 4
	[0089.216] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0089.216] lstrlenW (lpString=".jpg") returned 4
	[0089.216] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.216] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0089.216] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0089.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.412] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=33559) returned 1
	[0089.412] CloseHandle (hObject=0x160) returned 1
	[0089.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20
	[0089.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.413] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.413] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.413] GetLastError () returned 0x0
	[0089.413] ReadFile (in: hFile=0x160, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x8317, lpOverlapped=0x0) returned 1
	[0089.424] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x8320, lpOverlapped=0x0) returned 1
	[0089.427] ReadFile (in: hFile=0x160, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.427] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.427] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.427] CloseHandle (hObject=0x1b0) returned 1
	[0089.428] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.428] SetEndOfFile (hFile=0x160) returned 1
	[0089.429] CloseHandle (hObject=0x160) returned 1
	[0089.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.429] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1
	[0089.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0089.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0089.429] lstrlenW (lpString=".doc") returned 4
	[0089.429] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.429] lstrlenW (lpString=".docx") returned 5
	[0089.429] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.429] lstrlenW (lpString=".pdf") returned 4
	[0089.429] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.429] lstrlenW (lpString=".xls") returned 4
	[0089.429] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.429] lstrlenW (lpString=".xlsx") returned 5
	[0089.429] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.429] lstrlenW (lpString=".ppt") returned 4
	[0089.429] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0089.429] lstrlenW (lpString=".zip") returned 4
	[0089.429] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.430] lstrlenW (lpString=".rar") returned 4
	[0089.430] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.430] lstrlenW (lpString=".bz2") returned 4
	[0089.430] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.430] lstrlenW (lpString=".7z") returned 3
	[0089.430] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0089.430] lstrlenW (lpString=".dbf") returned 4
	[0089.430] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0089.430] lstrlenW (lpString=".1cd") returned 4
	[0089.430] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0089.430] lstrlenW (lpString=".jpg") returned 4
	[0089.430] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0089.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0089.430] lstrlenW (lpString=".doc") returned 4
	[0089.430] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.430] lstrlenW (lpString=".docx") returned 5
	[0089.430] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.430] lstrlenW (lpString=".pdf") returned 4
	[0089.430] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.430] lstrlenW (lpString=".xls") returned 4
	[0089.430] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.430] lstrlenW (lpString=".xlsx") returned 5
	[0089.430] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.430] lstrlenW (lpString=".ppt") returned 4
	[0089.430] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0089.430] lstrlenW (lpString=".zip") returned 4
	[0089.431] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.431] lstrlenW (lpString=".rar") returned 4
	[0089.431] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.431] lstrlenW (lpString=".bz2") returned 4
	[0089.431] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.431] lstrlenW (lpString=".7z") returned 3
	[0089.431] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0089.431] lstrlenW (lpString=".dbf") returned 4
	[0089.431] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0089.431] lstrlenW (lpString=".1cd") returned 4
	[0089.431] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0089.431] lstrlenW (lpString=".jpg") returned 4
	[0089.431] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.431] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0089.431] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0089.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0089.519] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=18413) returned 1
	[0089.519] CloseHandle (hObject=0x1bc) returned 1
	[0089.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20
	[0089.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0089.519] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.519] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0089.520] GetLastError () returned 0x0
	[0089.520] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x47ed, lpOverlapped=0x0) returned 1
	[0089.536] WriteFile (in: hFile=0x174, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x47f0, lpOverlapped=0x0) returned 1
	[0089.538] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.538] WriteFile (in: hFile=0x174, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.538] SetEndOfFile (hFile=0x174) returned 1
	[0089.538] CloseHandle (hObject=0x174) returned 1
	[0089.539] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.539] SetEndOfFile (hFile=0x1bc) returned 1
	[0089.540] CloseHandle (hObject=0x1bc) returned 1
	[0089.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.541] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1
	[0089.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0089.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0089.541] lstrlenW (lpString=".doc") returned 4
	[0089.541] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.542] lstrlenW (lpString=".docx") returned 5
	[0089.542] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.542] lstrlenW (lpString=".pdf") returned 4
	[0089.542] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.542] lstrlenW (lpString=".xls") returned 4
	[0089.542] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.542] lstrlenW (lpString=".xlsx") returned 5
	[0089.542] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.542] lstrlenW (lpString=".ppt") returned 4
	[0089.542] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0089.542] lstrlenW (lpString=".zip") returned 4
	[0089.542] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.542] lstrlenW (lpString=".rar") returned 4
	[0089.542] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.542] lstrlenW (lpString=".bz2") returned 4
	[0089.542] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.542] lstrlenW (lpString=".7z") returned 3
	[0089.542] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0089.542] lstrlenW (lpString=".dbf") returned 4
	[0089.542] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0089.542] lstrlenW (lpString=".1cd") returned 4
	[0089.542] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0089.542] lstrlenW (lpString=".jpg") returned 4
	[0089.542] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0089.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0089.542] lstrlenW (lpString=".doc") returned 4
	[0089.543] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.543] lstrlenW (lpString=".docx") returned 5
	[0089.543] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.543] lstrlenW (lpString=".pdf") returned 4
	[0089.543] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.543] lstrlenW (lpString=".xls") returned 4
	[0089.543] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.543] lstrlenW (lpString=".xlsx") returned 5
	[0089.543] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.543] lstrlenW (lpString=".ppt") returned 4
	[0089.543] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0089.543] lstrlenW (lpString=".zip") returned 4
	[0089.543] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.543] lstrlenW (lpString=".rar") returned 4
	[0089.543] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.543] lstrlenW (lpString=".bz2") returned 4
	[0089.543] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.543] lstrlenW (lpString=".7z") returned 3
	[0089.543] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0089.543] lstrlenW (lpString=".dbf") returned 4
	[0089.543] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0089.543] lstrlenW (lpString=".1cd") returned 4
	[0089.543] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0089.543] lstrlenW (lpString=".jpg") returned 4
	[0089.543] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.544] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0089.544] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0089.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0089.668] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=48115) returned 1
	[0089.669] CloseHandle (hObject=0x1bc) returned 1
	[0089.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20
	[0089.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0089.669] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.669] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0089.670] GetLastError () returned 0x0
	[0089.670] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xbbf3, lpOverlapped=0x0) returned 1
	[0089.712] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xbc00, lpOverlapped=0x0) returned 1
	[0089.714] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.714] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.714] SetEndOfFile (hFile=0x1b8) returned 1
	[0089.715] CloseHandle (hObject=0x1b8) returned 1
	[0089.715] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.715] SetEndOfFile (hFile=0x1bc) returned 1
	[0089.717] CloseHandle (hObject=0x1bc) returned 1
	[0089.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.717] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1
	[0089.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0089.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0089.721] lstrlenW (lpString=".doc") returned 4
	[0089.721] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.721] lstrlenW (lpString=".docx") returned 5
	[0089.721] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.721] lstrlenW (lpString=".pdf") returned 4
	[0089.721] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.721] lstrlenW (lpString=".xls") returned 4
	[0089.721] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.721] lstrlenW (lpString=".xlsx") returned 5
	[0089.721] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.721] lstrlenW (lpString=".ppt") returned 4
	[0089.721] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0089.721] lstrlenW (lpString=".zip") returned 4
	[0089.721] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.721] lstrlenW (lpString=".rar") returned 4
	[0089.721] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.721] lstrlenW (lpString=".bz2") returned 4
	[0089.721] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.721] lstrlenW (lpString=".7z") returned 3
	[0089.722] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0089.722] lstrlenW (lpString=".dbf") returned 4
	[0089.722] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0089.722] lstrlenW (lpString=".1cd") returned 4
	[0089.722] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0089.722] lstrlenW (lpString=".jpg") returned 4
	[0089.722] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0089.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0089.722] lstrlenW (lpString=".doc") returned 4
	[0089.722] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.722] lstrlenW (lpString=".docx") returned 5
	[0089.722] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.722] lstrlenW (lpString=".pdf") returned 4
	[0089.722] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.722] lstrlenW (lpString=".xls") returned 4
	[0089.722] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.722] lstrlenW (lpString=".xlsx") returned 5
	[0089.722] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.722] lstrlenW (lpString=".ppt") returned 4
	[0089.722] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0089.723] lstrlenW (lpString=".zip") returned 4
	[0089.723] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.723] lstrlenW (lpString=".rar") returned 4
	[0089.723] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.723] lstrlenW (lpString=".bz2") returned 4
	[0089.723] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.723] lstrlenW (lpString=".7z") returned 3
	[0089.723] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0089.723] lstrlenW (lpString=".dbf") returned 4
	[0089.723] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0089.723] lstrlenW (lpString=".1cd") returned 4
	[0089.723] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0089.723] lstrlenW (lpString=".jpg") returned 4
	[0089.723] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.723] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0089.723] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0089.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0089.938] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=37440) returned 1
	[0089.938] CloseHandle (hObject=0x1ac) returned 1
	[0089.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20
	[0089.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0089.939] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.939] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.939] GetLastError () returned 0x0
	[0089.939] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x9240, lpOverlapped=0x0) returned 1
	[0089.959] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x9250, lpOverlapped=0x0) returned 1
	[0089.961] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.961] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.961] SetEndOfFile (hFile=0x160) returned 1
	[0089.961] CloseHandle (hObject=0x160) returned 1
	[0089.961] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.961] SetEndOfFile (hFile=0x1ac) returned 1
	[0089.963] CloseHandle (hObject=0x1ac) returned 1
	[0089.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.963] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1
	[0089.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0089.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0089.963] lstrlenW (lpString=".doc") returned 4
	[0089.963] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.964] lstrlenW (lpString=".docx") returned 5
	[0089.964] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.964] lstrlenW (lpString=".pdf") returned 4
	[0089.964] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.964] lstrlenW (lpString=".xls") returned 4
	[0089.964] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.964] lstrlenW (lpString=".xlsx") returned 5
	[0089.964] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.964] lstrlenW (lpString=".ppt") returned 4
	[0089.964] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0089.964] lstrlenW (lpString=".zip") returned 4
	[0089.964] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.964] lstrlenW (lpString=".rar") returned 4
	[0089.964] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.964] lstrlenW (lpString=".bz2") returned 4
	[0089.964] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.964] lstrlenW (lpString=".7z") returned 3
	[0089.964] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0089.964] lstrlenW (lpString=".dbf") returned 4
	[0089.964] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0089.964] lstrlenW (lpString=".1cd") returned 4
	[0089.964] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0089.964] lstrlenW (lpString=".jpg") returned 4
	[0089.964] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0089.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0089.964] lstrlenW (lpString=".doc") returned 4
	[0089.965] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0089.965] lstrlenW (lpString=".docx") returned 5
	[0089.965] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0089.965] lstrlenW (lpString=".pdf") returned 4
	[0089.965] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0089.965] lstrlenW (lpString=".xls") returned 4
	[0089.965] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0089.965] lstrlenW (lpString=".xlsx") returned 5
	[0089.965] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0089.965] lstrlenW (lpString=".ppt") returned 4
	[0089.965] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0089.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0089.965] lstrlenW (lpString=".zip") returned 4
	[0089.965] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0089.965] lstrlenW (lpString=".rar") returned 4
	[0089.965] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0089.965] lstrlenW (lpString=".bz2") returned 4
	[0089.965] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0089.965] lstrlenW (lpString=".7z") returned 3
	[0089.965] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0089.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0089.965] lstrlenW (lpString=".dbf") returned 4
	[0089.965] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0089.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0089.965] lstrlenW (lpString=".1cd") returned 4
	[0089.965] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0089.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0089.965] lstrlenW (lpString=".jpg") returned 4
	[0089.965] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0089.966] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0089.966] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0089.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.009] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=16738) returned 1
	[0090.009] CloseHandle (hObject=0x1ac) returned 1
	[0090.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20
	[0090.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.010] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.010] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.011] GetLastError () returned 0x0
	[0090.011] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x4162, lpOverlapped=0x0) returned 1
	[0090.023] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x4170, lpOverlapped=0x0) returned 1
	[0090.025] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.025] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.025] SetEndOfFile (hFile=0x160) returned 1
	[0090.025] CloseHandle (hObject=0x160) returned 1
	[0090.026] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.026] SetEndOfFile (hFile=0x1ac) returned 1
	[0090.027] CloseHandle (hObject=0x1ac) returned 1
	[0090.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.027] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1
	[0090.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0090.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0090.028] lstrlenW (lpString=".doc") returned 4
	[0090.028] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.028] lstrlenW (lpString=".docx") returned 5
	[0090.028] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.028] lstrlenW (lpString=".pdf") returned 4
	[0090.028] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.028] lstrlenW (lpString=".xls") returned 4
	[0090.028] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.028] lstrlenW (lpString=".xlsx") returned 5
	[0090.028] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.028] lstrlenW (lpString=".ppt") returned 4
	[0090.028] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0090.028] lstrlenW (lpString=".zip") returned 4
	[0090.028] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.028] lstrlenW (lpString=".rar") returned 4
	[0090.028] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.028] lstrlenW (lpString=".bz2") returned 4
	[0090.028] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.028] lstrlenW (lpString=".7z") returned 3
	[0090.028] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0090.029] lstrlenW (lpString=".dbf") returned 4
	[0090.029] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0090.029] lstrlenW (lpString=".1cd") returned 4
	[0090.029] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0090.029] lstrlenW (lpString=".jpg") returned 4
	[0090.029] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0090.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0090.029] lstrlenW (lpString=".doc") returned 4
	[0090.029] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.029] lstrlenW (lpString=".docx") returned 5
	[0090.029] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.029] lstrlenW (lpString=".pdf") returned 4
	[0090.029] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.029] lstrlenW (lpString=".xls") returned 4
	[0090.029] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.029] lstrlenW (lpString=".xlsx") returned 5
	[0090.029] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.029] lstrlenW (lpString=".ppt") returned 4
	[0090.029] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0090.029] lstrlenW (lpString=".zip") returned 4
	[0090.029] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.030] lstrlenW (lpString=".rar") returned 4
	[0090.030] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.030] lstrlenW (lpString=".bz2") returned 4
	[0090.030] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.030] lstrlenW (lpString=".7z") returned 3
	[0090.030] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0090.030] lstrlenW (lpString=".dbf") returned 4
	[0090.030] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0090.030] lstrlenW (lpString=".1cd") returned 4
	[0090.030] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0090.030] lstrlenW (lpString=".jpg") returned 4
	[0090.030] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.030] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.030] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.067] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=19563) returned 1
	[0090.067] CloseHandle (hObject=0x160) returned 1
	[0090.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20
	[0090.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0090.152] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.152] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0090.194] GetLastError () returned 0x0
	[0090.194] ReadFile (in: hFile=0x1a8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x4c6b, lpOverlapped=0x0) returned 1
	[0090.209] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x4c70, lpOverlapped=0x0) returned 1
	[0090.210] ReadFile (in: hFile=0x1a8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.210] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.211] SetEndOfFile (hFile=0x1b4) returned 1
	[0090.211] CloseHandle (hObject=0x1b4) returned 1
	[0090.211] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.211] SetEndOfFile (hFile=0x1a8) returned 1
	[0090.212] CloseHandle (hObject=0x1a8) returned 1
	[0090.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.212] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1
	[0090.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0090.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0090.212] lstrlenW (lpString=".doc") returned 4
	[0090.212] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.212] lstrlenW (lpString=".docx") returned 5
	[0090.212] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.212] lstrlenW (lpString=".pdf") returned 4
	[0090.212] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.213] lstrlenW (lpString=".xls") returned 4
	[0090.213] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.213] lstrlenW (lpString=".xlsx") returned 5
	[0090.213] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.213] lstrlenW (lpString=".ppt") returned 4
	[0090.213] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0090.213] lstrlenW (lpString=".zip") returned 4
	[0090.213] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.213] lstrlenW (lpString=".rar") returned 4
	[0090.213] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.213] lstrlenW (lpString=".bz2") returned 4
	[0090.213] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.213] lstrlenW (lpString=".7z") returned 3
	[0090.213] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0090.213] lstrlenW (lpString=".dbf") returned 4
	[0090.213] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0090.213] lstrlenW (lpString=".1cd") returned 4
	[0090.213] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0090.213] lstrlenW (lpString=".jpg") returned 4
	[0090.213] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0090.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0090.213] lstrlenW (lpString=".doc") returned 4
	[0090.213] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.213] lstrlenW (lpString=".docx") returned 5
	[0090.213] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.213] lstrlenW (lpString=".pdf") returned 4
	[0090.213] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.214] lstrlenW (lpString=".xls") returned 4
	[0090.214] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.214] lstrlenW (lpString=".xlsx") returned 5
	[0090.214] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.214] lstrlenW (lpString=".ppt") returned 4
	[0090.214] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0090.214] lstrlenW (lpString=".zip") returned 4
	[0090.214] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.214] lstrlenW (lpString=".rar") returned 4
	[0090.214] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.214] lstrlenW (lpString=".bz2") returned 4
	[0090.214] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.214] lstrlenW (lpString=".7z") returned 3
	[0090.214] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0090.214] lstrlenW (lpString=".dbf") returned 4
	[0090.214] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0090.214] lstrlenW (lpString=".1cd") returned 4
	[0090.214] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0090.214] lstrlenW (lpString=".jpg") returned 4
	[0090.214] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.214] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.214] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0090.215] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=34163) returned 1
	[0090.215] CloseHandle (hObject=0x1a8) returned 1
	[0090.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20
	[0090.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0090.216] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.216] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0090.216] GetLastError () returned 0x0
	[0090.216] ReadFile (in: hFile=0x1a8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x8573, lpOverlapped=0x0) returned 1
	[0090.228] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x8580, lpOverlapped=0x0) returned 1
	[0090.229] ReadFile (in: hFile=0x1a8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.229] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.229] SetEndOfFile (hFile=0x1b4) returned 1
	[0090.230] CloseHandle (hObject=0x1b4) returned 1
	[0090.230] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.230] SetEndOfFile (hFile=0x1a8) returned 1
	[0090.231] CloseHandle (hObject=0x1a8) returned 1
	[0090.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.231] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1
	[0090.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0090.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0090.231] lstrlenW (lpString=".doc") returned 4
	[0090.231] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.231] lstrlenW (lpString=".docx") returned 5
	[0090.231] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.231] lstrlenW (lpString=".pdf") returned 4
	[0090.232] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.232] lstrlenW (lpString=".xls") returned 4
	[0090.232] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.232] lstrlenW (lpString=".xlsx") returned 5
	[0090.232] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.232] lstrlenW (lpString=".ppt") returned 4
	[0090.232] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0090.232] lstrlenW (lpString=".zip") returned 4
	[0090.232] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.232] lstrlenW (lpString=".rar") returned 4
	[0090.232] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.232] lstrlenW (lpString=".bz2") returned 4
	[0090.232] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.232] lstrlenW (lpString=".7z") returned 3
	[0090.232] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0090.232] lstrlenW (lpString=".dbf") returned 4
	[0090.232] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0090.232] lstrlenW (lpString=".1cd") returned 4
	[0090.232] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0090.232] lstrlenW (lpString=".jpg") returned 4
	[0090.232] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0090.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0090.232] lstrlenW (lpString=".doc") returned 4
	[0090.232] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.232] lstrlenW (lpString=".docx") returned 5
	[0090.232] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.232] lstrlenW (lpString=".pdf") returned 4
	[0090.232] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.232] lstrlenW (lpString=".xls") returned 4
	[0090.233] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.233] lstrlenW (lpString=".xlsx") returned 5
	[0090.233] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.233] lstrlenW (lpString=".ppt") returned 4
	[0090.233] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0090.233] lstrlenW (lpString=".zip") returned 4
	[0090.233] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.233] lstrlenW (lpString=".rar") returned 4
	[0090.233] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.233] lstrlenW (lpString=".bz2") returned 4
	[0090.233] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.233] lstrlenW (lpString=".7z") returned 3
	[0090.233] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0090.233] lstrlenW (lpString=".dbf") returned 4
	[0090.233] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0090.233] lstrlenW (lpString=".1cd") returned 4
	[0090.233] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0090.233] lstrlenW (lpString=".jpg") returned 4
	[0090.233] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.233] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.233] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0090.261] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=29305) returned 1
	[0090.261] CloseHandle (hObject=0x194) returned 1
	[0090.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20
	[0090.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0090.261] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.261] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.262] GetLastError () returned 0x0
	[0090.262] ReadFile (in: hFile=0x194, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x7279, lpOverlapped=0x0) returned 1
	[0090.274] WriteFile (in: hFile=0x188, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x7280, lpOverlapped=0x0) returned 1
	[0090.275] ReadFile (in: hFile=0x194, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.275] WriteFile (in: hFile=0x188, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.276] SetEndOfFile (hFile=0x188) returned 1
	[0090.276] CloseHandle (hObject=0x188) returned 1
	[0090.276] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.276] SetEndOfFile (hFile=0x194) returned 1
	[0090.277] CloseHandle (hObject=0x194) returned 1
	[0090.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.277] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1
	[0090.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0090.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0090.277] lstrlenW (lpString=".doc") returned 4
	[0090.277] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.278] lstrlenW (lpString=".docx") returned 5
	[0090.278] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.278] lstrlenW (lpString=".pdf") returned 4
	[0090.278] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.278] lstrlenW (lpString=".xls") returned 4
	[0090.278] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.278] lstrlenW (lpString=".xlsx") returned 5
	[0090.278] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.278] lstrlenW (lpString=".ppt") returned 4
	[0090.278] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0090.278] lstrlenW (lpString=".zip") returned 4
	[0090.278] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.278] lstrlenW (lpString=".rar") returned 4
	[0090.278] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.278] lstrlenW (lpString=".bz2") returned 4
	[0090.278] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.278] lstrlenW (lpString=".7z") returned 3
	[0090.278] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0090.278] lstrlenW (lpString=".dbf") returned 4
	[0090.278] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0090.278] lstrlenW (lpString=".1cd") returned 4
	[0090.278] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0090.278] lstrlenW (lpString=".jpg") returned 4
	[0090.278] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0090.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0090.278] lstrlenW (lpString=".doc") returned 4
	[0090.278] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.279] lstrlenW (lpString=".docx") returned 5
	[0090.279] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.279] lstrlenW (lpString=".pdf") returned 4
	[0090.279] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.279] lstrlenW (lpString=".xls") returned 4
	[0090.279] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.279] lstrlenW (lpString=".xlsx") returned 5
	[0090.279] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.279] lstrlenW (lpString=".ppt") returned 4
	[0090.279] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0090.279] lstrlenW (lpString=".zip") returned 4
	[0090.279] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.279] lstrlenW (lpString=".rar") returned 4
	[0090.279] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.279] lstrlenW (lpString=".bz2") returned 4
	[0090.279] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.279] lstrlenW (lpString=".7z") returned 3
	[0090.279] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0090.279] lstrlenW (lpString=".dbf") returned 4
	[0090.279] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0090.279] lstrlenW (lpString=".1cd") returned 4
	[0090.279] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0090.279] lstrlenW (lpString=".jpg") returned 4
	[0090.279] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.280] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.280] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.301] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=21812) returned 1
	[0090.301] CloseHandle (hObject=0x188) returned 1
	[0090.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20
	[0090.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.301] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.302] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0090.302] GetLastError () returned 0x0
	[0090.302] ReadFile (in: hFile=0x188, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x5534, lpOverlapped=0x0) returned 1
	[0090.312] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x5540, lpOverlapped=0x0) returned 1
	[0090.314] ReadFile (in: hFile=0x188, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.314] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.314] SetEndOfFile (hFile=0x1b0) returned 1
	[0090.314] CloseHandle (hObject=0x1b0) returned 1
	[0090.314] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.314] SetEndOfFile (hFile=0x188) returned 1
	[0090.315] CloseHandle (hObject=0x188) returned 1
	[0090.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.316] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1
	[0090.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0090.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0090.316] lstrlenW (lpString=".doc") returned 4
	[0090.316] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.316] lstrlenW (lpString=".docx") returned 5
	[0090.316] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.316] lstrlenW (lpString=".pdf") returned 4
	[0090.316] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.316] lstrlenW (lpString=".xls") returned 4
	[0090.316] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.316] lstrlenW (lpString=".xlsx") returned 5
	[0090.316] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.316] lstrlenW (lpString=".ppt") returned 4
	[0090.316] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0090.316] lstrlenW (lpString=".zip") returned 4
	[0090.316] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.316] lstrlenW (lpString=".rar") returned 4
	[0090.316] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.316] lstrlenW (lpString=".bz2") returned 4
	[0090.316] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.317] lstrlenW (lpString=".7z") returned 3
	[0090.317] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0090.317] lstrlenW (lpString=".dbf") returned 4
	[0090.317] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0090.317] lstrlenW (lpString=".1cd") returned 4
	[0090.317] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0090.317] lstrlenW (lpString=".jpg") returned 4
	[0090.317] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0090.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0090.317] lstrlenW (lpString=".doc") returned 4
	[0090.317] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.317] lstrlenW (lpString=".docx") returned 5
	[0090.317] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.317] lstrlenW (lpString=".pdf") returned 4
	[0090.317] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.317] lstrlenW (lpString=".xls") returned 4
	[0090.317] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.317] lstrlenW (lpString=".xlsx") returned 5
	[0090.317] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.317] lstrlenW (lpString=".ppt") returned 4
	[0090.317] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0090.317] lstrlenW (lpString=".zip") returned 4
	[0090.317] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.317] lstrlenW (lpString=".rar") returned 4
	[0090.317] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.317] lstrlenW (lpString=".bz2") returned 4
	[0090.317] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.318] lstrlenW (lpString=".7z") returned 3
	[0090.318] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0090.318] lstrlenW (lpString=".dbf") returned 4
	[0090.318] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0090.318] lstrlenW (lpString=".1cd") returned 4
	[0090.318] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0090.318] lstrlenW (lpString=".jpg") returned 4
	[0090.318] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.318] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.318] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0090.356] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=19525) returned 1
	[0090.356] CloseHandle (hObject=0x1a8) returned 1
	[0090.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20
	[0090.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0090.357] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.357] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.358] GetLastError () returned 0x0
	[0090.358] ReadFile (in: hFile=0x1a8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x4c45, lpOverlapped=0x0) returned 1
	[0090.371] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x4c50, lpOverlapped=0x0) returned 1
	[0090.373] ReadFile (in: hFile=0x1a8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.373] WriteFile (in: hFile=0x160, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.373] SetEndOfFile (hFile=0x160) returned 1
	[0090.373] CloseHandle (hObject=0x160) returned 1
	[0090.373] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.373] SetEndOfFile (hFile=0x1a8) returned 1
	[0090.374] CloseHandle (hObject=0x1a8) returned 1
	[0090.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.375] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1
	[0090.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0090.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0090.375] lstrlenW (lpString=".doc") returned 4
	[0090.375] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.375] lstrlenW (lpString=".docx") returned 5
	[0090.375] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.375] lstrlenW (lpString=".pdf") returned 4
	[0090.375] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.375] lstrlenW (lpString=".xls") returned 4
	[0090.375] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.375] lstrlenW (lpString=".xlsx") returned 5
	[0090.375] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.376] lstrlenW (lpString=".ppt") returned 4
	[0090.376] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0090.376] lstrlenW (lpString=".zip") returned 4
	[0090.376] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.376] lstrlenW (lpString=".rar") returned 4
	[0090.376] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.376] lstrlenW (lpString=".bz2") returned 4
	[0090.376] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.376] lstrlenW (lpString=".7z") returned 3
	[0090.376] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0090.376] lstrlenW (lpString=".dbf") returned 4
	[0090.376] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0090.376] lstrlenW (lpString=".1cd") returned 4
	[0090.376] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0090.376] lstrlenW (lpString=".jpg") returned 4
	[0090.376] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0090.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0090.376] lstrlenW (lpString=".doc") returned 4
	[0090.376] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.376] lstrlenW (lpString=".docx") returned 5
	[0090.377] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.377] lstrlenW (lpString=".pdf") returned 4
	[0090.377] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.377] lstrlenW (lpString=".xls") returned 4
	[0090.377] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.377] lstrlenW (lpString=".xlsx") returned 5
	[0090.377] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.377] lstrlenW (lpString=".ppt") returned 4
	[0090.377] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0090.377] lstrlenW (lpString=".zip") returned 4
	[0090.377] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.377] lstrlenW (lpString=".rar") returned 4
	[0090.377] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.377] lstrlenW (lpString=".bz2") returned 4
	[0090.377] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.377] lstrlenW (lpString=".7z") returned 3
	[0090.377] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0090.377] lstrlenW (lpString=".dbf") returned 4
	[0090.377] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0090.377] lstrlenW (lpString=".1cd") returned 4
	[0090.377] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0090.377] lstrlenW (lpString=".jpg") returned 4
	[0090.377] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.378] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.378] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0090.435] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=33479) returned 1
	[0090.435] CloseHandle (hObject=0x19c) returned 1
	[0090.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20
	[0090.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0090.436] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.436] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0090.437] GetLastError () returned 0x0
	[0090.437] ReadFile (in: hFile=0x19c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x82c7, lpOverlapped=0x0) returned 1
	[0090.449] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x82d0, lpOverlapped=0x0) returned 1
	[0090.451] ReadFile (in: hFile=0x19c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.451] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.451] SetEndOfFile (hFile=0x1b0) returned 1
	[0090.452] CloseHandle (hObject=0x1b0) returned 1
	[0090.452] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.452] SetEndOfFile (hFile=0x19c) returned 1
	[0090.453] CloseHandle (hObject=0x19c) returned 1
	[0090.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.453] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1
	[0090.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0090.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0090.454] lstrlenW (lpString=".doc") returned 4
	[0090.454] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.454] lstrlenW (lpString=".docx") returned 5
	[0090.454] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.454] lstrlenW (lpString=".pdf") returned 4
	[0090.454] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.454] lstrlenW (lpString=".xls") returned 4
	[0090.454] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.454] lstrlenW (lpString=".xlsx") returned 5
	[0090.454] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.454] lstrlenW (lpString=".ppt") returned 4
	[0090.454] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0090.454] lstrlenW (lpString=".zip") returned 4
	[0090.454] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.454] lstrlenW (lpString=".rar") returned 4
	[0090.454] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.455] lstrlenW (lpString=".bz2") returned 4
	[0090.455] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.455] lstrlenW (lpString=".7z") returned 3
	[0090.455] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0090.455] lstrlenW (lpString=".dbf") returned 4
	[0090.455] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0090.455] lstrlenW (lpString=".1cd") returned 4
	[0090.455] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0090.455] lstrlenW (lpString=".jpg") returned 4
	[0090.455] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0090.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0090.455] lstrlenW (lpString=".doc") returned 4
	[0090.455] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.455] lstrlenW (lpString=".docx") returned 5
	[0090.455] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0090.455] lstrlenW (lpString=".pdf") returned 4
	[0090.455] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.455] lstrlenW (lpString=".xls") returned 4
	[0090.455] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.455] lstrlenW (lpString=".xlsx") returned 5
	[0090.455] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0090.456] lstrlenW (lpString=".ppt") returned 4
	[0090.456] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0090.456] lstrlenW (lpString=".zip") returned 4
	[0090.456] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.456] lstrlenW (lpString=".rar") returned 4
	[0090.456] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.456] lstrlenW (lpString=".bz2") returned 4
	[0090.456] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.456] lstrlenW (lpString=".7z") returned 3
	[0090.456] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0090.456] lstrlenW (lpString=".dbf") returned 4
	[0090.456] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0090.456] lstrlenW (lpString=".1cd") returned 4
	[0090.456] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0090.456] lstrlenW (lpString=".jpg") returned 4
	[0090.456] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.456] lstrcmpiW (lpString1=".PNG", lpString2=".adobe") returned 1
	[0090.456] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0090.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 61
	os_tid = 0xba4

	[0073.182] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x37c06b0
	[0073.183] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x37d06b8
	[0073.184] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630a40
	[0073.185] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x6c06a0
	[0073.185] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630a58
	[0073.185] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3c90020
	[0073.185] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630a70
	[0073.185] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630a70, Size=0x20) returned 0x6162b0
	[0073.185] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630a70
	[0073.185] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630a70, Size=0x20) returned 0x6162d8
	[0073.185] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0073.185] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0073.186] Wow64DisableWow64FsRedirection (in: OldValue=0x32dff58 | out: OldValue=0x32dff58*=0x0) returned 1
	[0073.186] lstrlenW (lpString="kernel32.dll") returned 12
	[0073.186] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162b0 | out: hHeap=0x5e0000) returned 1
	[0073.186] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0073.186] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6162d8 | out: hHeap=0x5e0000) returned 1
	[0073.186] Sleep (dwMilliseconds=0x64) 
	[0073.725] Sleep (dwMilliseconds=0x64) 
	[0074.275] lstrcmpiW (lpString1=".ttf", lpString2=".adobe") returned 1
	[0074.275] lstrlenW (lpString="wgl4_boot.ttf") returned 13
	[0074.275] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0074.685] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=47452) returned 1
	[0074.685] CloseHandle (hObject=0x160) returned 1
	[0074.685] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20
	[0074.685] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0074.685] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.685] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0074.685] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0074.685] lstrlenW (lpString=".doc") returned 4
	[0074.685] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0074.685] lstrlenW (lpString=".docx") returned 5
	[0074.685] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0074.685] lstrlenW (lpString=".pdf") returned 4
	[0074.685] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0074.685] lstrlenW (lpString=".xls") returned 4
	[0074.685] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0074.685] lstrlenW (lpString=".xlsx") returned 5
	[0074.686] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0074.686] lstrlenW (lpString=".ppt") returned 4
	[0074.686] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0074.686] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0074.686] lstrlenW (lpString=".zip") returned 4
	[0074.686] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0074.686] lstrlenW (lpString=".rar") returned 4
	[0074.686] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0074.686] lstrlenW (lpString=".bz2") returned 4
	[0074.686] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0074.686] lstrlenW (lpString=".7z") returned 3
	[0074.686] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0074.686] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0074.686] lstrlenW (lpString=".dbf") returned 4
	[0074.686] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0074.686] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0074.686] lstrlenW (lpString=".1cd") returned 4
	[0074.686] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0074.686] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0074.686] lstrlenW (lpString=".jpg") returned 4
	[0074.686] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0074.686] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0074.686] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0074.686] lstrlenW (lpString=".doc") returned 4
	[0074.686] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0074.686] lstrlenW (lpString=".docx") returned 5
	[0074.687] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0074.687] lstrlenW (lpString=".pdf") returned 4
	[0074.687] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0074.687] lstrlenW (lpString=".xls") returned 4
	[0074.687] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0074.687] lstrlenW (lpString=".xlsx") returned 5
	[0074.687] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0074.687] lstrlenW (lpString=".ppt") returned 4
	[0074.687] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0074.687] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0074.687] lstrlenW (lpString=".zip") returned 4
	[0074.687] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0074.687] lstrlenW (lpString=".rar") returned 4
	[0074.687] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0074.687] lstrlenW (lpString=".bz2") returned 4
	[0074.687] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0074.687] lstrlenW (lpString=".7z") returned 3
	[0074.687] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0074.687] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0074.687] lstrlenW (lpString=".dbf") returned 4
	[0074.687] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0074.687] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0074.687] lstrlenW (lpString=".1cd") returned 4
	[0074.687] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0074.687] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0074.687] lstrlenW (lpString=".jpg") returned 4
	[0074.687] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0074.688] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0074.688] lstrlenW (lpString="ExcelMUI.msi") returned 12
	[0074.688] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0075.722] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2506240) returned 1
	[0075.722] CloseHandle (hObject=0x174) returned 1
	[0075.722] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020
	[0075.722] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0075.728] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0075.840] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0075.880] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0075.880] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0075.880] ReadFile (in: hFile=0x184, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0075.887] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0075.887] ReadFile (in: hFile=0x184, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0075.926] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0075.926] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0075.926] ReadFile (in: hFile=0x184, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0075.946] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0075.946] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0075.992] SetEndOfFile (hFile=0x184) returned 1
	[0075.992] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f20068
	[0075.996] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0075.996] WriteFile (in: hFile=0x184, lpBuffer=0x3f20068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f20068*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0075.998] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0075.998] WriteFile (in: hFile=0x184, lpBuffer=0x3f20068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f20068*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0076.004] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0076.004] WriteFile (in: hFile=0x184, lpBuffer=0x3f20068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f20068*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0076.007] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0076.007] CloseHandle (hObject=0x184) returned 1
	[0076.148] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0076.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0076.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0076.148] lstrlenW (lpString=".doc") returned 4
	[0076.148] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0076.148] lstrlenW (lpString=".docx") returned 5
	[0076.148] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0076.148] lstrlenW (lpString=".pdf") returned 4
	[0076.148] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0076.148] lstrlenW (lpString=".xls") returned 4
	[0076.149] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0076.149] lstrlenW (lpString=".xlsx") returned 5
	[0076.149] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0076.149] lstrlenW (lpString=".ppt") returned 4
	[0076.149] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0076.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0076.149] lstrlenW (lpString=".zip") returned 4
	[0076.149] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0076.149] lstrlenW (lpString=".rar") returned 4
	[0076.149] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0076.149] lstrlenW (lpString=".bz2") returned 4
	[0076.149] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0076.149] lstrlenW (lpString=".7z") returned 3
	[0076.149] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0076.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0076.149] lstrlenW (lpString=".dbf") returned 4
	[0076.149] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0076.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0076.149] lstrlenW (lpString=".1cd") returned 4
	[0076.149] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0076.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0076.149] lstrlenW (lpString=".jpg") returned 4
	[0076.149] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0076.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0076.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0076.149] lstrlenW (lpString=".doc") returned 4
	[0076.150] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0076.150] lstrlenW (lpString=".docx") returned 5
	[0076.150] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0076.150] lstrlenW (lpString=".pdf") returned 4
	[0076.150] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0076.150] lstrlenW (lpString=".xls") returned 4
	[0076.150] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0076.150] lstrlenW (lpString=".xlsx") returned 5
	[0076.150] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0076.150] lstrlenW (lpString=".ppt") returned 4
	[0076.150] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0076.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0076.150] lstrlenW (lpString=".zip") returned 4
	[0076.150] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0076.150] lstrlenW (lpString=".rar") returned 4
	[0076.150] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0076.150] lstrlenW (lpString=".bz2") returned 4
	[0076.150] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0076.150] lstrlenW (lpString=".7z") returned 3
	[0076.150] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0076.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0076.150] lstrlenW (lpString=".dbf") returned 4
	[0076.150] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0076.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0076.150] lstrlenW (lpString=".1cd") returned 4
	[0076.150] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0076.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0076.151] lstrlenW (lpString=".jpg") returned 4
	[0076.151] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0076.151] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0076.151] lstrlenW (lpString="OutlkLR.cab") returned 11
	[0076.151] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0076.151] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=14819276) returned 1
	[0076.151] CloseHandle (hObject=0x184) returned 1
	[0076.151] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020
	[0076.152] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0076.152] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0076.152] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0076.153] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0076.153] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0076.153] ReadFile (in: hFile=0x184, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0076.174] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0076.174] ReadFile (in: hFile=0x184, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0076.178] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0076.178] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0076.178] ReadFile (in: hFile=0x184, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0076.272] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0076.272] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0076.286] SetEndOfFile (hFile=0x184) returned 1
	[0076.287] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0076.372] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0076.372] WriteFile (in: hFile=0x184, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0076.373] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0076.373] WriteFile (in: hFile=0x184, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0076.374] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0076.374] WriteFile (in: hFile=0x184, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0076.376] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0076.378] CloseHandle (hObject=0x184) returned 1
	[0078.187] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0078.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0078.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0078.188] lstrlenW (lpString=".doc") returned 4
	[0078.188] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0078.188] lstrlenW (lpString=".docx") returned 5
	[0078.188] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0078.188] lstrlenW (lpString=".pdf") returned 4
	[0078.188] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0078.188] lstrlenW (lpString=".xls") returned 4
	[0078.188] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0078.188] lstrlenW (lpString=".xlsx") returned 5
	[0078.188] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0078.188] lstrlenW (lpString=".ppt") returned 4
	[0078.188] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0078.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0078.188] lstrlenW (lpString=".zip") returned 4
	[0078.188] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0078.188] lstrlenW (lpString=".rar") returned 4
	[0078.188] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0078.188] lstrlenW (lpString=".bz2") returned 4
	[0078.188] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0078.188] lstrlenW (lpString=".7z") returned 3
	[0078.188] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0078.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0078.188] lstrlenW (lpString=".dbf") returned 4
	[0078.188] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0078.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0078.189] lstrlenW (lpString=".1cd") returned 4
	[0078.189] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0078.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0078.189] lstrlenW (lpString=".jpg") returned 4
	[0078.189] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0078.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0078.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0078.189] lstrlenW (lpString=".doc") returned 4
	[0078.189] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0078.189] lstrlenW (lpString=".docx") returned 5
	[0078.189] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0078.189] lstrlenW (lpString=".pdf") returned 4
	[0078.189] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0078.189] lstrlenW (lpString=".xls") returned 4
	[0078.189] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0078.189] lstrlenW (lpString=".xlsx") returned 5
	[0078.189] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0078.189] lstrlenW (lpString=".ppt") returned 4
	[0078.189] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0078.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0078.189] lstrlenW (lpString=".zip") returned 4
	[0078.189] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0078.189] lstrlenW (lpString=".rar") returned 4
	[0078.189] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0078.189] lstrlenW (lpString=".bz2") returned 4
	[0078.189] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0078.190] lstrlenW (lpString=".7z") returned 3
	[0078.190] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0078.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0078.190] lstrlenW (lpString=".dbf") returned 4
	[0078.190] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0078.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0078.190] lstrlenW (lpString=".1cd") returned 4
	[0078.190] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0078.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0078.190] lstrlenW (lpString=".jpg") returned 4
	[0078.190] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0078.190] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0078.190] lstrlenW (lpString="Proof.msi") returned 9
	[0078.190] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0078.695] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=875520) returned 1
	[0078.695] CloseHandle (hObject=0x198) returned 1
	[0078.695] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020
	[0078.706] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0078.706] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0078.706] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.706] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.706] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0078.707] GetLastError () returned 0x0
	[0078.707] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xd5c00, lpOverlapped=0x0) returned 1
	[0078.737] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xd5c10, lpOverlapped=0x0) returned 1
	[0078.770] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0078.770] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0078.770] SetEndOfFile (hFile=0x1a8) returned 1
	[0078.771] CloseHandle (hObject=0x1a8) returned 1
	[0078.783] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.783] SetEndOfFile (hFile=0x1a4) returned 1
	[0078.791] CloseHandle (hObject=0x1a4) returned 1
	[0078.791] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0078.792] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1
	[0078.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0078.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0078.792] lstrlenW (lpString=".doc") returned 4
	[0078.792] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0078.792] lstrlenW (lpString=".docx") returned 5
	[0078.792] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0078.792] lstrlenW (lpString=".pdf") returned 4
	[0078.792] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0078.792] lstrlenW (lpString=".xls") returned 4
	[0078.792] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0078.792] lstrlenW (lpString=".xlsx") returned 5
	[0078.792] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0078.792] lstrlenW (lpString=".ppt") returned 4
	[0078.792] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0078.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0078.792] lstrlenW (lpString=".zip") returned 4
	[0078.792] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0078.792] lstrlenW (lpString=".rar") returned 4
	[0078.792] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0078.793] lstrlenW (lpString=".bz2") returned 4
	[0078.793] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0078.793] lstrlenW (lpString=".7z") returned 3
	[0078.793] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0078.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0078.793] lstrlenW (lpString=".dbf") returned 4
	[0078.793] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0078.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0078.793] lstrlenW (lpString=".1cd") returned 4
	[0078.793] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0078.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0078.793] lstrlenW (lpString=".jpg") returned 4
	[0078.793] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0078.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0078.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0078.793] lstrlenW (lpString=".doc") returned 4
	[0078.793] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0078.793] lstrlenW (lpString=".docx") returned 5
	[0078.793] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0078.793] lstrlenW (lpString=".pdf") returned 4
	[0078.793] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0078.793] lstrlenW (lpString=".xls") returned 4
	[0078.793] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0078.793] lstrlenW (lpString=".xlsx") returned 5
	[0078.793] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0078.793] lstrlenW (lpString=".ppt") returned 4
	[0078.793] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0078.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0078.793] lstrlenW (lpString=".zip") returned 4
	[0078.793] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0078.794] lstrlenW (lpString=".rar") returned 4
	[0078.794] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0078.794] lstrlenW (lpString=".bz2") returned 4
	[0078.794] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0078.794] lstrlenW (lpString=".7z") returned 3
	[0078.794] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0078.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0078.794] lstrlenW (lpString=".dbf") returned 4
	[0078.794] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0078.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0078.794] lstrlenW (lpString=".1cd") returned 4
	[0078.794] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0078.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0078.794] lstrlenW (lpString=".jpg") returned 4
	[0078.794] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0078.794] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0078.794] lstrlenW (lpString="Proof.cab") returned 9
	[0078.794] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0078.795] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=21064532) returned 1
	[0078.795] CloseHandle (hObject=0x1a4) returned 1
	[0078.795] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020
	[0078.795] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0078.795] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0078.841] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0078.841] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0078.841] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0078.841] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0078.844] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0078.844] ReadFile (in: hFile=0x1a4, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0078.890] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0078.890] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0078.890] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0078.959] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.959] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0078.977] SetEndOfFile (hFile=0x1a4) returned 1
	[0078.977] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f40078
	[0078.982] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.982] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.983] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.983] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.984] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.984] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.985] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f40078 | out: hHeap=0x5e0000) returned 1
	[0078.985] CloseHandle (hObject=0x1a4) returned 1
	[0079.977] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0079.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0079.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0079.977] lstrlenW (lpString=".doc") returned 4
	[0079.977] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0079.977] lstrlenW (lpString=".docx") returned 5
	[0079.978] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0079.978] lstrlenW (lpString=".pdf") returned 4
	[0079.978] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0079.978] lstrlenW (lpString=".xls") returned 4
	[0079.978] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0079.978] lstrlenW (lpString=".xlsx") returned 5
	[0079.978] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0079.978] lstrlenW (lpString=".ppt") returned 4
	[0079.978] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0079.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0079.978] lstrlenW (lpString=".zip") returned 4
	[0079.978] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0079.978] lstrlenW (lpString=".rar") returned 4
	[0079.978] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0079.978] lstrlenW (lpString=".bz2") returned 4
	[0079.978] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0079.978] lstrlenW (lpString=".7z") returned 3
	[0079.978] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0079.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0079.978] lstrlenW (lpString=".dbf") returned 4
	[0079.978] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0079.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0079.978] lstrlenW (lpString=".1cd") returned 4
	[0079.978] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0079.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0079.978] lstrlenW (lpString=".jpg") returned 4
	[0079.979] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0079.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0079.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0079.979] lstrlenW (lpString=".doc") returned 4
	[0079.979] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0079.979] lstrlenW (lpString=".docx") returned 5
	[0079.979] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0079.979] lstrlenW (lpString=".pdf") returned 4
	[0079.980] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0079.980] lstrlenW (lpString=".xls") returned 4
	[0079.980] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0079.981] lstrlenW (lpString=".xlsx") returned 5
	[0079.981] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0079.981] lstrlenW (lpString=".ppt") returned 4
	[0079.981] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0079.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0079.981] lstrlenW (lpString=".zip") returned 4
	[0079.981] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0079.981] lstrlenW (lpString=".rar") returned 4
	[0079.981] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0079.981] lstrlenW (lpString=".bz2") returned 4
	[0079.981] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0079.981] lstrlenW (lpString=".7z") returned 3
	[0079.981] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0079.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0079.981] lstrlenW (lpString=".dbf") returned 4
	[0079.981] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0079.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0079.981] lstrlenW (lpString=".1cd") returned 4
	[0079.981] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0079.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0079.981] lstrlenW (lpString=".jpg") returned 4
	[0079.981] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0079.982] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0079.982] lstrlenW (lpString="InfLR.cab") returned 9
	[0079.982] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0079.982] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=18874884) returned 1
	[0079.982] CloseHandle (hObject=0x1a4) returned 1
	[0079.982] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020
	[0079.983] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0079.983] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0079.984] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0079.984] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0079.984] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0079.984] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0079.988] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0079.988] ReadFile (in: hFile=0x1a4, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.004] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0080.004] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.004] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.027] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.027] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0080.043] SetEndOfFile (hFile=0x1a4) returned 1
	[0080.043] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f40078
	[0080.047] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.047] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.051] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.051] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.054] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.055] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.059] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f40078 | out: hHeap=0x5e0000) returned 1
	[0080.059] CloseHandle (hObject=0x1a4) returned 1
	[0080.734] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0080.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0080.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0080.734] lstrlenW (lpString=".doc") returned 4
	[0080.734] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0080.734] lstrlenW (lpString=".docx") returned 5
	[0080.734] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0080.734] lstrlenW (lpString=".pdf") returned 4
	[0080.734] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0080.734] lstrlenW (lpString=".xls") returned 4
	[0080.735] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0080.735] lstrlenW (lpString=".xlsx") returned 5
	[0080.735] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0080.735] lstrlenW (lpString=".ppt") returned 4
	[0080.735] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0080.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0080.735] lstrlenW (lpString=".zip") returned 4
	[0080.735] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0080.735] lstrlenW (lpString=".rar") returned 4
	[0080.735] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0080.735] lstrlenW (lpString=".bz2") returned 4
	[0080.735] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0080.735] lstrlenW (lpString=".7z") returned 3
	[0080.735] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0080.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0080.735] lstrlenW (lpString=".dbf") returned 4
	[0080.735] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0080.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0080.735] lstrlenW (lpString=".1cd") returned 4
	[0080.735] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0080.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0080.735] lstrlenW (lpString=".jpg") returned 4
	[0080.735] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0080.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0080.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0080.735] lstrlenW (lpString=".doc") returned 4
	[0080.735] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0080.735] lstrlenW (lpString=".docx") returned 5
	[0080.735] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0080.735] lstrlenW (lpString=".pdf") returned 4
	[0080.736] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0080.736] lstrlenW (lpString=".xls") returned 4
	[0080.736] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0080.736] lstrlenW (lpString=".xlsx") returned 5
	[0080.736] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0080.736] lstrlenW (lpString=".ppt") returned 4
	[0080.736] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0080.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0080.736] lstrlenW (lpString=".zip") returned 4
	[0080.736] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0080.736] lstrlenW (lpString=".rar") returned 4
	[0080.736] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0080.736] lstrlenW (lpString=".bz2") returned 4
	[0080.736] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0080.736] lstrlenW (lpString=".7z") returned 3
	[0080.736] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0080.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0080.736] lstrlenW (lpString=".dbf") returned 4
	[0080.736] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0080.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0080.736] lstrlenW (lpString=".1cd") returned 4
	[0080.736] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0080.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0080.736] lstrlenW (lpString=".jpg") returned 4
	[0080.736] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0080.736] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0080.736] lstrlenW (lpString="VisioMUI.msi") returned 12
	[0080.737] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0080.737] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2797568) returned 1
	[0080.737] CloseHandle (hObject=0x1a4) returned 1
	[0080.737] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020
	[0080.737] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0080.737] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0080.738] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0080.738] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0080.738] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.738] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.741] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.741] ReadFile (in: hFile=0x1a4, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.823] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0080.823] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.823] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.843] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.843] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0080.911] SetEndOfFile (hFile=0x1a4) returned 1
	[0080.911] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f40078
	[0080.911] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.911] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.912] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.912] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.918] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.918] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f40078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f40078*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.920] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f40078 | out: hHeap=0x5e0000) returned 1
	[0080.920] CloseHandle (hObject=0x1a4) returned 1
	[0080.920] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0080.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0080.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0080.920] lstrlenW (lpString=".doc") returned 4
	[0080.920] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0080.920] lstrlenW (lpString=".docx") returned 5
	[0080.920] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0080.920] lstrlenW (lpString=".pdf") returned 4
	[0080.920] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0080.921] lstrlenW (lpString=".xls") returned 4
	[0080.921] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0080.921] lstrlenW (lpString=".xlsx") returned 5
	[0080.921] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0080.921] lstrlenW (lpString=".ppt") returned 4
	[0080.921] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0080.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0080.921] lstrlenW (lpString=".zip") returned 4
	[0080.921] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0080.921] lstrlenW (lpString=".rar") returned 4
	[0080.921] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0080.921] lstrlenW (lpString=".bz2") returned 4
	[0080.921] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0080.921] lstrlenW (lpString=".7z") returned 3
	[0080.921] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0080.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0080.921] lstrlenW (lpString=".dbf") returned 4
	[0080.921] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0080.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0080.921] lstrlenW (lpString=".1cd") returned 4
	[0080.921] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0080.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0080.921] lstrlenW (lpString=".jpg") returned 4
	[0080.921] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0080.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0080.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0080.921] lstrlenW (lpString=".doc") returned 4
	[0080.921] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0080.921] lstrlenW (lpString=".docx") returned 5
	[0080.921] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0080.921] lstrlenW (lpString=".pdf") returned 4
	[0080.921] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0080.921] lstrlenW (lpString=".xls") returned 4
	[0080.922] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0080.922] lstrlenW (lpString=".xlsx") returned 5
	[0080.922] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0080.922] lstrlenW (lpString=".ppt") returned 4
	[0080.922] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0080.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0080.922] lstrlenW (lpString=".zip") returned 4
	[0080.922] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0080.922] lstrlenW (lpString=".rar") returned 4
	[0080.922] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0080.922] lstrlenW (lpString=".bz2") returned 4
	[0080.922] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0080.922] lstrlenW (lpString=".7z") returned 3
	[0080.922] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0080.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0080.922] lstrlenW (lpString=".dbf") returned 4
	[0080.922] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0080.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0080.922] lstrlenW (lpString=".1cd") returned 4
	[0080.922] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0080.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0080.922] lstrlenW (lpString=".jpg") returned 4
	[0080.922] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0080.922] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0080.922] lstrlenW (lpString="ProjectMUI.msi") returned 14
	[0080.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.046] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2511872) returned 1
	[0081.046] CloseHandle (hObject=0x198) returned 1
	[0081.046] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020
	[0081.046] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.046] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0081.047] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0081.047] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0081.047] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0081.047] ReadFile (in: hFile=0x198, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0081.049] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0081.049] ReadFile (in: hFile=0x198, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0081.108] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0081.108] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0081.108] ReadFile (in: hFile=0x198, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0081.279] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.279] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0081.300] SetEndOfFile (hFile=0x198) returned 1
	[0081.301] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3fc0088
	[0081.305] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.305] WriteFile (in: hFile=0x198, lpBuffer=0x3fc0088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc0088*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.307] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.307] WriteFile (in: hFile=0x198, lpBuffer=0x3fc0088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc0088*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.348] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.348] WriteFile (in: hFile=0x198, lpBuffer=0x3fc0088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc0088*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.351] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3fc0088 | out: hHeap=0x5e0000) returned 1
	[0081.353] CloseHandle (hObject=0x198) returned 1
	[0081.353] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0081.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0081.353] lstrlenW (lpString=".doc") returned 4
	[0081.353] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0081.353] lstrlenW (lpString=".docx") returned 5
	[0081.353] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0081.353] lstrlenW (lpString=".pdf") returned 4
	[0081.353] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0081.353] lstrlenW (lpString=".xls") returned 4
	[0081.354] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0081.354] lstrlenW (lpString=".xlsx") returned 5
	[0081.354] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0081.354] lstrlenW (lpString=".ppt") returned 4
	[0081.354] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0081.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0081.354] lstrlenW (lpString=".zip") returned 4
	[0081.354] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0081.354] lstrlenW (lpString=".rar") returned 4
	[0081.354] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0081.354] lstrlenW (lpString=".bz2") returned 4
	[0081.354] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0081.354] lstrlenW (lpString=".7z") returned 3
	[0081.354] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0081.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0081.354] lstrlenW (lpString=".dbf") returned 4
	[0081.354] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0081.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0081.354] lstrlenW (lpString=".1cd") returned 4
	[0081.354] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0081.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0081.354] lstrlenW (lpString=".jpg") returned 4
	[0081.354] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0081.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0081.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0081.354] lstrlenW (lpString=".doc") returned 4
	[0081.354] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0081.354] lstrlenW (lpString=".docx") returned 5
	[0081.354] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0081.354] lstrlenW (lpString=".pdf") returned 4
	[0081.354] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0081.354] lstrlenW (lpString=".xls") returned 4
	[0081.354] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0081.355] lstrlenW (lpString=".xlsx") returned 5
	[0081.355] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0081.355] lstrlenW (lpString=".ppt") returned 4
	[0081.355] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0081.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0081.355] lstrlenW (lpString=".zip") returned 4
	[0081.355] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0081.355] lstrlenW (lpString=".rar") returned 4
	[0081.355] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0081.355] lstrlenW (lpString=".bz2") returned 4
	[0081.355] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0081.355] lstrlenW (lpString=".7z") returned 3
	[0081.355] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0081.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0081.355] lstrlenW (lpString=".dbf") returned 4
	[0081.355] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0081.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0081.355] lstrlenW (lpString=".1cd") returned 4
	[0081.355] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0081.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0081.355] lstrlenW (lpString=".jpg") returned 4
	[0081.355] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0081.355] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0081.355] lstrlenW (lpString="dwdcw20.dll") returned 11
	[0081.355] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0081.479] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=526176) returned 1
	[0081.479] CloseHandle (hObject=0x19c) returned 1
	[0081.479] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020
	[0081.491] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.495] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0081.531] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.531] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.531] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0081.677] GetLastError () returned 0x0
	[0081.677] ReadFile (in: hFile=0x194, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x80760, lpOverlapped=0x0) returned 1
	[0081.698] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x80770, lpOverlapped=0x0) returned 1
	[0081.712] ReadFile (in: hFile=0x194, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.712] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0081.713] SetEndOfFile (hFile=0x1a0) returned 1
	[0081.744] CloseHandle (hObject=0x1a0) returned 1
	[0081.832] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.832] SetEndOfFile (hFile=0x194) returned 1
	[0081.845] CloseHandle (hObject=0x194) returned 1
	[0081.849] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0081.867] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1
	[0081.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0081.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0081.876] lstrlenW (lpString=".doc") returned 4
	[0081.876] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.876] lstrlenW (lpString=".docx") returned 5
	[0081.876] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0081.876] lstrlenW (lpString=".pdf") returned 4
	[0081.876] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.876] lstrlenW (lpString=".xls") returned 4
	[0081.876] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.876] lstrlenW (lpString=".xlsx") returned 5
	[0081.876] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0081.876] lstrlenW (lpString=".ppt") returned 4
	[0081.876] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0081.876] lstrlenW (lpString=".zip") returned 4
	[0081.876] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.876] lstrlenW (lpString=".rar") returned 4
	[0081.876] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.877] lstrlenW (lpString=".bz2") returned 4
	[0081.877] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.877] lstrlenW (lpString=".7z") returned 3
	[0081.877] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0081.877] lstrlenW (lpString=".dbf") returned 4
	[0081.877] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0081.877] lstrlenW (lpString=".1cd") returned 4
	[0081.877] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0081.877] lstrlenW (lpString=".jpg") returned 4
	[0081.877] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0081.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0081.877] lstrlenW (lpString=".doc") returned 4
	[0081.877] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.877] lstrlenW (lpString=".docx") returned 5
	[0081.877] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0081.877] lstrlenW (lpString=".pdf") returned 4
	[0081.877] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.877] lstrlenW (lpString=".xls") returned 4
	[0081.877] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.877] lstrlenW (lpString=".xlsx") returned 5
	[0081.877] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0081.877] lstrlenW (lpString=".ppt") returned 4
	[0081.878] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0081.878] lstrlenW (lpString=".zip") returned 4
	[0081.878] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.878] lstrlenW (lpString=".rar") returned 4
	[0081.878] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.878] lstrlenW (lpString=".bz2") returned 4
	[0081.878] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.878] lstrlenW (lpString=".7z") returned 3
	[0081.878] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0081.878] lstrlenW (lpString=".dbf") returned 4
	[0081.878] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0081.878] lstrlenW (lpString=".1cd") returned 4
	[0081.878] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0081.878] lstrlenW (lpString=".jpg") returned 4
	[0081.878] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.878] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0081.878] lstrlenW (lpString="OfficeLR.cab") returned 12
	[0081.878] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0081.965] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=14127746) returned 1
	[0081.965] CloseHandle (hObject=0x184) returned 1
	[0081.965] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020
	[0081.973] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0081.974] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0082.104] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0082.201] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0082.201] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.202] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0082.219] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.219] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0082.225] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0082.225] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.225] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0082.246] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.246] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0082.270] SetEndOfFile (hFile=0x1a8) returned 1
	[0082.310] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f28070
	[0082.315] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0082.315] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f28070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f28070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0082.316] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0082.316] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f28070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f28070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0082.317] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0082.317] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f28070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f28070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0082.320] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f28070 | out: hHeap=0x5e0000) returned 1
	[0082.320] CloseHandle (hObject=0x1a8) returned 1
	[0082.336] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0082.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0082.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0082.408] lstrlenW (lpString=".doc") returned 4
	[0082.408] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0082.408] lstrlenW (lpString=".docx") returned 5
	[0082.408] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0082.408] lstrlenW (lpString=".pdf") returned 4
	[0082.408] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0082.408] lstrlenW (lpString=".xls") returned 4
	[0082.408] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0082.408] lstrlenW (lpString=".xlsx") returned 5
	[0082.408] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0082.408] lstrlenW (lpString=".ppt") returned 4
	[0082.408] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0082.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0082.408] lstrlenW (lpString=".zip") returned 4
	[0082.408] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0082.408] lstrlenW (lpString=".rar") returned 4
	[0082.408] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0082.409] lstrlenW (lpString=".bz2") returned 4
	[0082.409] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0082.409] lstrlenW (lpString=".7z") returned 3
	[0082.409] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0082.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0082.409] lstrlenW (lpString=".dbf") returned 4
	[0082.409] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0082.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0082.409] lstrlenW (lpString=".1cd") returned 4
	[0082.409] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0082.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0082.409] lstrlenW (lpString=".jpg") returned 4
	[0082.409] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0082.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0082.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0082.409] lstrlenW (lpString=".doc") returned 4
	[0082.409] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0082.409] lstrlenW (lpString=".docx") returned 5
	[0082.409] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0082.409] lstrlenW (lpString=".pdf") returned 4
	[0082.409] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0082.409] lstrlenW (lpString=".xls") returned 4
	[0082.409] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0082.409] lstrlenW (lpString=".xlsx") returned 5
	[0082.409] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0082.410] lstrlenW (lpString=".ppt") returned 4
	[0082.410] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0082.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0082.410] lstrlenW (lpString=".zip") returned 4
	[0082.410] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0082.410] lstrlenW (lpString=".rar") returned 4
	[0082.410] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0082.410] lstrlenW (lpString=".bz2") returned 4
	[0082.410] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0082.410] lstrlenW (lpString=".7z") returned 3
	[0082.410] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0082.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0082.410] lstrlenW (lpString=".dbf") returned 4
	[0082.410] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0082.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0082.410] lstrlenW (lpString=".1cd") returned 4
	[0082.410] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0082.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0082.410] lstrlenW (lpString=".jpg") returned 4
	[0082.410] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0082.410] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0082.410] lstrlenW (lpString="AccessMUISet.msi") returned 16
	[0082.411] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0082.411] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=868864) returned 1
	[0082.411] CloseHandle (hObject=0x19c) returned 1
	[0082.411] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020
	[0082.411] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.411] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0082.412] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.412] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0082.412] GetLastError () returned 0x0
	[0082.412] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xd4200, lpOverlapped=0x0) returned 1
	[0082.453] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xd4210, lpOverlapped=0x0) returned 1
	[0082.527] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0082.527] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0082.527] SetEndOfFile (hFile=0x1ac) returned 1
	[0082.527] CloseHandle (hObject=0x1ac) returned 1
	[0082.527] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.527] SetEndOfFile (hFile=0x19c) returned 1
	[0082.537] CloseHandle (hObject=0x19c) returned 1
	[0082.538] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0082.576] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1
	[0082.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0082.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0082.577] lstrlenW (lpString=".doc") returned 4
	[0082.577] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0082.577] lstrlenW (lpString=".docx") returned 5
	[0082.577] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1
	[0082.577] lstrlenW (lpString=".pdf") returned 4
	[0082.578] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0082.578] lstrlenW (lpString=".xls") returned 4
	[0082.578] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0082.578] lstrlenW (lpString=".xlsx") returned 5
	[0082.578] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1
	[0082.578] lstrlenW (lpString=".ppt") returned 4
	[0082.578] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0082.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0082.578] lstrlenW (lpString=".zip") returned 4
	[0082.578] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0082.578] lstrlenW (lpString=".rar") returned 4
	[0082.578] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0082.578] lstrlenW (lpString=".bz2") returned 4
	[0082.578] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0082.578] lstrlenW (lpString=".7z") returned 3
	[0082.578] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0082.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0082.578] lstrlenW (lpString=".dbf") returned 4
	[0082.578] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0082.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0082.578] lstrlenW (lpString=".1cd") returned 4
	[0082.578] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0082.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0082.578] lstrlenW (lpString=".jpg") returned 4
	[0082.578] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0082.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0082.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0082.579] lstrlenW (lpString=".doc") returned 4
	[0082.579] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0082.579] lstrlenW (lpString=".docx") returned 5
	[0082.579] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1
	[0082.579] lstrlenW (lpString=".pdf") returned 4
	[0082.579] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0082.579] lstrlenW (lpString=".xls") returned 4
	[0082.579] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0082.579] lstrlenW (lpString=".xlsx") returned 5
	[0082.579] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1
	[0082.579] lstrlenW (lpString=".ppt") returned 4
	[0082.579] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0082.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0082.579] lstrlenW (lpString=".zip") returned 4
	[0082.579] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0082.579] lstrlenW (lpString=".rar") returned 4
	[0082.579] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0082.579] lstrlenW (lpString=".bz2") returned 4
	[0082.579] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0082.579] lstrlenW (lpString=".7z") returned 3
	[0082.579] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0082.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0082.579] lstrlenW (lpString=".dbf") returned 4
	[0082.579] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0082.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0082.579] lstrlenW (lpString=".1cd") returned 4
	[0082.580] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0082.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0082.580] lstrlenW (lpString=".jpg") returned 4
	[0082.580] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0082.580] lstrcmpiW (lpString1=".msi", lpString2=".adobe") returned 1
	[0082.580] lstrlenW (lpString="Office32WW.msi") returned 14
	[0082.580] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0082.580] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1992192) returned 1
	[0082.580] CloseHandle (hObject=0x1a8) returned 1
	[0082.581] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020
	[0082.581] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.581] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0082.582] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0082.582] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0082.582] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.582] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0082.585] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.585] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0082.589] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0082.589] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.589] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0082.633] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.633] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0082.679] SetEndOfFile (hFile=0x1a8) returned 1
	[0082.679] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f28070
	[0082.679] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0082.679] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f28070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f28070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0082.681] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0082.681] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f28070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f28070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0082.684] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0082.684] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f28070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f28070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0082.687] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f28070 | out: hHeap=0x5e0000) returned 1
	[0082.687] CloseHandle (hObject=0x1a8) returned 1
	[0082.687] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0082.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0082.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0082.688] lstrlenW (lpString=".doc") returned 4
	[0082.688] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0082.688] lstrlenW (lpString=".docx") returned 5
	[0082.688] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0082.688] lstrlenW (lpString=".pdf") returned 4
	[0082.688] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0082.688] lstrlenW (lpString=".xls") returned 4
	[0082.688] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0082.688] lstrlenW (lpString=".xlsx") returned 5
	[0082.688] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0082.688] lstrlenW (lpString=".ppt") returned 4
	[0082.688] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0082.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0082.688] lstrlenW (lpString=".zip") returned 4
	[0082.688] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0082.688] lstrlenW (lpString=".rar") returned 4
	[0082.688] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0082.688] lstrlenW (lpString=".bz2") returned 4
	[0082.688] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0082.688] lstrlenW (lpString=".7z") returned 3
	[0082.688] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0082.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0082.689] lstrlenW (lpString=".dbf") returned 4
	[0082.689] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0082.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0082.689] lstrlenW (lpString=".1cd") returned 4
	[0082.689] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0082.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0082.689] lstrlenW (lpString=".jpg") returned 4
	[0082.689] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0082.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0082.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0082.689] lstrlenW (lpString=".doc") returned 4
	[0082.689] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0082.689] lstrlenW (lpString=".docx") returned 5
	[0082.689] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0082.689] lstrlenW (lpString=".pdf") returned 4
	[0082.689] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0082.689] lstrlenW (lpString=".xls") returned 4
	[0082.689] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0082.689] lstrlenW (lpString=".xlsx") returned 5
	[0082.689] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0082.689] lstrlenW (lpString=".ppt") returned 4
	[0082.689] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0082.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0082.689] lstrlenW (lpString=".zip") returned 4
	[0082.690] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0082.690] lstrlenW (lpString=".rar") returned 4
	[0082.690] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0082.690] lstrlenW (lpString=".bz2") returned 4
	[0082.690] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0082.690] lstrlenW (lpString=".7z") returned 3
	[0082.690] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0082.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0082.690] lstrlenW (lpString=".dbf") returned 4
	[0082.690] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0082.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0082.690] lstrlenW (lpString=".1cd") returned 4
	[0082.690] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0082.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0082.690] lstrlenW (lpString=".jpg") returned 4
	[0082.690] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0082.690] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0082.690] lstrlenW (lpString="osetup.dll") returned 10
	[0082.690] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0082.725] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=7378792) returned 1
	[0082.725] CloseHandle (hObject=0x174) returned 1
	[0082.725] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020
	[0082.777] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0082.778] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0082.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.004] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0083.004] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.004] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.008] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.009] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.061] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0083.061] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.061] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.096] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.096] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0083.137] SetEndOfFile (hFile=0x1a8) returned 1
	[0083.147] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0083.152] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.152] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.154] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.154] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.157] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.157] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.159] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0083.159] CloseHandle (hObject=0x1a8) returned 1
	[0083.172] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0083.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.232] lstrlenW (lpString=".doc") returned 4
	[0083.232] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.232] lstrlenW (lpString=".docx") returned 5
	[0083.232] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0083.232] lstrlenW (lpString=".pdf") returned 4
	[0083.232] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.232] lstrlenW (lpString=".xls") returned 4
	[0083.232] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.232] lstrlenW (lpString=".xlsx") returned 5
	[0083.232] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0083.232] lstrlenW (lpString=".ppt") returned 4
	[0083.232] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.232] lstrlenW (lpString=".zip") returned 4
	[0083.232] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.232] lstrlenW (lpString=".rar") returned 4
	[0083.232] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.232] lstrlenW (lpString=".bz2") returned 4
	[0083.232] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.233] lstrlenW (lpString=".7z") returned 3
	[0083.233] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.233] lstrlenW (lpString=".dbf") returned 4
	[0083.233] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.233] lstrlenW (lpString=".1cd") returned 4
	[0083.233] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.233] lstrlenW (lpString=".jpg") returned 4
	[0083.233] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.233] lstrlenW (lpString=".doc") returned 4
	[0083.233] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.233] lstrlenW (lpString=".docx") returned 5
	[0083.233] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0083.233] lstrlenW (lpString=".pdf") returned 4
	[0083.233] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.233] lstrlenW (lpString=".xls") returned 4
	[0083.233] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.233] lstrlenW (lpString=".xlsx") returned 5
	[0083.233] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0083.233] lstrlenW (lpString=".ppt") returned 4
	[0083.233] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.234] lstrlenW (lpString=".zip") returned 4
	[0083.234] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.234] lstrlenW (lpString=".rar") returned 4
	[0083.234] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.234] lstrlenW (lpString=".bz2") returned 4
	[0083.234] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.234] lstrlenW (lpString=".7z") returned 3
	[0083.234] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.234] lstrlenW (lpString=".dbf") returned 4
	[0083.234] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.234] lstrlenW (lpString=".1cd") returned 4
	[0083.234] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0083.234] lstrlenW (lpString=".jpg") returned 4
	[0083.234] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.234] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0083.234] lstrlenW (lpString="ProPrWW.cab") returned 11
	[0083.234] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0083.265] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=177720283) returned 1
	[0083.265] CloseHandle (hObject=0x1a4) returned 1
	[0083.265] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020
	[0083.277] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.278] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0083.306] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0083.482] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0083.482] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.482] ReadFile (in: hFile=0x1b0, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.505] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.505] ReadFile (in: hFile=0x1b0, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.512] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0083.512] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.512] ReadFile (in: hFile=0x1b0, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.529] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.529] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0083.549] SetEndOfFile (hFile=0x1b0) returned 1
	[0083.606] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0083.610] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.610] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.611] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.611] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.612] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.612] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.614] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0083.614] CloseHandle (hObject=0x1b0) returned 1
	[0083.717] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0083.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0083.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0083.717] lstrlenW (lpString=".doc") returned 4
	[0083.717] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0083.717] lstrlenW (lpString=".docx") returned 5
	[0083.717] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0083.717] lstrlenW (lpString=".pdf") returned 4
	[0083.717] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0083.717] lstrlenW (lpString=".xls") returned 4
	[0083.717] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0083.717] lstrlenW (lpString=".xlsx") returned 5
	[0083.717] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0083.717] lstrlenW (lpString=".ppt") returned 4
	[0083.717] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0083.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0083.718] lstrlenW (lpString=".zip") returned 4
	[0083.718] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0083.718] lstrlenW (lpString=".rar") returned 4
	[0083.718] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0083.718] lstrlenW (lpString=".bz2") returned 4
	[0083.718] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0083.718] lstrlenW (lpString=".7z") returned 3
	[0083.718] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0083.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0083.718] lstrlenW (lpString=".dbf") returned 4
	[0083.718] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0083.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0083.718] lstrlenW (lpString=".1cd") returned 4
	[0083.718] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0083.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0083.718] lstrlenW (lpString=".jpg") returned 4
	[0083.718] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0083.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0083.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0083.718] lstrlenW (lpString=".doc") returned 4
	[0083.718] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0083.718] lstrlenW (lpString=".docx") returned 5
	[0083.718] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0083.718] lstrlenW (lpString=".pdf") returned 4
	[0083.719] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0083.719] lstrlenW (lpString=".xls") returned 4
	[0083.719] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0083.719] lstrlenW (lpString=".xlsx") returned 5
	[0083.719] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0083.719] lstrlenW (lpString=".ppt") returned 4
	[0083.719] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0083.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0083.719] lstrlenW (lpString=".zip") returned 4
	[0083.719] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0083.719] lstrlenW (lpString=".rar") returned 4
	[0083.719] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0083.719] lstrlenW (lpString=".bz2") returned 4
	[0083.719] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0083.719] lstrlenW (lpString=".7z") returned 3
	[0083.719] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0083.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0083.719] lstrlenW (lpString=".dbf") returned 4
	[0083.719] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0083.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0083.719] lstrlenW (lpString=".1cd") returned 4
	[0083.719] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0083.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0083.719] lstrlenW (lpString=".jpg") returned 4
	[0083.719] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0083.720] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0083.720] lstrlenW (lpString="PidGenX.dll") returned 11
	[0083.720] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0083.850] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1463568) returned 1
	[0083.850] CloseHandle (hObject=0x1a8) returned 1
	[0083.850] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020
	[0083.866] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0083.886] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0083.899] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.899] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.899] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0083.947] GetLastError () returned 0x0
	[0083.947] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0083.974] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0084.001] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x65520, lpOverlapped=0x0) returned 1
	[0084.023] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x65530, lpOverlapped=0x0) returned 1
	[0084.038] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.038] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0084.039] SetEndOfFile (hFile=0x1ac) returned 1
	[0084.044] CloseHandle (hObject=0x1ac) returned 1
	[0084.045] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.045] SetEndOfFile (hFile=0x160) returned 1
	[0084.054] CloseHandle (hObject=0x160) returned 1
	[0084.055] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0084.057] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1
	[0084.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0084.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0084.066] lstrlenW (lpString=".doc") returned 4
	[0084.066] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.066] lstrlenW (lpString=".docx") returned 5
	[0084.066] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0084.066] lstrlenW (lpString=".pdf") returned 4
	[0084.066] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.066] lstrlenW (lpString=".xls") returned 4
	[0084.066] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.066] lstrlenW (lpString=".xlsx") returned 5
	[0084.066] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0084.066] lstrlenW (lpString=".ppt") returned 4
	[0084.066] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0084.066] lstrlenW (lpString=".zip") returned 4
	[0084.066] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.067] lstrlenW (lpString=".rar") returned 4
	[0084.067] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.067] lstrlenW (lpString=".bz2") returned 4
	[0084.067] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.067] lstrlenW (lpString=".7z") returned 3
	[0084.067] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0084.067] lstrlenW (lpString=".dbf") returned 4
	[0084.067] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0084.067] lstrlenW (lpString=".1cd") returned 4
	[0084.067] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0084.067] lstrlenW (lpString=".jpg") returned 4
	[0084.067] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0084.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0084.067] lstrlenW (lpString=".doc") returned 4
	[0084.067] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.067] lstrlenW (lpString=".docx") returned 5
	[0084.067] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0084.067] lstrlenW (lpString=".pdf") returned 4
	[0084.067] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.067] lstrlenW (lpString=".xls") returned 4
	[0084.067] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.067] lstrlenW (lpString=".xlsx") returned 5
	[0084.068] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0084.068] lstrlenW (lpString=".ppt") returned 4
	[0084.068] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0084.068] lstrlenW (lpString=".zip") returned 4
	[0084.068] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.068] lstrlenW (lpString=".rar") returned 4
	[0084.068] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.068] lstrlenW (lpString=".bz2") returned 4
	[0084.068] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.068] lstrlenW (lpString=".7z") returned 3
	[0084.068] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0084.068] lstrlenW (lpString=".dbf") returned 4
	[0084.068] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0084.068] lstrlenW (lpString=".1cd") returned 4
	[0084.068] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0084.068] lstrlenW (lpString=".jpg") returned 4
	[0084.068] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.069] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0084.069] lstrlenW (lpString="setup.exe") returned 9
	[0084.069] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0084.131] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1377656) returned 1
	[0084.132] CloseHandle (hObject=0x160) returned 1
	[0084.132] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020
	[0084.316] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.317] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0084.329] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.329] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.329] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.339] GetLastError () returned 0x0
	[0084.339] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0084.398] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0084.506] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x50588, lpOverlapped=0x0) returned 1
	[0084.548] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x50590, lpOverlapped=0x0) returned 1
	[0084.582] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0084.582] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0084.582] SetEndOfFile (hFile=0x1b0) returned 1
	[0084.583] CloseHandle (hObject=0x1b0) returned 1
	[0084.583] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.583] SetEndOfFile (hFile=0x1a4) returned 1
	[0084.587] CloseHandle (hObject=0x1a4) returned 1
	[0084.587] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0084.588] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1
	[0084.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0084.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0084.588] lstrlenW (lpString=".doc") returned 4
	[0084.588] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0084.588] lstrlenW (lpString=".docx") returned 5
	[0084.588] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0084.588] lstrlenW (lpString=".pdf") returned 4
	[0084.588] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0084.588] lstrlenW (lpString=".xls") returned 4
	[0084.589] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0084.589] lstrlenW (lpString=".xlsx") returned 5
	[0084.589] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0084.589] lstrlenW (lpString=".ppt") returned 4
	[0084.589] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0084.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0084.589] lstrlenW (lpString=".zip") returned 4
	[0084.589] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0084.589] lstrlenW (lpString=".rar") returned 4
	[0084.589] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0084.589] lstrlenW (lpString=".bz2") returned 4
	[0084.589] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0084.589] lstrlenW (lpString=".7z") returned 3
	[0084.589] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0084.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0084.589] lstrlenW (lpString=".dbf") returned 4
	[0084.589] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0084.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0084.589] lstrlenW (lpString=".1cd") returned 4
	[0084.589] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0084.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0084.589] lstrlenW (lpString=".jpg") returned 4
	[0084.589] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0084.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0084.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0084.590] lstrlenW (lpString=".doc") returned 4
	[0084.590] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0084.590] lstrlenW (lpString=".docx") returned 5
	[0084.590] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0084.590] lstrlenW (lpString=".pdf") returned 4
	[0084.590] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0084.590] lstrlenW (lpString=".xls") returned 4
	[0084.590] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0084.590] lstrlenW (lpString=".xlsx") returned 5
	[0084.590] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0084.590] lstrlenW (lpString=".ppt") returned 4
	[0084.590] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0084.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0084.590] lstrlenW (lpString=".zip") returned 4
	[0084.590] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0084.590] lstrlenW (lpString=".rar") returned 4
	[0084.590] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0084.590] lstrlenW (lpString=".bz2") returned 4
	[0084.590] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0084.590] lstrlenW (lpString=".7z") returned 3
	[0084.590] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0084.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0084.590] lstrlenW (lpString=".dbf") returned 4
	[0084.590] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0084.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0084.591] lstrlenW (lpString=".1cd") returned 4
	[0084.591] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0084.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0084.591] lstrlenW (lpString=".jpg") returned 4
	[0084.591] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0084.591] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0084.591] lstrlenW (lpString="PidGenX.dll") returned 11
	[0084.591] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0084.617] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1463568) returned 1
	[0084.617] CloseHandle (hObject=0x1b0) returned 1
	[0084.618] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020
	[0084.886] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0084.948] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0085.035] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.036] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0085.170] GetLastError () returned 0x0
	[0085.170] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0085.205] WriteFile (in: hFile=0x194, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0085.233] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x65520, lpOverlapped=0x0) returned 1
	[0085.257] WriteFile (in: hFile=0x194, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x65530, lpOverlapped=0x0) returned 1
	[0085.274] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.274] WriteFile (in: hFile=0x194, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0085.274] SetEndOfFile (hFile=0x194) returned 1
	[0085.299] CloseHandle (hObject=0x194) returned 1
	[0085.305] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.305] SetEndOfFile (hFile=0x1a8) returned 1
	[0085.335] CloseHandle (hObject=0x1a8) returned 1
	[0085.360] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0085.373] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1
	[0085.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0085.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0085.487] lstrlenW (lpString=".doc") returned 4
	[0085.487] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.487] lstrlenW (lpString=".docx") returned 5
	[0085.487] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0085.487] lstrlenW (lpString=".pdf") returned 4
	[0085.487] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.487] lstrlenW (lpString=".xls") returned 4
	[0085.487] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.487] lstrlenW (lpString=".xlsx") returned 5
	[0085.487] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0085.487] lstrlenW (lpString=".ppt") returned 4
	[0085.487] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0085.487] lstrlenW (lpString=".zip") returned 4
	[0085.488] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.488] lstrlenW (lpString=".rar") returned 4
	[0085.488] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.488] lstrlenW (lpString=".bz2") returned 4
	[0085.488] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.488] lstrlenW (lpString=".7z") returned 3
	[0085.488] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0085.488] lstrlenW (lpString=".dbf") returned 4
	[0085.488] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0085.488] lstrlenW (lpString=".1cd") returned 4
	[0085.488] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0085.488] lstrlenW (lpString=".jpg") returned 4
	[0085.488] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0085.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0085.488] lstrlenW (lpString=".doc") returned 4
	[0085.488] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.488] lstrlenW (lpString=".docx") returned 5
	[0085.488] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0085.488] lstrlenW (lpString=".pdf") returned 4
	[0085.488] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.488] lstrlenW (lpString=".xls") returned 4
	[0085.489] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.489] lstrlenW (lpString=".xlsx") returned 5
	[0085.489] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0085.489] lstrlenW (lpString=".ppt") returned 4
	[0085.489] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0085.489] lstrlenW (lpString=".zip") returned 4
	[0085.489] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.489] lstrlenW (lpString=".rar") returned 4
	[0085.489] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.489] lstrlenW (lpString=".bz2") returned 4
	[0085.489] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.489] lstrlenW (lpString=".7z") returned 3
	[0085.489] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0085.489] lstrlenW (lpString=".dbf") returned 4
	[0085.489] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0085.489] lstrlenW (lpString=".1cd") returned 4
	[0085.489] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0085.489] lstrlenW (lpString=".jpg") returned 4
	[0085.489] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.490] lstrcmpiW (lpString1=".cab", lpString2=".adobe") returned 1
	[0085.490] lstrlenW (lpString="VisiorWW.cab") returned 12
	[0085.490] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0085.599] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=195011319) returned 1
	[0085.599] CloseHandle (hObject=0x198) returned 1
	[0085.599] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020
	[0085.806] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0085.849] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0086.046] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0086.062] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0086.062] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0086.062] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0086.075] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0086.075] ReadFile (in: hFile=0x19c, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0086.085] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0086.085] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0086.085] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0086.106] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.106] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0086.176] SetEndOfFile (hFile=0x19c) returned 1
	[0086.176] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0086.182] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.182] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.183] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.183] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.185] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.185] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.188] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0086.188] CloseHandle (hObject=0x19c) returned 1
	[0086.188] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x2020) returned 1
	[0086.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0086.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0086.189] lstrlenW (lpString=".doc") returned 4
	[0086.189] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0086.189] lstrlenW (lpString=".docx") returned 5
	[0086.189] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0086.189] lstrlenW (lpString=".pdf") returned 4
	[0086.189] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0086.189] lstrlenW (lpString=".xls") returned 4
	[0086.189] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0086.189] lstrlenW (lpString=".xlsx") returned 5
	[0086.189] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0086.189] lstrlenW (lpString=".ppt") returned 4
	[0086.189] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0086.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0086.189] lstrlenW (lpString=".zip") returned 4
	[0086.189] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0086.189] lstrlenW (lpString=".rar") returned 4
	[0086.189] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0086.189] lstrlenW (lpString=".bz2") returned 4
	[0086.189] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0086.189] lstrlenW (lpString=".7z") returned 3
	[0086.190] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0086.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0086.190] lstrlenW (lpString=".dbf") returned 4
	[0086.190] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0086.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0086.190] lstrlenW (lpString=".1cd") returned 4
	[0086.190] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0086.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0086.190] lstrlenW (lpString=".jpg") returned 4
	[0086.190] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0086.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0086.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0086.190] lstrlenW (lpString=".doc") returned 4
	[0086.190] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0086.190] lstrlenW (lpString=".docx") returned 5
	[0086.190] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0086.190] lstrlenW (lpString=".pdf") returned 4
	[0086.190] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0086.190] lstrlenW (lpString=".xls") returned 4
	[0086.190] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0086.190] lstrlenW (lpString=".xlsx") returned 5
	[0086.190] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0086.190] lstrlenW (lpString=".ppt") returned 4
	[0086.190] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0086.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0086.191] lstrlenW (lpString=".zip") returned 4
	[0086.191] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0086.191] lstrlenW (lpString=".rar") returned 4
	[0086.191] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0086.191] lstrlenW (lpString=".bz2") returned 4
	[0086.191] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0086.191] lstrlenW (lpString=".7z") returned 3
	[0086.191] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0086.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0086.191] lstrlenW (lpString=".dbf") returned 4
	[0086.191] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0086.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0086.191] lstrlenW (lpString=".1cd") returned 4
	[0086.191] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0086.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0086.191] lstrlenW (lpString=".jpg") returned 4
	[0086.191] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0086.191] lstrcmpiW (lpString1=".HLP", lpString2=".adobe") returned 1
	[0086.191] lstrlenW (lpString="EQNEDT32.HLP") returned 12
	[0086.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.265] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=176311) returned 1
	[0086.265] CloseHandle (hObject=0x194) returned 1
	[0086.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20
	[0086.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0086.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0086.497] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.497] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0086.729] GetLastError () returned 0x0
	[0086.729] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x2b0b7, lpOverlapped=0x0) returned 1
	[0086.735] WriteFile (in: hFile=0x194, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2b0c0, lpOverlapped=0x0) returned 1
	[0086.739] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.739] WriteFile (in: hFile=0x194, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0086.739] SetEndOfFile (hFile=0x194) returned 1
	[0086.740] CloseHandle (hObject=0x194) returned 1
	[0086.740] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.740] SetEndOfFile (hFile=0x1a4) returned 1
	[0086.742] CloseHandle (hObject=0x1a4) returned 1
	[0086.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0086.743] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1
	[0086.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0086.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0086.743] lstrlenW (lpString=".doc") returned 4
	[0086.743] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1
	[0086.743] lstrlenW (lpString=".docx") returned 5
	[0086.743] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1
	[0086.743] lstrlenW (lpString=".pdf") returned 4
	[0086.743] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1
	[0086.743] lstrlenW (lpString=".xls") returned 4
	[0086.743] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1
	[0086.743] lstrlenW (lpString=".xlsx") returned 5
	[0086.743] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1
	[0086.743] lstrlenW (lpString=".ppt") returned 4
	[0086.743] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1
	[0086.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0086.744] lstrlenW (lpString=".zip") returned 4
	[0086.744] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1
	[0086.744] lstrlenW (lpString=".rar") returned 4
	[0086.744] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1
	[0086.744] lstrlenW (lpString=".bz2") returned 4
	[0086.744] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1
	[0086.744] lstrlenW (lpString=".7z") returned 3
	[0086.744] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1
	[0086.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0086.744] lstrlenW (lpString=".dbf") returned 4
	[0086.744] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1
	[0086.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0086.744] lstrlenW (lpString=".1cd") returned 4
	[0086.744] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1
	[0086.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0086.744] lstrlenW (lpString=".jpg") returned 4
	[0086.744] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1
	[0086.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0086.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0086.744] lstrlenW (lpString=".doc") returned 4
	[0086.744] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1
	[0086.744] lstrlenW (lpString=".docx") returned 5
	[0086.744] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1
	[0086.744] lstrlenW (lpString=".pdf") returned 4
	[0086.745] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1
	[0086.745] lstrlenW (lpString=".xls") returned 4
	[0086.745] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1
	[0086.745] lstrlenW (lpString=".xlsx") returned 5
	[0086.745] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1
	[0086.745] lstrlenW (lpString=".ppt") returned 4
	[0086.745] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1
	[0086.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0086.745] lstrlenW (lpString=".zip") returned 4
	[0086.745] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1
	[0086.745] lstrlenW (lpString=".rar") returned 4
	[0086.745] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1
	[0086.745] lstrlenW (lpString=".bz2") returned 4
	[0086.745] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1
	[0086.745] lstrlenW (lpString=".7z") returned 3
	[0086.745] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1
	[0086.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0086.745] lstrlenW (lpString=".dbf") returned 4
	[0086.745] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1
	[0086.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0086.745] lstrlenW (lpString=".1cd") returned 4
	[0086.745] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1
	[0086.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0086.745] lstrlenW (lpString=".jpg") returned 4
	[0086.745] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1
	[0086.746] lstrcmpiW (lpString1=".FLT", lpString2=".adobe") returned 1
	[0086.746] lstrlenW (lpString="EPSIMP32.FLT") returned 12
	[0086.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0086.775] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=712592) returned 1
	[0086.776] CloseHandle (hObject=0x174) returned 1
	[0086.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20
	[0087.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.113] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.113] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0087.143] GetLastError () returned 0x0
	[0087.143] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xadf90, lpOverlapped=0x0) returned 1
	[0087.165] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xadfa0, lpOverlapped=0x0) returned 1
	[0087.183] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.183] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0087.183] SetEndOfFile (hFile=0x190) returned 1
	[0087.187] CloseHandle (hObject=0x190) returned 1
	[0087.211] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.211] SetEndOfFile (hFile=0x1ac) returned 1
	[0087.226] CloseHandle (hObject=0x1ac) returned 1
	[0087.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0087.236] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1
	[0087.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67
	[0087.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67
	[0087.242] lstrlenW (lpString=".doc") returned 4
	[0087.242] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0087.242] lstrlenW (lpString=".docx") returned 5
	[0087.242] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0087.242] lstrlenW (lpString=".pdf") returned 4
	[0087.242] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0087.242] lstrlenW (lpString=".xls") returned 4
	[0087.242] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0087.242] lstrlenW (lpString=".xlsx") returned 5
	[0087.242] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0087.242] lstrlenW (lpString=".ppt") returned 4
	[0087.242] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0087.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67
	[0087.242] lstrlenW (lpString=".zip") returned 4
	[0087.242] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0087.243] lstrlenW (lpString=".rar") returned 4
	[0087.243] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0087.243] lstrlenW (lpString=".bz2") returned 4
	[0087.243] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0087.243] lstrlenW (lpString=".7z") returned 3
	[0087.243] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0087.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67
	[0087.243] lstrlenW (lpString=".dbf") returned 4
	[0087.243] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0087.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67
	[0087.243] lstrlenW (lpString=".1cd") returned 4
	[0087.243] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0087.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67
	[0087.243] lstrlenW (lpString=".jpg") returned 4
	[0087.243] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0087.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67
	[0087.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67
	[0087.243] lstrlenW (lpString=".doc") returned 4
	[0087.243] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0087.243] lstrlenW (lpString=".docx") returned 5
	[0087.243] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0087.243] lstrlenW (lpString=".pdf") returned 4
	[0087.243] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0087.243] lstrlenW (lpString=".xls") returned 4
	[0087.243] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0087.243] lstrlenW (lpString=".xlsx") returned 5
	[0087.244] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0087.244] lstrlenW (lpString=".ppt") returned 4
	[0087.244] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0087.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67
	[0087.244] lstrlenW (lpString=".zip") returned 4
	[0087.244] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0087.244] lstrlenW (lpString=".rar") returned 4
	[0087.244] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0087.244] lstrlenW (lpString=".bz2") returned 4
	[0087.244] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0087.244] lstrlenW (lpString=".7z") returned 3
	[0087.244] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0087.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67
	[0087.244] lstrlenW (lpString=".dbf") returned 4
	[0087.244] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0087.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67
	[0087.244] lstrlenW (lpString=".1cd") returned 4
	[0087.244] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0087.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67
	[0087.244] lstrlenW (lpString=".jpg") returned 4
	[0087.244] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0087.244] lstrcmpiW (lpString1=".WPG", lpString2=".adobe") returned 1
	[0087.245] lstrlenW (lpString="MS.WPG") returned 6
	[0087.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.277] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1382) returned 1
	[0087.277] CloseHandle (hObject=0x174) returned 1
	[0087.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20
	[0087.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0087.346] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.346] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0087.370] GetLastError () returned 0x0
	[0087.370] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x566, lpOverlapped=0x0) returned 1
	[0087.374] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x570, lpOverlapped=0x0) returned 1
	[0087.375] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.375] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0087.376] SetEndOfFile (hFile=0x160) returned 1
	[0087.382] CloseHandle (hObject=0x160) returned 1
	[0087.386] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.386] SetEndOfFile (hFile=0x19c) returned 1
	[0087.393] CloseHandle (hObject=0x19c) returned 1
	[0087.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0087.400] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 1
	[0087.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0087.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0087.415] lstrlenW (lpString=".doc") returned 4
	[0087.415] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1
	[0087.415] lstrlenW (lpString=".docx") returned 5
	[0087.415] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1
	[0087.415] lstrlenW (lpString=".pdf") returned 4
	[0087.415] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1
	[0087.415] lstrlenW (lpString=".xls") returned 4
	[0087.415] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1
	[0087.415] lstrlenW (lpString=".xlsx") returned 5
	[0087.415] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1
	[0087.415] lstrlenW (lpString=".ppt") returned 4
	[0087.415] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1
	[0087.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0087.415] lstrlenW (lpString=".zip") returned 4
	[0087.415] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1
	[0087.415] lstrlenW (lpString=".rar") returned 4
	[0087.415] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1
	[0087.415] lstrlenW (lpString=".bz2") returned 4
	[0087.415] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1
	[0087.415] lstrlenW (lpString=".7z") returned 3
	[0087.415] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1
	[0087.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0087.415] lstrlenW (lpString=".dbf") returned 4
	[0087.415] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1
	[0087.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0087.415] lstrlenW (lpString=".1cd") returned 4
	[0087.416] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1
	[0087.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0087.416] lstrlenW (lpString=".jpg") returned 4
	[0087.416] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1
	[0087.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0087.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0087.416] lstrlenW (lpString=".doc") returned 4
	[0087.416] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1
	[0087.416] lstrlenW (lpString=".docx") returned 5
	[0087.416] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1
	[0087.416] lstrlenW (lpString=".pdf") returned 4
	[0087.416] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1
	[0087.416] lstrlenW (lpString=".xls") returned 4
	[0087.416] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1
	[0087.416] lstrlenW (lpString=".xlsx") returned 5
	[0087.416] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1
	[0087.416] lstrlenW (lpString=".ppt") returned 4
	[0087.416] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1
	[0087.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0087.416] lstrlenW (lpString=".zip") returned 4
	[0087.416] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1
	[0087.416] lstrlenW (lpString=".rar") returned 4
	[0087.416] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1
	[0087.416] lstrlenW (lpString=".bz2") returned 4
	[0087.416] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1
	[0087.416] lstrlenW (lpString=".7z") returned 3
	[0087.417] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1
	[0087.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0087.417] lstrlenW (lpString=".dbf") returned 4
	[0087.417] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1
	[0087.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0087.417] lstrlenW (lpString=".1cd") returned 4
	[0087.417] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1
	[0087.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0087.417] lstrlenW (lpString=".jpg") returned 4
	[0087.417] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1
	[0087.417] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0087.417] lstrlenW (lpString="hxds.dll") returned 8
	[0087.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.421] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1257984) returned 1
	[0087.421] CloseHandle (hObject=0x174) returned 1
	[0087.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20
	[0087.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.422] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.422] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0087.422] GetLastError () returned 0x0
	[0087.422] ReadFile (in: hFile=0x174, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0087.456] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0087.484] ReadFile (in: hFile=0x174, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x33210, lpOverlapped=0x0) returned 1
	[0087.503] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x33220, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x33220, lpOverlapped=0x0) returned 1
	[0087.512] ReadFile (in: hFile=0x174, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.512] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0087.513] SetEndOfFile (hFile=0x160) returned 1
	[0087.513] CloseHandle (hObject=0x160) returned 1
	[0087.513] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.513] SetEndOfFile (hFile=0x174) returned 1
	[0087.516] CloseHandle (hObject=0x174) returned 1
	[0087.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0087.516] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 1
	[0087.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60
	[0087.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60
	[0087.517] lstrlenW (lpString=".doc") returned 4
	[0087.517] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.517] lstrlenW (lpString=".docx") returned 5
	[0087.517] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0087.517] lstrlenW (lpString=".pdf") returned 4
	[0087.517] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.517] lstrlenW (lpString=".xls") returned 4
	[0087.517] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.517] lstrlenW (lpString=".xlsx") returned 5
	[0087.517] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0087.517] lstrlenW (lpString=".ppt") returned 4
	[0087.517] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60
	[0087.517] lstrlenW (lpString=".zip") returned 4
	[0087.517] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.517] lstrlenW (lpString=".rar") returned 4
	[0087.517] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.517] lstrlenW (lpString=".bz2") returned 4
	[0087.517] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.517] lstrlenW (lpString=".7z") returned 3
	[0087.517] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60
	[0087.517] lstrlenW (lpString=".dbf") returned 4
	[0087.517] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60
	[0087.518] lstrlenW (lpString=".1cd") returned 4
	[0087.518] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60
	[0087.518] lstrlenW (lpString=".jpg") returned 4
	[0087.518] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60
	[0087.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60
	[0087.518] lstrlenW (lpString=".doc") returned 4
	[0087.518] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.518] lstrlenW (lpString=".docx") returned 5
	[0087.518] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0087.518] lstrlenW (lpString=".pdf") returned 4
	[0087.518] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.518] lstrlenW (lpString=".xls") returned 4
	[0087.518] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.518] lstrlenW (lpString=".xlsx") returned 5
	[0087.518] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0087.518] lstrlenW (lpString=".ppt") returned 4
	[0087.518] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60
	[0087.518] lstrlenW (lpString=".zip") returned 4
	[0087.518] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.518] lstrlenW (lpString=".rar") returned 4
	[0087.518] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.518] lstrlenW (lpString=".bz2") returned 4
	[0087.518] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.519] lstrlenW (lpString=".7z") returned 3
	[0087.519] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60
	[0087.519] lstrlenW (lpString=".dbf") returned 4
	[0087.519] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60
	[0087.519] lstrlenW (lpString=".1cd") returned 4
	[0087.519] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60
	[0087.519] lstrlenW (lpString=".jpg") returned 4
	[0087.519] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.519] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0087.519] lstrlenW (lpString="ITIRCL55.DLL") returned 12
	[0087.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.520] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1831424) returned 1
	[0087.520] CloseHandle (hObject=0x174) returned 1
	[0087.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20
	[0087.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0087.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0087.525] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0087.525] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0087.525] ReadFile (in: hFile=0x174, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0087.532] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0087.532] ReadFile (in: hFile=0x174, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0087.536] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0087.536] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0087.536] ReadFile (in: hFile=0x174, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0087.558] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.558] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0087.590] SetEndOfFile (hFile=0x174) returned 1
	[0087.590] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f30070
	[0087.595] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0087.595] WriteFile (in: hFile=0x174, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0087.597] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0087.597] WriteFile (in: hFile=0x174, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0087.600] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0087.600] WriteFile (in: hFile=0x174, lpBuffer=0x3f30070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30070*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0087.602] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0087.603] CloseHandle (hObject=0x174) returned 1
	[0087.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0087.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64
	[0087.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64
	[0087.607] lstrlenW (lpString=".doc") returned 4
	[0087.607] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0087.607] lstrlenW (lpString=".docx") returned 5
	[0087.607] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1
	[0087.607] lstrlenW (lpString=".pdf") returned 4
	[0087.607] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0087.607] lstrlenW (lpString=".xls") returned 4
	[0087.607] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0087.607] lstrlenW (lpString=".xlsx") returned 5
	[0087.607] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1
	[0087.607] lstrlenW (lpString=".ppt") returned 4
	[0087.607] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0087.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64
	[0087.608] lstrlenW (lpString=".zip") returned 4
	[0087.608] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0087.608] lstrlenW (lpString=".rar") returned 4
	[0087.608] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0087.608] lstrlenW (lpString=".bz2") returned 4
	[0087.608] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0087.608] lstrlenW (lpString=".7z") returned 3
	[0087.608] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0087.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64
	[0087.608] lstrlenW (lpString=".dbf") returned 4
	[0087.608] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0087.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64
	[0087.608] lstrlenW (lpString=".1cd") returned 4
	[0087.608] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0087.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64
	[0087.608] lstrlenW (lpString=".jpg") returned 4
	[0087.608] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0087.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64
	[0087.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64
	[0087.608] lstrlenW (lpString=".doc") returned 4
	[0087.608] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0087.608] lstrlenW (lpString=".docx") returned 5
	[0087.608] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1
	[0087.609] lstrlenW (lpString=".pdf") returned 4
	[0087.609] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0087.609] lstrlenW (lpString=".xls") returned 4
	[0087.609] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0087.609] lstrlenW (lpString=".xlsx") returned 5
	[0087.609] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1
	[0087.609] lstrlenW (lpString=".ppt") returned 4
	[0087.609] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0087.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64
	[0087.609] lstrlenW (lpString=".zip") returned 4
	[0087.609] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0087.609] lstrlenW (lpString=".rar") returned 4
	[0087.609] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0087.609] lstrlenW (lpString=".bz2") returned 4
	[0087.609] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0087.609] lstrlenW (lpString=".7z") returned 3
	[0087.609] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0087.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64
	[0087.609] lstrlenW (lpString=".dbf") returned 4
	[0087.609] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0087.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64
	[0087.609] lstrlenW (lpString=".1cd") returned 4
	[0087.609] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0087.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64
	[0087.609] lstrlenW (lpString=".jpg") returned 4
	[0087.609] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0087.610] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0087.610] lstrlenW (lpString="msitss55.dll") returned 12
	[0087.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.616] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=430080) returned 1
	[0087.616] CloseHandle (hObject=0x1ac) returned 1
	[0087.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20
	[0087.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.617] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.617] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0087.617] GetLastError () returned 0x0
	[0087.617] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x69000, lpOverlapped=0x0) returned 1
	[0087.632] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x69010, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x69010, lpOverlapped=0x0) returned 1
	[0087.644] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.644] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0087.644] SetEndOfFile (hFile=0x19c) returned 1
	[0087.644] CloseHandle (hObject=0x19c) returned 1
	[0087.644] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.644] SetEndOfFile (hFile=0x1ac) returned 1
	[0087.649] CloseHandle (hObject=0x1ac) returned 1
	[0087.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0087.650] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1
	[0087.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64
	[0087.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64
	[0087.650] lstrlenW (lpString=".doc") returned 4
	[0087.650] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.650] lstrlenW (lpString=".docx") returned 5
	[0087.650] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0087.650] lstrlenW (lpString=".pdf") returned 4
	[0087.650] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.650] lstrlenW (lpString=".xls") returned 4
	[0087.650] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.650] lstrlenW (lpString=".xlsx") returned 5
	[0087.651] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0087.651] lstrlenW (lpString=".ppt") returned 4
	[0087.651] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64
	[0087.651] lstrlenW (lpString=".zip") returned 4
	[0087.651] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.651] lstrlenW (lpString=".rar") returned 4
	[0087.651] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.651] lstrlenW (lpString=".bz2") returned 4
	[0087.651] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.651] lstrlenW (lpString=".7z") returned 3
	[0087.651] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64
	[0087.651] lstrlenW (lpString=".dbf") returned 4
	[0087.651] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64
	[0087.651] lstrlenW (lpString=".1cd") returned 4
	[0087.651] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64
	[0087.651] lstrlenW (lpString=".jpg") returned 4
	[0087.651] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64
	[0087.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64
	[0087.651] lstrlenW (lpString=".doc") returned 4
	[0087.651] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.652] lstrlenW (lpString=".docx") returned 5
	[0087.652] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0087.652] lstrlenW (lpString=".pdf") returned 4
	[0087.652] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.652] lstrlenW (lpString=".xls") returned 4
	[0087.652] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.652] lstrlenW (lpString=".xlsx") returned 5
	[0087.652] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0087.652] lstrlenW (lpString=".ppt") returned 4
	[0087.652] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64
	[0087.652] lstrlenW (lpString=".zip") returned 4
	[0087.652] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.652] lstrlenW (lpString=".rar") returned 4
	[0087.652] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.652] lstrlenW (lpString=".bz2") returned 4
	[0087.652] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.652] lstrlenW (lpString=".7z") returned 3
	[0087.652] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64
	[0087.652] lstrlenW (lpString=".dbf") returned 4
	[0087.652] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64
	[0087.652] lstrlenW (lpString=".1cd") returned 4
	[0087.652] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64
	[0087.653] lstrlenW (lpString=".jpg") returned 4
	[0087.653] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.653] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0087.653] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0087.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.659] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=3584) returned 1
	[0087.659] CloseHandle (hObject=0x1ac) returned 1
	[0087.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20
	[0087.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0087.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0087.660] lstrlenW (lpString=".doc") returned 4
	[0087.660] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.660] lstrlenW (lpString=".docx") returned 5
	[0087.660] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.660] lstrlenW (lpString=".pdf") returned 4
	[0087.660] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.660] lstrlenW (lpString=".xls") returned 4
	[0087.660] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.660] lstrlenW (lpString=".xlsx") returned 5
	[0087.660] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.660] lstrlenW (lpString=".ppt") returned 4
	[0087.660] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0087.660] lstrlenW (lpString=".zip") returned 4
	[0087.660] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.660] lstrlenW (lpString=".rar") returned 4
	[0087.660] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.660] lstrlenW (lpString=".bz2") returned 4
	[0087.660] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.660] lstrlenW (lpString=".7z") returned 3
	[0087.660] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0087.661] lstrlenW (lpString=".dbf") returned 4
	[0087.661] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0087.661] lstrlenW (lpString=".1cd") returned 4
	[0087.661] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0087.661] lstrlenW (lpString=".jpg") returned 4
	[0087.661] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0087.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0087.661] lstrlenW (lpString=".doc") returned 4
	[0087.661] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.661] lstrlenW (lpString=".docx") returned 5
	[0087.661] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.661] lstrlenW (lpString=".pdf") returned 4
	[0087.661] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.661] lstrlenW (lpString=".xls") returned 4
	[0087.661] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.661] lstrlenW (lpString=".xlsx") returned 5
	[0087.661] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.661] lstrlenW (lpString=".ppt") returned 4
	[0087.661] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0087.661] lstrlenW (lpString=".zip") returned 4
	[0087.662] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.662] lstrlenW (lpString=".rar") returned 4
	[0087.662] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.662] lstrlenW (lpString=".bz2") returned 4
	[0087.662] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.662] lstrlenW (lpString=".7z") returned 3
	[0087.662] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0087.662] lstrlenW (lpString=".dbf") returned 4
	[0087.662] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0087.662] lstrlenW (lpString=".1cd") returned 4
	[0087.662] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0087.662] lstrlenW (lpString=".jpg") returned 4
	[0087.662] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.662] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0087.662] lstrlenW (lpString="ConvertInkStore.exe") returned 19
	[0087.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.663] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=193024) returned 1
	[0087.663] CloseHandle (hObject=0x1ac) returned 1
	[0087.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20
	[0087.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70
	[0087.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70
	[0087.664] lstrlenW (lpString=".doc") returned 4
	[0087.664] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.664] lstrlenW (lpString=".docx") returned 5
	[0087.664] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0087.664] lstrlenW (lpString=".pdf") returned 4
	[0087.664] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.664] lstrlenW (lpString=".xls") returned 4
	[0087.664] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.664] lstrlenW (lpString=".xlsx") returned 5
	[0087.664] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0087.664] lstrlenW (lpString=".ppt") returned 4
	[0087.664] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70
	[0087.664] lstrlenW (lpString=".zip") returned 4
	[0087.664] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.664] lstrlenW (lpString=".rar") returned 4
	[0087.665] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.665] lstrlenW (lpString=".bz2") returned 4
	[0087.665] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.665] lstrlenW (lpString=".7z") returned 3
	[0087.665] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70
	[0087.665] lstrlenW (lpString=".dbf") returned 4
	[0087.665] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70
	[0087.665] lstrlenW (lpString=".1cd") returned 4
	[0087.665] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70
	[0087.665] lstrlenW (lpString=".jpg") returned 4
	[0087.665] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70
	[0087.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70
	[0087.665] lstrlenW (lpString=".doc") returned 4
	[0087.665] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.665] lstrlenW (lpString=".docx") returned 5
	[0087.665] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0087.665] lstrlenW (lpString=".pdf") returned 4
	[0087.665] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.665] lstrlenW (lpString=".xls") returned 4
	[0087.665] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.665] lstrlenW (lpString=".xlsx") returned 5
	[0087.666] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0087.666] lstrlenW (lpString=".ppt") returned 4
	[0087.666] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70
	[0087.666] lstrlenW (lpString=".zip") returned 4
	[0087.666] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.666] lstrlenW (lpString=".rar") returned 4
	[0087.666] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.666] lstrlenW (lpString=".bz2") returned 4
	[0087.666] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.666] lstrlenW (lpString=".7z") returned 3
	[0087.666] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70
	[0087.666] lstrlenW (lpString=".dbf") returned 4
	[0087.666] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70
	[0087.666] lstrlenW (lpString=".1cd") returned 4
	[0087.666] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70
	[0087.666] lstrlenW (lpString=".jpg") returned 4
	[0087.666] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.666] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0087.667] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0087.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.667] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=3584) returned 1
	[0087.667] CloseHandle (hObject=0x1ac) returned 1
	[0087.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20
	[0087.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0087.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0087.670] lstrlenW (lpString=".doc") returned 4
	[0087.670] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.670] lstrlenW (lpString=".docx") returned 5
	[0087.670] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.670] lstrlenW (lpString=".pdf") returned 4
	[0087.670] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.670] lstrlenW (lpString=".xls") returned 4
	[0087.670] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.670] lstrlenW (lpString=".xlsx") returned 5
	[0087.670] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.670] lstrlenW (lpString=".ppt") returned 4
	[0087.670] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0087.670] lstrlenW (lpString=".zip") returned 4
	[0087.670] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.670] lstrlenW (lpString=".rar") returned 4
	[0087.670] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.670] lstrlenW (lpString=".bz2") returned 4
	[0087.671] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.671] lstrlenW (lpString=".7z") returned 3
	[0087.671] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0087.671] lstrlenW (lpString=".dbf") returned 4
	[0087.671] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0087.671] lstrlenW (lpString=".1cd") returned 4
	[0087.671] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0087.671] lstrlenW (lpString=".jpg") returned 4
	[0087.671] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0087.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0087.673] lstrlenW (lpString=".doc") returned 4
	[0087.673] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.673] lstrlenW (lpString=".docx") returned 5
	[0087.673] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.673] lstrlenW (lpString=".pdf") returned 4
	[0087.673] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.673] lstrlenW (lpString=".xls") returned 4
	[0087.673] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.673] lstrlenW (lpString=".xlsx") returned 5
	[0087.673] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.673] lstrlenW (lpString=".ppt") returned 4
	[0087.673] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0087.673] lstrlenW (lpString=".zip") returned 4
	[0087.673] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.673] lstrlenW (lpString=".rar") returned 4
	[0087.674] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.674] lstrlenW (lpString=".bz2") returned 4
	[0087.674] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.674] lstrlenW (lpString=".7z") returned 3
	[0087.674] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0087.674] lstrlenW (lpString=".dbf") returned 4
	[0087.674] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0087.674] lstrlenW (lpString=".1cd") returned 4
	[0087.674] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0087.674] lstrlenW (lpString=".jpg") returned 4
	[0087.674] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.674] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0087.675] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0087.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.675] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=3584) returned 1
	[0087.675] CloseHandle (hObject=0x1ac) returned 1
	[0087.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20
	[0087.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0087.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0087.676] lstrlenW (lpString=".doc") returned 4
	[0087.676] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.676] lstrlenW (lpString=".docx") returned 5
	[0087.676] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.676] lstrlenW (lpString=".pdf") returned 4
	[0087.676] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.676] lstrlenW (lpString=".xls") returned 4
	[0087.676] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.676] lstrlenW (lpString=".xlsx") returned 5
	[0087.677] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.677] lstrlenW (lpString=".ppt") returned 4
	[0087.677] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0087.677] lstrlenW (lpString=".zip") returned 4
	[0087.677] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.677] lstrlenW (lpString=".rar") returned 4
	[0087.677] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.677] lstrlenW (lpString=".bz2") returned 4
	[0087.677] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.677] lstrlenW (lpString=".7z") returned 3
	[0087.677] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0087.677] lstrlenW (lpString=".dbf") returned 4
	[0087.677] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0087.677] lstrlenW (lpString=".1cd") returned 4
	[0087.677] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0087.677] lstrlenW (lpString=".jpg") returned 4
	[0087.677] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0087.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0087.678] lstrlenW (lpString=".doc") returned 4
	[0087.678] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.678] lstrlenW (lpString=".docx") returned 5
	[0087.678] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.678] lstrlenW (lpString=".pdf") returned 4
	[0087.678] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.678] lstrlenW (lpString=".xls") returned 4
	[0087.678] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.678] lstrlenW (lpString=".xlsx") returned 5
	[0087.678] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.678] lstrlenW (lpString=".ppt") returned 4
	[0087.678] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0087.678] lstrlenW (lpString=".zip") returned 4
	[0087.678] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.678] lstrlenW (lpString=".rar") returned 4
	[0087.678] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.678] lstrlenW (lpString=".bz2") returned 4
	[0087.678] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.678] lstrlenW (lpString=".7z") returned 3
	[0087.678] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0087.678] lstrlenW (lpString=".dbf") returned 4
	[0087.678] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0087.678] lstrlenW (lpString=".1cd") returned 4
	[0087.679] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0087.679] lstrlenW (lpString=".jpg") returned 4
	[0087.679] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.679] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0087.679] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0087.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0087.686] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=4096) returned 1
	[0087.687] CloseHandle (hObject=0x1ac) returned 1
	[0087.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20
	[0087.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0087.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0087.687] lstrlenW (lpString=".doc") returned 4
	[0087.688] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.688] lstrlenW (lpString=".docx") returned 5
	[0087.688] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.688] lstrlenW (lpString=".pdf") returned 4
	[0087.688] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.688] lstrlenW (lpString=".xls") returned 4
	[0087.688] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.688] lstrlenW (lpString=".xlsx") returned 5
	[0087.688] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.688] lstrlenW (lpString=".ppt") returned 4
	[0087.688] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0087.688] lstrlenW (lpString=".zip") returned 4
	[0087.688] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.688] lstrlenW (lpString=".rar") returned 4
	[0087.688] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.688] lstrlenW (lpString=".bz2") returned 4
	[0087.688] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.688] lstrlenW (lpString=".7z") returned 3
	[0087.689] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0087.689] lstrlenW (lpString=".dbf") returned 4
	[0087.689] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0087.689] lstrlenW (lpString=".1cd") returned 4
	[0087.689] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0087.689] lstrlenW (lpString=".jpg") returned 4
	[0087.689] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0087.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0087.689] lstrlenW (lpString=".doc") returned 4
	[0087.689] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.689] lstrlenW (lpString=".docx") returned 5
	[0087.689] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0087.689] lstrlenW (lpString=".pdf") returned 4
	[0087.689] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.689] lstrlenW (lpString=".xls") returned 4
	[0087.689] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.689] lstrlenW (lpString=".xlsx") returned 5
	[0087.689] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0087.689] lstrlenW (lpString=".ppt") returned 4
	[0087.689] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0087.689] lstrlenW (lpString=".zip") returned 4
	[0087.690] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.690] lstrlenW (lpString=".rar") returned 4
	[0087.690] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.690] lstrlenW (lpString=".bz2") returned 4
	[0087.690] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.690] lstrlenW (lpString=".7z") returned 3
	[0087.690] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0087.690] lstrlenW (lpString=".dbf") returned 4
	[0087.690] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0087.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0087.690] lstrlenW (lpString=".1cd") returned 4
	[0087.690] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0087.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0087.690] lstrlenW (lpString=".jpg") returned 4
	[0087.690] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0087.690] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0087.690] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27
	[0087.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0087.704] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=8704) returned 1
	[0087.704] CloseHandle (hObject=0x19c) returned 1
	[0087.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20
	[0087.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0087.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0087.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0087.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0087.762] lstrlenW (lpString=".doc") returned 4
	[0087.762] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0087.762] lstrlenW (lpString=".docx") returned 5
	[0087.762] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0087.762] lstrlenW (lpString=".pdf") returned 4
	[0087.762] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0087.762] lstrlenW (lpString=".xls") returned 4
	[0087.762] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0087.762] lstrlenW (lpString=".xlsx") returned 5
	[0087.762] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0087.762] lstrlenW (lpString=".ppt") returned 4
	[0087.762] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0087.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0087.762] lstrlenW (lpString=".zip") returned 4
	[0087.762] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0087.763] lstrlenW (lpString=".rar") returned 4
	[0087.763] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0087.763] lstrlenW (lpString=".bz2") returned 4
	[0087.763] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0087.763] lstrlenW (lpString=".7z") returned 3
	[0087.763] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0087.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0087.763] lstrlenW (lpString=".dbf") returned 4
	[0087.763] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.978] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.978] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0088.979] GetLastError () returned 0x0
	[0088.979] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x665a0, lpOverlapped=0x0) returned 1
	[0088.993] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x665b0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x665b0, lpOverlapped=0x0) returned 1
	[0089.001] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.001] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0089.002] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.002] CloseHandle (hObject=0x1b0) returned 1
	[0089.002] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.002] SetEndOfFile (hFile=0x160) returned 1
	[0089.006] CloseHandle (hObject=0x160) returned 1
	[0089.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.006] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1
	[0089.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72
	[0089.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72
	[0089.007] lstrlenW (lpString=".doc") returned 4
	[0089.007] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.007] lstrlenW (lpString=".docx") returned 5
	[0089.007] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1
	[0089.007] lstrlenW (lpString=".pdf") returned 4
	[0089.007] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.007] lstrlenW (lpString=".xls") returned 4
	[0089.007] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.007] lstrlenW (lpString=".xlsx") returned 5
	[0089.007] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1
	[0089.007] lstrlenW (lpString=".ppt") returned 4
	[0089.007] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72
	[0089.007] lstrlenW (lpString=".zip") returned 4
	[0089.007] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.007] lstrlenW (lpString=".rar") returned 4
	[0089.007] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.007] lstrlenW (lpString=".bz2") returned 4
	[0089.007] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.007] lstrlenW (lpString=".7z") returned 3
	[0089.007] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72
	[0089.007] lstrlenW (lpString=".dbf") returned 4
	[0089.007] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72
	[0089.008] lstrlenW (lpString=".1cd") returned 4
	[0089.008] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72
	[0089.008] lstrlenW (lpString=".jpg") returned 4
	[0089.008] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72
	[0089.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72
	[0089.008] lstrlenW (lpString=".doc") returned 4
	[0089.008] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.008] lstrlenW (lpString=".docx") returned 5
	[0089.008] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1
	[0089.008] lstrlenW (lpString=".pdf") returned 4
	[0089.008] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.008] lstrlenW (lpString=".xls") returned 4
	[0089.008] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.008] lstrlenW (lpString=".xlsx") returned 5
	[0089.008] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1
	[0089.008] lstrlenW (lpString=".ppt") returned 4
	[0089.008] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72
	[0089.008] lstrlenW (lpString=".zip") returned 4
	[0089.008] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.008] lstrlenW (lpString=".rar") returned 4
	[0089.008] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.008] lstrlenW (lpString=".bz2") returned 4
	[0089.008] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.008] lstrlenW (lpString=".7z") returned 3
	[0089.008] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72
	[0089.008] lstrlenW (lpString=".dbf") returned 4
	[0089.008] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72
	[0089.009] lstrlenW (lpString=".1cd") returned 4
	[0089.009] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72
	[0089.009] lstrlenW (lpString=".jpg") returned 4
	[0089.009] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.009] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0089.009] lstrlenW (lpString="msinfo32.exe.mui") returned 16
	[0089.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.009] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=26624) returned 1
	[0089.009] CloseHandle (hObject=0x160) returned 1
	[0089.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20
	[0089.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0089.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76
	[0089.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76
	[0089.010] lstrlenW (lpString=".doc") returned 4
	[0089.010] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0089.010] lstrlenW (lpString=".docx") returned 5
	[0089.010] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0089.010] lstrlenW (lpString=".pdf") returned 4
	[0089.010] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0089.010] lstrlenW (lpString=".xls") returned 4
	[0089.010] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0089.010] lstrlenW (lpString=".xlsx") returned 5
	[0089.010] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0089.010] lstrlenW (lpString=".ppt") returned 4
	[0089.010] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0089.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76
	[0089.011] lstrlenW (lpString=".zip") returned 4
	[0089.011] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0089.011] lstrlenW (lpString=".rar") returned 4
	[0089.011] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0089.011] lstrlenW (lpString=".bz2") returned 4
	[0089.011] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0089.011] lstrlenW (lpString=".7z") returned 3
	[0089.011] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0089.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76
	[0089.011] lstrlenW (lpString=".dbf") returned 4
	[0089.011] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0089.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76
	[0089.011] lstrlenW (lpString=".1cd") returned 4
	[0089.011] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0089.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76
	[0089.011] lstrlenW (lpString=".jpg") returned 4
	[0089.011] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0089.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76
	[0089.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76
	[0089.011] lstrlenW (lpString=".doc") returned 4
	[0089.011] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0089.011] lstrlenW (lpString=".docx") returned 5
	[0089.011] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0089.011] lstrlenW (lpString=".pdf") returned 4
	[0089.011] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0089.011] lstrlenW (lpString=".xls") returned 4
	[0089.011] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0089.011] lstrlenW (lpString=".xlsx") returned 5
	[0089.012] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0089.012] lstrlenW (lpString=".ppt") returned 4
	[0089.012] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0089.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76
	[0089.012] lstrlenW (lpString=".zip") returned 4
	[0089.012] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0089.012] lstrlenW (lpString=".rar") returned 4
	[0089.012] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0089.012] lstrlenW (lpString=".bz2") returned 4
	[0089.012] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0089.012] lstrlenW (lpString=".7z") returned 3
	[0089.012] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0089.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76
	[0089.012] lstrlenW (lpString=".dbf") returned 4
	[0089.012] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0089.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76
	[0089.012] lstrlenW (lpString=".1cd") returned 4
	[0089.012] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0089.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76
	[0089.012] lstrlenW (lpString=".jpg") returned 4
	[0089.012] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0089.012] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0089.012] lstrlenW (lpString="msinfo32.exe") returned 12
	[0089.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.013] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=378880) returned 1
	[0089.013] CloseHandle (hObject=0x160) returned 1
	[0089.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20
	[0089.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0089.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66
	[0089.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66
	[0089.013] lstrlenW (lpString=".doc") returned 4
	[0089.013] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0089.014] lstrlenW (lpString=".docx") returned 5
	[0089.014] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1
	[0089.014] lstrlenW (lpString=".pdf") returned 4
	[0089.014] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0089.014] lstrlenW (lpString=".xls") returned 4
	[0089.014] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0089.014] lstrlenW (lpString=".xlsx") returned 5
	[0089.014] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1
	[0089.014] lstrlenW (lpString=".ppt") returned 4
	[0089.014] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0089.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66
	[0089.014] lstrlenW (lpString=".zip") returned 4
	[0089.014] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0089.014] lstrlenW (lpString=".rar") returned 4
	[0089.014] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0089.014] lstrlenW (lpString=".bz2") returned 4
	[0089.014] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0089.014] lstrlenW (lpString=".7z") returned 3
	[0089.014] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0089.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66
	[0089.014] lstrlenW (lpString=".dbf") returned 4
	[0089.014] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0089.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66
	[0089.014] lstrlenW (lpString=".1cd") returned 4
	[0089.014] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0089.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66
	[0089.014] lstrlenW (lpString=".jpg") returned 4
	[0089.014] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0089.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66
	[0089.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66
	[0089.014] lstrlenW (lpString=".doc") returned 4
	[0089.015] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0089.015] lstrlenW (lpString=".docx") returned 5
	[0089.015] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1
	[0089.015] lstrlenW (lpString=".pdf") returned 4
	[0089.015] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0089.015] lstrlenW (lpString=".xls") returned 4
	[0089.015] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0089.015] lstrlenW (lpString=".xlsx") returned 5
	[0089.015] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1
	[0089.015] lstrlenW (lpString=".ppt") returned 4
	[0089.015] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0089.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66
	[0089.015] lstrlenW (lpString=".zip") returned 4
	[0089.015] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0089.015] lstrlenW (lpString=".rar") returned 4
	[0089.015] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0089.015] lstrlenW (lpString=".bz2") returned 4
	[0089.015] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0089.015] lstrlenW (lpString=".7z") returned 3
	[0089.015] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0089.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66
	[0089.015] lstrlenW (lpString=".dbf") returned 4
	[0089.015] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0089.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66
	[0089.015] lstrlenW (lpString=".1cd") returned 4
	[0089.015] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0089.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66
	[0089.015] lstrlenW (lpString=".jpg") returned 4
	[0089.015] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0089.016] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.016] lstrlenW (lpString="ACEINTL.DLL") returned 11
	[0089.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.016] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=198056) returned 1
	[0089.016] CloseHandle (hObject=0x160) returned 1
	[0089.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20
	[0089.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.017] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.017] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.018] GetLastError () returned 0x0
	[0089.018] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x305a8, lpOverlapped=0x0) returned 1
	[0089.045] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x305b0, lpOverlapped=0x0) returned 1
	[0089.050] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.050] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.050] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.050] CloseHandle (hObject=0x1b0) returned 1
	[0089.050] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.051] SetEndOfFile (hFile=0x160) returned 1
	[0089.053] CloseHandle (hObject=0x160) returned 1
	[0089.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.053] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 1
	[0089.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0089.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0089.054] lstrlenW (lpString=".doc") returned 4
	[0089.054] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.054] lstrlenW (lpString=".docx") returned 5
	[0089.054] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0089.054] lstrlenW (lpString=".pdf") returned 4
	[0089.054] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.054] lstrlenW (lpString=".xls") returned 4
	[0089.054] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.054] lstrlenW (lpString=".xlsx") returned 5
	[0089.054] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0089.054] lstrlenW (lpString=".ppt") returned 4
	[0089.054] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0089.054] lstrlenW (lpString=".zip") returned 4
	[0089.054] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.054] lstrlenW (lpString=".rar") returned 4
	[0089.054] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.054] lstrlenW (lpString=".bz2") returned 4
	[0089.054] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.054] lstrlenW (lpString=".7z") returned 3
	[0089.055] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0089.055] lstrlenW (lpString=".dbf") returned 4
	[0089.055] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0089.055] lstrlenW (lpString=".1cd") returned 4
	[0089.055] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0089.055] lstrlenW (lpString=".jpg") returned 4
	[0089.055] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0089.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0089.055] lstrlenW (lpString=".doc") returned 4
	[0089.055] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.055] lstrlenW (lpString=".docx") returned 5
	[0089.055] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0089.055] lstrlenW (lpString=".pdf") returned 4
	[0089.055] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.055] lstrlenW (lpString=".xls") returned 4
	[0089.055] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.055] lstrlenW (lpString=".xlsx") returned 5
	[0089.055] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0089.055] lstrlenW (lpString=".ppt") returned 4
	[0089.055] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0089.056] lstrlenW (lpString=".zip") returned 4
	[0089.056] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.056] lstrlenW (lpString=".rar") returned 4
	[0089.056] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.056] lstrlenW (lpString=".bz2") returned 4
	[0089.056] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.056] lstrlenW (lpString=".7z") returned 3
	[0089.056] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0089.056] lstrlenW (lpString=".dbf") returned 4
	[0089.056] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0089.056] lstrlenW (lpString=".1cd") returned 4
	[0089.056] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0089.056] lstrlenW (lpString=".jpg") returned 4
	[0089.056] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.056] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.056] lstrlenW (lpString="ACEODBCI.DLL") returned 12
	[0089.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.057] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=52656) returned 1
	[0089.057] CloseHandle (hObject=0x160) returned 1
	[0089.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20
	[0089.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.058] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.058] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.059] GetLastError () returned 0x0
	[0089.059] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xcdb0, lpOverlapped=0x0) returned 1
	[0089.065] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xcdc0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xcdc0, lpOverlapped=0x0) returned 1
	[0089.067] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.067] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.067] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.067] CloseHandle (hObject=0x1b0) returned 1
	[0089.068] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.068] SetEndOfFile (hFile=0x160) returned 1
	[0089.069] CloseHandle (hObject=0x160) returned 1
	[0089.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.070] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1
	[0089.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0089.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0089.070] lstrlenW (lpString=".doc") returned 4
	[0089.070] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.070] lstrlenW (lpString=".docx") returned 5
	[0089.070] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0089.070] lstrlenW (lpString=".pdf") returned 4
	[0089.070] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.070] lstrlenW (lpString=".xls") returned 4
	[0089.070] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.070] lstrlenW (lpString=".xlsx") returned 5
	[0089.070] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0089.070] lstrlenW (lpString=".ppt") returned 4
	[0089.070] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0089.070] lstrlenW (lpString=".zip") returned 4
	[0089.070] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.070] lstrlenW (lpString=".rar") returned 4
	[0089.070] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.071] lstrlenW (lpString=".bz2") returned 4
	[0089.071] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.071] lstrlenW (lpString=".7z") returned 3
	[0089.071] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0089.071] lstrlenW (lpString=".dbf") returned 4
	[0089.071] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0089.071] lstrlenW (lpString=".1cd") returned 4
	[0089.071] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0089.071] lstrlenW (lpString=".jpg") returned 4
	[0089.071] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0089.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0089.071] lstrlenW (lpString=".doc") returned 4
	[0089.071] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.071] lstrlenW (lpString=".docx") returned 5
	[0089.071] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0089.071] lstrlenW (lpString=".pdf") returned 4
	[0089.071] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.071] lstrlenW (lpString=".xls") returned 4
	[0089.071] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.071] lstrlenW (lpString=".xlsx") returned 5
	[0089.071] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0089.071] lstrlenW (lpString=".ppt") returned 4
	[0089.072] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0089.072] lstrlenW (lpString=".zip") returned 4
	[0089.072] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.072] lstrlenW (lpString=".rar") returned 4
	[0089.072] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.072] lstrlenW (lpString=".bz2") returned 4
	[0089.072] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.072] lstrlenW (lpString=".7z") returned 3
	[0089.072] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0089.072] lstrlenW (lpString=".dbf") returned 4
	[0089.072] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0089.072] lstrlenW (lpString=".1cd") returned 4
	[0089.072] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0089.072] lstrlenW (lpString=".jpg") returned 4
	[0089.072] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.072] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.072] lstrlenW (lpString="ACERECR.DLL") returned 11
	[0089.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.073] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=20944) returned 1
	[0089.073] CloseHandle (hObject=0x160) returned 1
	[0089.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20
	[0089.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.074] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.075] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.075] GetLastError () returned 0x0
	[0089.076] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x51d0, lpOverlapped=0x0) returned 1
	[0089.082] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x51e0, lpOverlapped=0x0) returned 1
	[0089.083] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.083] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.083] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.083] CloseHandle (hObject=0x1b0) returned 1
	[0089.084] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.084] SetEndOfFile (hFile=0x160) returned 1
	[0089.085] CloseHandle (hObject=0x160) returned 1
	[0089.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.085] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 1
	[0089.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0089.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0089.086] lstrlenW (lpString=".doc") returned 4
	[0089.086] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.086] lstrlenW (lpString=".docx") returned 5
	[0089.086] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0089.086] lstrlenW (lpString=".pdf") returned 4
	[0089.086] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.086] lstrlenW (lpString=".xls") returned 4
	[0089.086] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.086] lstrlenW (lpString=".xlsx") returned 5
	[0089.086] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0089.086] lstrlenW (lpString=".ppt") returned 4
	[0089.086] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0089.086] lstrlenW (lpString=".zip") returned 4
	[0089.086] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.086] lstrlenW (lpString=".rar") returned 4
	[0089.086] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.086] lstrlenW (lpString=".bz2") returned 4
	[0089.086] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.086] lstrlenW (lpString=".7z") returned 3
	[0089.086] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0089.087] lstrlenW (lpString=".dbf") returned 4
	[0089.087] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0089.087] lstrlenW (lpString=".1cd") returned 4
	[0089.087] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0089.087] lstrlenW (lpString=".jpg") returned 4
	[0089.087] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0089.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0089.087] lstrlenW (lpString=".doc") returned 4
	[0089.087] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.087] lstrlenW (lpString=".docx") returned 5
	[0089.087] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0089.087] lstrlenW (lpString=".pdf") returned 4
	[0089.087] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.087] lstrlenW (lpString=".xls") returned 4
	[0089.087] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.087] lstrlenW (lpString=".xlsx") returned 5
	[0089.087] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0089.087] lstrlenW (lpString=".ppt") returned 4
	[0089.087] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0089.087] lstrlenW (lpString=".zip") returned 4
	[0089.087] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.088] lstrlenW (lpString=".rar") returned 4
	[0089.088] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.088] lstrlenW (lpString=".bz2") returned 4
	[0089.088] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.088] lstrlenW (lpString=".7z") returned 3
	[0089.088] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0089.088] lstrlenW (lpString=".dbf") returned 4
	[0089.088] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0089.088] lstrlenW (lpString=".1cd") returned 4
	[0089.088] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0089.088] lstrlenW (lpString=".jpg") returned 4
	[0089.088] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.088] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.088] lstrlenW (lpString="ACEWSTR.DLL") returned 11
	[0089.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.089] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=862608) returned 1
	[0089.089] CloseHandle (hObject=0x160) returned 1
	[0089.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20
	[0089.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.090] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.090] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.091] GetLastError () returned 0x0
	[0089.091] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xd2990, lpOverlapped=0x0) returned 1
	[0089.132] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xd29a0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xd29a0, lpOverlapped=0x0) returned 1
	[0089.162] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.162] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.163] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.163] CloseHandle (hObject=0x1b0) returned 1
	[0089.163] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.163] SetEndOfFile (hFile=0x160) returned 1
	[0089.171] CloseHandle (hObject=0x160) returned 1
	[0089.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.171] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 1
	[0089.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0089.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0089.171] lstrlenW (lpString=".doc") returned 4
	[0089.171] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.171] lstrlenW (lpString=".docx") returned 5
	[0089.171] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0089.172] lstrlenW (lpString=".pdf") returned 4
	[0089.172] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.172] lstrlenW (lpString=".xls") returned 4
	[0089.172] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.172] lstrlenW (lpString=".xlsx") returned 5
	[0089.172] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0089.172] lstrlenW (lpString=".ppt") returned 4
	[0089.172] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0089.172] lstrlenW (lpString=".zip") returned 4
	[0089.172] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.172] lstrlenW (lpString=".rar") returned 4
	[0089.172] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.172] lstrlenW (lpString=".bz2") returned 4
	[0089.172] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.172] lstrlenW (lpString=".7z") returned 3
	[0089.172] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0089.172] lstrlenW (lpString=".dbf") returned 4
	[0089.172] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0089.172] lstrlenW (lpString=".1cd") returned 4
	[0089.172] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0089.172] lstrlenW (lpString=".jpg") returned 4
	[0089.172] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0089.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0089.172] lstrlenW (lpString=".doc") returned 4
	[0089.172] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.172] lstrlenW (lpString=".docx") returned 5
	[0089.172] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0089.173] lstrlenW (lpString=".pdf") returned 4
	[0089.173] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.173] lstrlenW (lpString=".xls") returned 4
	[0089.173] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.173] lstrlenW (lpString=".xlsx") returned 5
	[0089.173] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0089.173] lstrlenW (lpString=".ppt") returned 4
	[0089.173] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0089.173] lstrlenW (lpString=".zip") returned 4
	[0089.173] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.173] lstrlenW (lpString=".rar") returned 4
	[0089.173] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.173] lstrlenW (lpString=".bz2") returned 4
	[0089.173] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.173] lstrlenW (lpString=".7z") returned 3
	[0089.173] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0089.173] lstrlenW (lpString=".dbf") returned 4
	[0089.173] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0089.173] lstrlenW (lpString=".1cd") returned 4
	[0089.173] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0089.173] lstrlenW (lpString=".jpg") returned 4
	[0089.173] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.173] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.173] lstrlenW (lpString="ALRTINTL.DLL") returned 12
	[0089.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.174] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=154448) returned 1
	[0089.174] CloseHandle (hObject=0x160) returned 1
	[0089.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20
	[0089.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.175] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.175] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0089.176] GetLastError () returned 0x0
	[0089.176] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x25b50, lpOverlapped=0x0) returned 1
	[0089.184] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x25b60, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x25b60, lpOverlapped=0x0) returned 1
	[0089.188] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.188] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.188] SetEndOfFile (hFile=0x1b0) returned 1
	[0089.191] CloseHandle (hObject=0x1b0) returned 1
	[0089.191] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.191] SetEndOfFile (hFile=0x160) returned 1
	[0089.193] CloseHandle (hObject=0x160) returned 1
	[0089.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.194] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 1
	[0089.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0089.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0089.194] lstrlenW (lpString=".doc") returned 4
	[0089.194] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.194] lstrlenW (lpString=".docx") returned 5
	[0089.194] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0089.194] lstrlenW (lpString=".pdf") returned 4
	[0089.194] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.194] lstrlenW (lpString=".xls") returned 4
	[0089.194] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.194] lstrlenW (lpString=".xlsx") returned 5
	[0089.194] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0089.194] lstrlenW (lpString=".ppt") returned 4
	[0089.194] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0089.194] lstrlenW (lpString=".zip") returned 4
	[0089.194] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.194] lstrlenW (lpString=".rar") returned 4
	[0089.194] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.194] lstrlenW (lpString=".bz2") returned 4
	[0089.194] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.194] lstrlenW (lpString=".7z") returned 3
	[0089.194] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0089.195] lstrlenW (lpString=".dbf") returned 4
	[0089.195] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0089.195] lstrlenW (lpString=".1cd") returned 4
	[0089.195] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0089.195] lstrlenW (lpString=".jpg") returned 4
	[0089.195] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0089.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0089.195] lstrlenW (lpString=".doc") returned 4
	[0089.195] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.195] lstrlenW (lpString=".docx") returned 5
	[0089.195] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0089.195] lstrlenW (lpString=".pdf") returned 4
	[0089.195] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.195] lstrlenW (lpString=".xls") returned 4
	[0089.195] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.195] lstrlenW (lpString=".xlsx") returned 5
	[0089.195] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0089.195] lstrlenW (lpString=".ppt") returned 4
	[0089.195] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0089.195] lstrlenW (lpString=".zip") returned 4
	[0089.195] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.195] lstrlenW (lpString=".rar") returned 4
	[0089.195] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.195] lstrlenW (lpString=".bz2") returned 4
	[0089.195] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.195] lstrlenW (lpString=".7z") returned 3
	[0089.195] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0089.196] lstrlenW (lpString=".dbf") returned 4
	[0089.196] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0089.196] lstrlenW (lpString=".1cd") returned 4
	[0089.196] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0089.196] lstrlenW (lpString=".jpg") returned 4
	[0089.196] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.196] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.196] lstrlenW (lpString="MSOINTL.DLL") returned 11
	[0089.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.197] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2528128) returned 1
	[0089.197] CloseHandle (hObject=0x160) returned 1
	[0089.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20
	[0089.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0089.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.198] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0089.199] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0089.199] ReadFile (in: hFile=0x160, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0089.217] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0089.217] ReadFile (in: hFile=0x160, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0089.232] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0089.232] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0089.232] ReadFile (in: hFile=0x160, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0089.267] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.267] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0089.288] SetEndOfFile (hFile=0x160) returned 1
	[0089.288] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x4001020
	[0089.292] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0089.292] WriteFile (in: hFile=0x160, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0089.294] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0089.294] WriteFile (in: hFile=0x160, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0089.300] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0089.300] WriteFile (in: hFile=0x160, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0089.306] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x4001020 | out: hHeap=0x5e0000) returned 1
	[0089.306] CloseHandle (hObject=0x160) returned 1
	[0089.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72
	[0089.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72
	[0089.306] lstrlenW (lpString=".doc") returned 4
	[0089.306] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.306] lstrlenW (lpString=".docx") returned 5
	[0089.306] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0089.306] lstrlenW (lpString=".pdf") returned 4
	[0089.306] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.306] lstrlenW (lpString=".xls") returned 4
	[0089.306] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.306] lstrlenW (lpString=".xlsx") returned 5
	[0089.307] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0089.307] lstrlenW (lpString=".ppt") returned 4
	[0089.307] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72
	[0089.307] lstrlenW (lpString=".zip") returned 4
	[0089.307] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.307] lstrlenW (lpString=".rar") returned 4
	[0089.307] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.307] lstrlenW (lpString=".bz2") returned 4
	[0089.307] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.307] lstrlenW (lpString=".7z") returned 3
	[0089.307] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72
	[0089.307] lstrlenW (lpString=".dbf") returned 4
	[0089.307] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72
	[0089.307] lstrlenW (lpString=".1cd") returned 4
	[0089.307] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72
	[0089.307] lstrlenW (lpString=".jpg") returned 4
	[0089.307] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72
	[0089.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72
	[0089.307] lstrlenW (lpString=".doc") returned 4
	[0089.307] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.307] lstrlenW (lpString=".docx") returned 5
	[0089.307] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0089.307] lstrlenW (lpString=".pdf") returned 4
	[0089.307] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.307] lstrlenW (lpString=".xls") returned 4
	[0089.307] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.307] lstrlenW (lpString=".xlsx") returned 5
	[0089.308] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0089.308] lstrlenW (lpString=".ppt") returned 4
	[0089.308] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72
	[0089.308] lstrlenW (lpString=".zip") returned 4
	[0089.308] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.308] lstrlenW (lpString=".rar") returned 4
	[0089.308] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.308] lstrlenW (lpString=".bz2") returned 4
	[0089.308] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.308] lstrlenW (lpString=".7z") returned 3
	[0089.308] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72
	[0089.308] lstrlenW (lpString=".dbf") returned 4
	[0089.308] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72
	[0089.308] lstrlenW (lpString=".1cd") returned 4
	[0089.308] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72
	[0089.308] lstrlenW (lpString=".jpg") returned 4
	[0089.308] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.308] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.308] lstrlenW (lpString="MSSOAPR3.DLL") returned 12
	[0089.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0089.356] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=41864) returned 1
	[0089.356] CloseHandle (hObject=0x184) returned 1
	[0089.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20
	[0089.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0089.356] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.356] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0089.357] GetLastError () returned 0x0
	[0089.357] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xa388, lpOverlapped=0x0) returned 1
	[0089.384] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xa390, lpOverlapped=0x0) returned 1
	[0089.386] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.386] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.386] SetEndOfFile (hFile=0x160) returned 1
	[0089.386] CloseHandle (hObject=0x160) returned 1
	[0089.387] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.387] SetEndOfFile (hFile=0x184) returned 1
	[0089.388] CloseHandle (hObject=0x184) returned 1
	[0089.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.388] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 1
	[0089.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73
	[0089.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73
	[0089.388] lstrlenW (lpString=".doc") returned 4
	[0089.388] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.389] lstrlenW (lpString=".docx") returned 5
	[0089.389] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1
	[0089.389] lstrlenW (lpString=".pdf") returned 4
	[0089.389] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.389] lstrlenW (lpString=".xls") returned 4
	[0089.389] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.389] lstrlenW (lpString=".xlsx") returned 5
	[0089.389] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1
	[0089.389] lstrlenW (lpString=".ppt") returned 4
	[0089.389] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73
	[0089.389] lstrlenW (lpString=".zip") returned 4
	[0089.389] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.389] lstrlenW (lpString=".rar") returned 4
	[0089.389] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.389] lstrlenW (lpString=".bz2") returned 4
	[0089.389] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.389] lstrlenW (lpString=".7z") returned 3
	[0089.389] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73
	[0089.389] lstrlenW (lpString=".dbf") returned 4
	[0089.389] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73
	[0089.389] lstrlenW (lpString=".1cd") returned 4
	[0089.389] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73
	[0089.389] lstrlenW (lpString=".jpg") returned 4
	[0089.389] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73
	[0089.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73
	[0089.389] lstrlenW (lpString=".doc") returned 4
	[0089.389] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.390] lstrlenW (lpString=".docx") returned 5
	[0089.390] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1
	[0089.390] lstrlenW (lpString=".pdf") returned 4
	[0089.390] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.390] lstrlenW (lpString=".xls") returned 4
	[0089.390] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.390] lstrlenW (lpString=".xlsx") returned 5
	[0089.390] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1
	[0089.390] lstrlenW (lpString=".ppt") returned 4
	[0089.390] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73
	[0089.390] lstrlenW (lpString=".zip") returned 4
	[0089.390] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.390] lstrlenW (lpString=".rar") returned 4
	[0089.390] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.390] lstrlenW (lpString=".bz2") returned 4
	[0089.390] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.390] lstrlenW (lpString=".7z") returned 3
	[0089.390] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73
	[0089.390] lstrlenW (lpString=".dbf") returned 4
	[0089.390] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73
	[0089.390] lstrlenW (lpString=".1cd") returned 4
	[0089.390] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73
	[0089.390] lstrlenW (lpString=".jpg") returned 4
	[0089.390] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.390] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.391] lstrlenW (lpString="OARPMANR.DLL") returned 12
	[0089.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0089.391] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=11656) returned 1
	[0089.391] CloseHandle (hObject=0x184) returned 1
	[0089.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20
	[0089.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0089.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0089.392] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.392] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0089.544] GetLastError () returned 0x0
	[0089.544] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x2d88, lpOverlapped=0x0) returned 1
	[0089.588] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2d90, lpOverlapped=0x0) returned 1
	[0089.589] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.589] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.589] SetEndOfFile (hFile=0x1bc) returned 1
	[0089.667] CloseHandle (hObject=0x1bc) returned 1
	[0089.727] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.727] SetEndOfFile (hFile=0x184) returned 1
	[0089.900] CloseHandle (hObject=0x184) returned 1
	[0089.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0089.968] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 1
	[0089.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73
	[0089.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73
	[0089.970] lstrlenW (lpString=".doc") returned 4
	[0089.970] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.970] lstrlenW (lpString=".docx") returned 5
	[0089.970] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0089.971] lstrlenW (lpString=".pdf") returned 4
	[0089.971] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.971] lstrlenW (lpString=".xls") returned 4
	[0089.971] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.971] lstrlenW (lpString=".xlsx") returned 5
	[0089.971] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0089.971] lstrlenW (lpString=".ppt") returned 4
	[0089.971] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73
	[0089.971] lstrlenW (lpString=".zip") returned 4
	[0089.971] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.971] lstrlenW (lpString=".rar") returned 4
	[0089.971] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.971] lstrlenW (lpString=".bz2") returned 4
	[0089.971] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.972] lstrlenW (lpString=".7z") returned 3
	[0089.972] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73
	[0089.972] lstrlenW (lpString=".dbf") returned 4
	[0089.972] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73
	[0089.972] lstrlenW (lpString=".1cd") returned 4
	[0089.972] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73
	[0089.972] lstrlenW (lpString=".jpg") returned 4
	[0089.972] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73
	[0089.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73
	[0089.973] lstrlenW (lpString=".doc") returned 4
	[0089.973] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0089.973] lstrlenW (lpString=".docx") returned 5
	[0089.973] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0089.973] lstrlenW (lpString=".pdf") returned 4
	[0089.973] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0089.973] lstrlenW (lpString=".xls") returned 4
	[0089.973] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0089.973] lstrlenW (lpString=".xlsx") returned 5
	[0089.973] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0089.973] lstrlenW (lpString=".ppt") returned 4
	[0089.973] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0089.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73
	[0089.973] lstrlenW (lpString=".zip") returned 4
	[0089.973] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0089.973] lstrlenW (lpString=".rar") returned 4
	[0089.973] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0089.973] lstrlenW (lpString=".bz2") returned 4
	[0089.973] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0089.973] lstrlenW (lpString=".7z") returned 3
	[0089.973] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0089.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73
	[0089.973] lstrlenW (lpString=".dbf") returned 4
	[0089.973] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0089.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73
	[0089.974] lstrlenW (lpString=".1cd") returned 4
	[0089.974] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0089.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73
	[0089.974] lstrlenW (lpString=".jpg") returned 4
	[0089.974] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0089.974] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0089.974] lstrlenW (lpString="ACERCLR.DLL") returned 11
	[0089.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.091] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=55744) returned 1
	[0090.091] CloseHandle (hObject=0x1ac) returned 1
	[0090.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 0x20
	[0090.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0090.324] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.324] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0090.458] GetLastError () returned 0x0
	[0090.458] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xd9c0, lpOverlapped=0x0) returned 1
	[0090.468] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xd9d0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xd9d0, lpOverlapped=0x0) returned 1
	[0090.470] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.470] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0090.470] SetEndOfFile (hFile=0x1b4) returned 1
	[0090.497] CloseHandle (hObject=0x1b4) returned 1
	[0090.498] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.498] SetEndOfFile (hFile=0x188) returned 1
	[0090.527] CloseHandle (hObject=0x188) returned 1
	[0090.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.533] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 1
	[0090.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67
	[0090.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67
	[0090.547] lstrlenW (lpString=".doc") returned 4
	[0090.547] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0090.547] lstrlenW (lpString=".docx") returned 5
	[0090.547] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0090.547] lstrlenW (lpString=".pdf") returned 4
	[0090.547] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0090.547] lstrlenW (lpString=".xls") returned 4
	[0090.547] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0090.547] lstrlenW (lpString=".xlsx") returned 5
	[0090.547] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0090.547] lstrlenW (lpString=".ppt") returned 4
	[0090.547] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0090.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67
	[0090.547] lstrlenW (lpString=".zip") returned 4
	[0090.547] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0090.547] lstrlenW (lpString=".rar") returned 4
	[0090.548] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0090.548] lstrlenW (lpString=".bz2") returned 4
	[0090.548] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0090.548] lstrlenW (lpString=".7z") returned 3
	[0090.548] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0090.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67
	[0090.548] lstrlenW (lpString=".dbf") returned 4
	[0090.548] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0090.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67
	[0090.548] lstrlenW (lpString=".1cd") returned 4
	[0090.548] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0090.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67
	[0090.548] lstrlenW (lpString=".jpg") returned 4
	[0090.548] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0090.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67
	[0090.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67
	[0090.548] lstrlenW (lpString=".doc") returned 4
	[0090.548] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0090.548] lstrlenW (lpString=".docx") returned 5
	[0090.548] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0090.548] lstrlenW (lpString=".pdf") returned 4
	[0090.548] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0090.548] lstrlenW (lpString=".xls") returned 4
	[0090.548] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0090.548] lstrlenW (lpString=".xlsx") returned 5
	[0090.548] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0090.549] lstrlenW (lpString=".ppt") returned 4
	[0090.549] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0090.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67
	[0090.549] lstrlenW (lpString=".zip") returned 4
	[0090.549] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0090.549] lstrlenW (lpString=".rar") returned 4
	[0090.549] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0090.549] lstrlenW (lpString=".bz2") returned 4
	[0090.549] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0090.549] lstrlenW (lpString=".7z") returned 3
	[0090.549] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0090.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67
	[0090.549] lstrlenW (lpString=".dbf") returned 4
	[0090.549] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0090.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67
	[0090.549] lstrlenW (lpString=".1cd") returned 4
	[0090.549] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0090.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67
	[0090.549] lstrlenW (lpString=".jpg") returned 4
	[0090.549] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0090.549] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0090.550] lstrlenW (lpString="ACEWSS.DLL") returned 10
	[0090.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0090.633] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=318368) returned 1
	[0090.633] CloseHandle (hObject=0x19c) returned 1
	[0090.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 0x20
	[0090.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0090.675] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.675] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0090.699] GetLastError () returned 0x0
	[0090.699] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x4dba0, lpOverlapped=0x0) returned 1
	[0090.790] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4dbb0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x4dbb0, lpOverlapped=0x0) returned 1
	[0090.800] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.800] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0090.800] SetEndOfFile (hFile=0x174) returned 1
	[0090.800] CloseHandle (hObject=0x174) returned 1
	[0090.801] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.801] SetEndOfFile (hFile=0x198) returned 1
	[0090.806] CloseHandle (hObject=0x198) returned 1
	[0090.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0090.806] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 1
	[0090.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66
	[0090.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66
	[0090.807] lstrlenW (lpString=".doc") returned 4
	[0090.807] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0090.807] lstrlenW (lpString=".docx") returned 5
	[0090.807] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0090.807] lstrlenW (lpString=".pdf") returned 4
	[0090.807] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0090.807] lstrlenW (lpString=".xls") returned 4
	[0090.807] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0090.807] lstrlenW (lpString=".xlsx") returned 5
	[0090.807] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0090.807] lstrlenW (lpString=".ppt") returned 4
	[0090.807] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0090.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66
	[0090.807] lstrlenW (lpString=".zip") returned 4
	[0090.807] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0090.807] lstrlenW (lpString=".rar") returned 4
	[0090.807] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0090.807] lstrlenW (lpString=".bz2") returned 4
	[0090.807] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0090.808] lstrlenW (lpString=".7z") returned 3
	[0090.808] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0090.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66
	[0090.808] lstrlenW (lpString=".dbf") returned 4
	[0090.808] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0090.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66
	[0090.808] lstrlenW (lpString=".1cd") returned 4
	[0090.808] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0090.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66
	[0090.808] lstrlenW (lpString=".jpg") returned 4
	[0090.808] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0090.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66
	[0090.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66
	[0090.808] lstrlenW (lpString=".doc") returned 4
	[0090.808] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0090.808] lstrlenW (lpString=".docx") returned 5
	[0090.808] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0090.808] lstrlenW (lpString=".pdf") returned 4
	[0090.808] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0090.808] lstrlenW (lpString=".xls") returned 4
	[0090.808] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0090.808] lstrlenW (lpString=".xlsx") returned 5
	[0090.808] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0090.808] lstrlenW (lpString=".ppt") returned 4
	[0090.808] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0090.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66
	[0090.809] lstrlenW (lpString=".zip") returned 4
	[0090.809] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0090.809] lstrlenW (lpString=".rar") returned 4
	[0090.809] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0090.809] lstrlenW (lpString=".bz2") returned 4
	[0090.809] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0090.809] lstrlenW (lpString=".7z") returned 3
	[0090.809] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0090.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66
	[0090.809] lstrlenW (lpString=".dbf") returned 4
	[0090.809] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0090.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66
	[0090.809] lstrlenW (lpString=".1cd") returned 4
	[0090.809] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0090.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66
	[0090.809] lstrlenW (lpString=".jpg") returned 4
	[0090.809] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0090.809] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0090.809] lstrlenW (lpString="ATLCONV.DLL") returned 11
	[0090.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0090.946] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=385368) returned 1
	[0090.946] CloseHandle (hObject=0x190) returned 1
	[0090.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 0x20
	[0090.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0090.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0090.968] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.968] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0090.971] GetLastError () returned 0x0
	[0090.971] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x5e158, lpOverlapped=0x0) returned 1
	[0091.630] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x5e160, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x5e160, lpOverlapped=0x0) returned 1
	[0091.639] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.639] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0091.639] SetEndOfFile (hFile=0x174) returned 1
	[0091.640] CloseHandle (hObject=0x174) returned 1
	[0091.640] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.640] SetEndOfFile (hFile=0x1b8) returned 1
	[0091.646] CloseHandle (hObject=0x1b8) returned 1
	[0091.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0091.646] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 1
	[0091.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67
	[0091.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67
	[0091.647] lstrlenW (lpString=".doc") returned 4
	[0091.647] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0091.647] lstrlenW (lpString=".docx") returned 5
	[0091.647] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1
	[0091.647] lstrlenW (lpString=".pdf") returned 4
	[0091.647] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0091.647] lstrlenW (lpString=".xls") returned 4
	[0091.647] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0091.647] lstrlenW (lpString=".xlsx") returned 5
	[0091.647] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1
	[0091.647] lstrlenW (lpString=".ppt") returned 4
	[0091.647] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0091.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67
	[0091.647] lstrlenW (lpString=".zip") returned 4
	[0091.647] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0091.648] lstrlenW (lpString=".rar") returned 4
	[0091.648] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0091.648] lstrlenW (lpString=".bz2") returned 4
	[0091.648] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0091.648] lstrlenW (lpString=".7z") returned 3
	[0091.648] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0091.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67
	[0091.648] lstrlenW (lpString=".dbf") returned 4
	[0091.648] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0091.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67
	[0091.648] lstrlenW (lpString=".1cd") returned 4
	[0091.648] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0091.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67
	[0091.648] lstrlenW (lpString=".jpg") returned 4
	[0091.648] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0091.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67
	[0091.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67
	[0091.648] lstrlenW (lpString=".doc") returned 4
	[0091.648] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0091.648] lstrlenW (lpString=".docx") returned 5
	[0091.648] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1
	[0091.648] lstrlenW (lpString=".pdf") returned 4
	[0091.649] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0091.649] lstrlenW (lpString=".xls") returned 4
	[0091.649] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0091.649] lstrlenW (lpString=".xlsx") returned 5
	[0091.649] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1
	[0091.649] lstrlenW (lpString=".ppt") returned 4
	[0091.649] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0091.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67
	[0091.649] lstrlenW (lpString=".zip") returned 4
	[0091.649] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0091.649] lstrlenW (lpString=".rar") returned 4
	[0091.649] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0091.649] lstrlenW (lpString=".bz2") returned 4
	[0091.649] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0091.649] lstrlenW (lpString=".7z") returned 3
	[0091.649] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0091.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67
	[0091.649] lstrlenW (lpString=".dbf") returned 4
	[0091.649] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0091.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67
	[0091.649] lstrlenW (lpString=".1cd") returned 4
	[0091.649] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0091.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67
	[0091.650] lstrlenW (lpString=".jpg") returned 4
	[0091.650] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0091.650] lstrcmpiW (lpString1=".EXE", lpString2=".adobe") returned 1
	[0091.650] lstrlenW (lpString="FLTLDR.EXE") returned 10
	[0091.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0091.784] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=157024) returned 1
	[0091.784] CloseHandle (hObject=0x1c0) returned 1
	[0091.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 0x20
	[0091.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0091.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0091.917] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.917] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0092.009] GetLastError () returned 0x0
	[0092.009] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x26560, lpOverlapped=0x0) returned 1
	[0092.019] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x26570, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x26570, lpOverlapped=0x0) returned 1
	[0092.023] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.023] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0092.024] SetEndOfFile (hFile=0x174) returned 1
	[0092.030] CloseHandle (hObject=0x174) returned 1
	[0092.032] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.032] SetEndOfFile (hFile=0x1b8) returned 1
	[0092.036] CloseHandle (hObject=0x1b8) returned 1
	[0092.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.049] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 1
	[0092.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66
	[0092.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66
	[0092.050] lstrlenW (lpString=".doc") returned 4
	[0092.050] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0092.050] lstrlenW (lpString=".docx") returned 5
	[0092.050] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1
	[0092.050] lstrlenW (lpString=".pdf") returned 4
	[0092.050] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0092.051] lstrlenW (lpString=".xls") returned 4
	[0092.051] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0092.051] lstrlenW (lpString=".xlsx") returned 5
	[0092.051] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1
	[0092.051] lstrlenW (lpString=".ppt") returned 4
	[0092.051] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0092.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66
	[0092.051] lstrlenW (lpString=".zip") returned 4
	[0092.051] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0092.051] lstrlenW (lpString=".rar") returned 4
	[0092.051] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0092.051] lstrlenW (lpString=".bz2") returned 4
	[0092.051] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0092.051] lstrlenW (lpString=".7z") returned 3
	[0092.051] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0092.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66
	[0092.051] lstrlenW (lpString=".dbf") returned 4
	[0092.051] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0092.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66
	[0092.051] lstrlenW (lpString=".1cd") returned 4
	[0092.052] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0092.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66
	[0092.052] lstrlenW (lpString=".jpg") returned 4
	[0092.052] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0092.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66
	[0092.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66
	[0092.052] lstrlenW (lpString=".doc") returned 4
	[0092.052] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0092.052] lstrlenW (lpString=".docx") returned 5
	[0092.052] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1
	[0092.052] lstrlenW (lpString=".pdf") returned 4
	[0092.052] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0092.052] lstrlenW (lpString=".xls") returned 4
	[0092.052] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0092.052] lstrlenW (lpString=".xlsx") returned 5
	[0092.052] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1
	[0092.052] lstrlenW (lpString=".ppt") returned 4
	[0092.052] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0092.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66
	[0092.052] lstrlenW (lpString=".zip") returned 4
	[0092.053] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0092.053] lstrlenW (lpString=".rar") returned 4
	[0092.053] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0092.053] lstrlenW (lpString=".bz2") returned 4
	[0092.053] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0092.053] lstrlenW (lpString=".7z") returned 3
	[0092.053] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0092.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66
	[0092.053] lstrlenW (lpString=".dbf") returned 4
	[0092.053] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0092.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66
	[0092.053] lstrlenW (lpString=".1cd") returned 4
	[0092.053] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0092.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66
	[0092.053] lstrlenW (lpString=".jpg") returned 4
	[0092.053] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0092.053] lstrcmpiW (lpString1=".EXE", lpString2=".adobe") returned 1
	[0092.053] lstrlenW (lpString="MSOICONS.EXE") returned 12
	[0092.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0092.137] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=473952) returned 1
	[0092.137] CloseHandle (hObject=0x174) returned 1
	[0092.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 0x20
	[0092.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0092.282] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.282] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0092.308] GetLastError () returned 0x0
	[0092.308] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x73b60, lpOverlapped=0x0) returned 1
	[0092.406] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x73b70, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x73b70, lpOverlapped=0x0) returned 1
	[0092.416] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.416] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0092.416] SetEndOfFile (hFile=0x1b0) returned 1
	[0092.416] CloseHandle (hObject=0x1b0) returned 1
	[0092.416] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.416] SetEndOfFile (hFile=0x178) returned 1
	[0092.420] CloseHandle (hObject=0x178) returned 1
	[0092.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.421] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 1
	[0092.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68
	[0092.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68
	[0092.421] lstrlenW (lpString=".doc") returned 4
	[0092.421] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0092.421] lstrlenW (lpString=".docx") returned 5
	[0092.421] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1
	[0092.421] lstrlenW (lpString=".pdf") returned 4
	[0092.421] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0092.421] lstrlenW (lpString=".xls") returned 4
	[0092.421] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0092.421] lstrlenW (lpString=".xlsx") returned 5
	[0092.421] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1
	[0092.421] lstrlenW (lpString=".ppt") returned 4
	[0092.421] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0092.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68
	[0092.422] lstrlenW (lpString=".zip") returned 4
	[0092.422] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0092.422] lstrlenW (lpString=".rar") returned 4
	[0092.422] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0092.422] lstrlenW (lpString=".bz2") returned 4
	[0092.422] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0092.422] lstrlenW (lpString=".7z") returned 3
	[0092.422] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0092.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68
	[0092.422] lstrlenW (lpString=".dbf") returned 4
	[0092.422] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0092.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68
	[0092.422] lstrlenW (lpString=".1cd") returned 4
	[0092.422] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0092.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68
	[0092.422] lstrlenW (lpString=".jpg") returned 4
	[0092.422] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0092.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68
	[0092.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68
	[0092.422] lstrlenW (lpString=".doc") returned 4
	[0092.422] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0092.422] lstrlenW (lpString=".docx") returned 5
	[0092.422] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1
	[0092.422] lstrlenW (lpString=".pdf") returned 4
	[0092.422] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0092.422] lstrlenW (lpString=".xls") returned 4
	[0092.422] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0092.422] lstrlenW (lpString=".xlsx") returned 5
	[0092.422] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1
	[0092.422] lstrlenW (lpString=".ppt") returned 4
	[0092.422] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0092.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68
	[0092.422] lstrlenW (lpString=".zip") returned 4
	[0092.423] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0092.423] lstrlenW (lpString=".rar") returned 4
	[0092.423] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0092.423] lstrlenW (lpString=".bz2") returned 4
	[0092.423] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0092.423] lstrlenW (lpString=".7z") returned 3
	[0092.423] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0092.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68
	[0092.423] lstrlenW (lpString=".dbf") returned 4
	[0092.423] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0092.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68
	[0092.423] lstrlenW (lpString=".1cd") returned 4
	[0092.423] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0092.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68
	[0092.423] lstrlenW (lpString=".jpg") returned 4
	[0092.423] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0092.423] lstrcmpiW (lpString1=".EXE", lpString2=".adobe") returned 1
	[0092.423] lstrlenW (lpString="MSOXMLED.EXE") returned 12
	[0092.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0092.424] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=121168) returned 1
	[0092.424] CloseHandle (hObject=0x178) returned 1
	[0092.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 0x20
	[0092.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0092.425] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.425] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0092.425] GetLastError () returned 0x0
	[0092.425] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1d950, lpOverlapped=0x0) returned 1
	[0092.432] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1d960, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1d960, lpOverlapped=0x0) returned 1
	[0092.434] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.434] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0092.434] SetEndOfFile (hFile=0x1b0) returned 1
	[0092.434] CloseHandle (hObject=0x1b0) returned 1
	[0092.435] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.435] SetEndOfFile (hFile=0x178) returned 1
	[0092.437] CloseHandle (hObject=0x178) returned 1
	[0092.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.437] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 1
	[0092.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68
	[0092.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68
	[0092.437] lstrlenW (lpString=".doc") returned 4
	[0092.437] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0092.437] lstrlenW (lpString=".docx") returned 5
	[0092.437] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1
	[0092.437] lstrlenW (lpString=".pdf") returned 4
	[0092.437] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0092.437] lstrlenW (lpString=".xls") returned 4
	[0092.437] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0092.438] lstrlenW (lpString=".xlsx") returned 5
	[0092.438] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1
	[0092.438] lstrlenW (lpString=".ppt") returned 4
	[0092.438] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0092.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68
	[0092.438] lstrlenW (lpString=".zip") returned 4
	[0092.438] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0092.438] lstrlenW (lpString=".rar") returned 4
	[0092.438] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0092.438] lstrlenW (lpString=".bz2") returned 4
	[0092.438] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0092.438] lstrlenW (lpString=".7z") returned 3
	[0092.438] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0092.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68
	[0092.438] lstrlenW (lpString=".dbf") returned 4
	[0092.438] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0092.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68
	[0092.438] lstrlenW (lpString=".1cd") returned 4
	[0092.438] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0092.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68
	[0092.438] lstrlenW (lpString=".jpg") returned 4
	[0092.438] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0092.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68
	[0092.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68
	[0092.439] lstrlenW (lpString=".doc") returned 4
	[0092.439] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0092.439] lstrlenW (lpString=".docx") returned 5
	[0092.439] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1
	[0092.439] lstrlenW (lpString=".pdf") returned 4
	[0092.439] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0092.439] lstrlenW (lpString=".xls") returned 4
	[0092.439] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0092.439] lstrlenW (lpString=".xlsx") returned 5
	[0092.439] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1
	[0092.439] lstrlenW (lpString=".ppt") returned 4
	[0092.439] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0092.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68
	[0092.439] lstrlenW (lpString=".zip") returned 4
	[0092.439] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0092.439] lstrlenW (lpString=".rar") returned 4
	[0092.439] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0092.439] lstrlenW (lpString=".bz2") returned 4
	[0092.439] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0092.439] lstrlenW (lpString=".7z") returned 3
	[0092.439] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0092.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68
	[0092.439] lstrlenW (lpString=".dbf") returned 4
	[0092.440] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0092.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68
	[0092.440] lstrlenW (lpString=".1cd") returned 4
	[0092.440] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0092.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68
	[0092.440] lstrlenW (lpString=".jpg") returned 4
	[0092.440] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0092.440] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0092.440] lstrlenW (lpString="MSOXMLMF.DLL") returned 12
	[0092.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0092.441] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=56192) returned 1
	[0092.441] CloseHandle (hObject=0x178) returned 1
	[0092.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll")) returned 0x20
	[0092.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0092.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68
	[0092.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68
	[0092.441] lstrlenW (lpString=".doc") returned 4
	[0092.441] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.441] lstrlenW (lpString=".docx") returned 5
	[0092.441] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1
	[0092.441] lstrlenW (lpString=".pdf") returned 4
	[0092.441] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.441] lstrlenW (lpString=".xls") returned 4
	[0092.441] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.442] lstrlenW (lpString=".xlsx") returned 5
	[0092.442] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1
	[0092.442] lstrlenW (lpString=".ppt") returned 4
	[0092.442] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68
	[0092.442] lstrlenW (lpString=".zip") returned 4
	[0092.442] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.442] lstrlenW (lpString=".rar") returned 4
	[0092.442] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.442] lstrlenW (lpString=".bz2") returned 4
	[0092.442] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.442] lstrlenW (lpString=".7z") returned 3
	[0092.442] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68
	[0092.442] lstrlenW (lpString=".dbf") returned 4
	[0092.442] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68
	[0092.442] lstrlenW (lpString=".1cd") returned 4
	[0092.442] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68
	[0092.442] lstrlenW (lpString=".jpg") returned 4
	[0092.442] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68
	[0092.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68
	[0092.442] lstrlenW (lpString=".doc") returned 4
	[0092.442] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.442] lstrlenW (lpString=".docx") returned 5
	[0092.443] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1
	[0092.443] lstrlenW (lpString=".pdf") returned 4
	[0092.443] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.443] lstrlenW (lpString=".xls") returned 4
	[0092.443] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.443] lstrlenW (lpString=".xlsx") returned 5
	[0092.443] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1
	[0092.443] lstrlenW (lpString=".ppt") returned 4
	[0092.443] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68
	[0092.443] lstrlenW (lpString=".zip") returned 4
	[0092.443] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.443] lstrlenW (lpString=".rar") returned 4
	[0092.443] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.443] lstrlenW (lpString=".bz2") returned 4
	[0092.443] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.443] lstrlenW (lpString=".7z") returned 3
	[0092.443] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68
	[0092.443] lstrlenW (lpString=".dbf") returned 4
	[0092.443] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68
	[0092.443] lstrlenW (lpString=".1cd") returned 4
	[0092.443] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68
	[0092.443] lstrlenW (lpString=".jpg") returned 4
	[0092.443] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.444] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0092.444] lstrlenW (lpString="MSPTLS.DLL") returned 10
	[0092.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0092.444] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1198464) returned 1
	[0092.444] CloseHandle (hObject=0x178) returned 1
	[0092.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 0x20
	[0092.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0092.445] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.445] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0092.446] GetLastError () returned 0x0
	[0092.446] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0092.585] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0092.606] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x24990, lpOverlapped=0x0) returned 1
	[0092.700] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x249a0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x249a0, lpOverlapped=0x0) returned 1
	[0092.705] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.705] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0092.706] SetEndOfFile (hFile=0x1b0) returned 1
	[0092.711] CloseHandle (hObject=0x1b0) returned 1
	[0092.719] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.719] SetEndOfFile (hFile=0x178) returned 1
	[0092.723] CloseHandle (hObject=0x178) returned 1
	[0092.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.728] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 1
	[0092.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66
	[0092.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66
	[0092.736] lstrlenW (lpString=".doc") returned 4
	[0092.736] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.736] lstrlenW (lpString=".docx") returned 5
	[0092.736] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0092.736] lstrlenW (lpString=".pdf") returned 4
	[0092.736] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.736] lstrlenW (lpString=".xls") returned 4
	[0092.736] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.736] lstrlenW (lpString=".xlsx") returned 5
	[0092.736] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0092.736] lstrlenW (lpString=".ppt") returned 4
	[0092.736] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66
	[0092.736] lstrlenW (lpString=".zip") returned 4
	[0092.736] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.736] lstrlenW (lpString=".rar") returned 4
	[0092.736] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.736] lstrlenW (lpString=".bz2") returned 4
	[0092.736] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.736] lstrlenW (lpString=".7z") returned 3
	[0092.736] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66
	[0092.736] lstrlenW (lpString=".dbf") returned 4
	[0092.736] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66
	[0092.736] lstrlenW (lpString=".1cd") returned 4
	[0092.736] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66
	[0092.736] lstrlenW (lpString=".jpg") returned 4
	[0092.736] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66
	[0092.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66
	[0092.737] lstrlenW (lpString=".doc") returned 4
	[0092.737] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.737] lstrlenW (lpString=".docx") returned 5
	[0092.737] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0092.737] lstrlenW (lpString=".pdf") returned 4
	[0092.737] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.737] lstrlenW (lpString=".xls") returned 4
	[0092.737] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.737] lstrlenW (lpString=".xlsx") returned 5
	[0092.737] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0092.737] lstrlenW (lpString=".ppt") returned 4
	[0092.737] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66
	[0092.737] lstrlenW (lpString=".zip") returned 4
	[0092.737] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.737] lstrlenW (lpString=".rar") returned 4
	[0092.737] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.737] lstrlenW (lpString=".bz2") returned 4
	[0092.737] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.737] lstrlenW (lpString=".7z") returned 3
	[0092.737] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66
	[0092.737] lstrlenW (lpString=".dbf") returned 4
	[0092.737] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66
	[0092.737] lstrlenW (lpString=".1cd") returned 4
	[0092.737] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66
	[0092.737] lstrlenW (lpString=".jpg") returned 4
	[0092.737] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.738] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0092.738] lstrlenW (lpString="ODBCMON.DLL") returned 11
	[0092.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0092.752] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=30056) returned 1
	[0092.752] CloseHandle (hObject=0x190) returned 1
	[0092.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 0x20
	[0092.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0092.773] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.773] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0092.781] GetLastError () returned 0x0
	[0092.781] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x7568, lpOverlapped=0x0) returned 1
	[0092.791] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x7570, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x7570, lpOverlapped=0x0) returned 1
	[0092.793] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.793] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0092.793] SetEndOfFile (hFile=0x188) returned 1
	[0092.793] CloseHandle (hObject=0x188) returned 1
	[0092.793] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.793] SetEndOfFile (hFile=0x1c4) returned 1
	[0092.794] CloseHandle (hObject=0x1c4) returned 1
	[0092.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.794] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 1
	[0092.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67
	[0092.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67
	[0092.795] lstrlenW (lpString=".doc") returned 4
	[0092.795] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.795] lstrlenW (lpString=".docx") returned 5
	[0092.795] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1
	[0092.795] lstrlenW (lpString=".pdf") returned 4
	[0092.795] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.795] lstrlenW (lpString=".xls") returned 4
	[0092.795] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.795] lstrlenW (lpString=".xlsx") returned 5
	[0092.795] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1
	[0092.795] lstrlenW (lpString=".ppt") returned 4
	[0092.795] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67
	[0092.795] lstrlenW (lpString=".zip") returned 4
	[0092.795] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.795] lstrlenW (lpString=".rar") returned 4
	[0092.795] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.795] lstrlenW (lpString=".bz2") returned 4
	[0092.795] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.795] lstrlenW (lpString=".7z") returned 3
	[0092.795] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67
	[0092.795] lstrlenW (lpString=".dbf") returned 4
	[0092.795] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67
	[0092.795] lstrlenW (lpString=".1cd") returned 4
	[0092.796] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67
	[0092.796] lstrlenW (lpString=".jpg") returned 4
	[0092.796] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67
	[0092.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67
	[0092.796] lstrlenW (lpString=".doc") returned 4
	[0092.796] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.796] lstrlenW (lpString=".docx") returned 5
	[0092.796] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1
	[0092.796] lstrlenW (lpString=".pdf") returned 4
	[0092.796] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.796] lstrlenW (lpString=".xls") returned 4
	[0092.796] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.796] lstrlenW (lpString=".xlsx") returned 5
	[0092.796] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1
	[0092.796] lstrlenW (lpString=".ppt") returned 4
	[0092.796] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67
	[0092.796] lstrlenW (lpString=".zip") returned 4
	[0092.796] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.797] lstrlenW (lpString=".rar") returned 4
	[0092.797] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.797] lstrlenW (lpString=".bz2") returned 4
	[0092.797] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.797] lstrlenW (lpString=".7z") returned 3
	[0092.797] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67
	[0092.797] lstrlenW (lpString=".dbf") returned 4
	[0092.797] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67
	[0092.797] lstrlenW (lpString=".1cd") returned 4
	[0092.797] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67
	[0092.797] lstrlenW (lpString=".jpg") returned 4
	[0092.797] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.797] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0092.797] lstrlenW (lpString="BRANDING.DLL") returned 12
	[0092.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0092.882] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=15224) returned 1
	[0092.883] CloseHandle (hObject=0x1a4) returned 1
	[0092.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 0x20
	[0092.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0092.908] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.908] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0092.931] GetLastError () returned 0x0
	[0092.931] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x3b78, lpOverlapped=0x0) returned 1
	[0092.934] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x3b80, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x3b80, lpOverlapped=0x0) returned 1
	[0092.937] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.937] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0092.937] SetEndOfFile (hFile=0x198) returned 1
	[0092.940] CloseHandle (hObject=0x198) returned 1
	[0092.940] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.940] SetEndOfFile (hFile=0x1a4) returned 1
	[0092.941] CloseHandle (hObject=0x1a4) returned 1
	[0092.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.941] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 1
	[0092.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105
	[0092.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105
	[0092.942] lstrlenW (lpString=".doc") returned 4
	[0092.942] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.942] lstrlenW (lpString=".docx") returned 5
	[0092.942] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1
	[0092.942] lstrlenW (lpString=".pdf") returned 4
	[0092.942] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.942] lstrlenW (lpString=".xls") returned 4
	[0092.942] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.942] lstrlenW (lpString=".xlsx") returned 5
	[0092.942] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1
	[0092.942] lstrlenW (lpString=".ppt") returned 4
	[0092.942] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105
	[0092.943] lstrlenW (lpString=".zip") returned 4
	[0092.943] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.943] lstrlenW (lpString=".rar") returned 4
	[0092.943] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.943] lstrlenW (lpString=".bz2") returned 4
	[0092.943] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.943] lstrlenW (lpString=".7z") returned 3
	[0092.943] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105
	[0092.943] lstrlenW (lpString=".dbf") returned 4
	[0092.943] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105
	[0092.943] lstrlenW (lpString=".1cd") returned 4
	[0092.943] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105
	[0092.943] lstrlenW (lpString=".jpg") returned 4
	[0092.943] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105
	[0092.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105
	[0092.943] lstrlenW (lpString=".doc") returned 4
	[0092.943] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0092.943] lstrlenW (lpString=".docx") returned 5
	[0092.943] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1
	[0092.943] lstrlenW (lpString=".pdf") returned 4
	[0092.943] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0092.944] lstrlenW (lpString=".xls") returned 4
	[0092.944] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0092.944] lstrlenW (lpString=".xlsx") returned 5
	[0092.944] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1
	[0092.944] lstrlenW (lpString=".ppt") returned 4
	[0092.944] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0092.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105
	[0092.944] lstrlenW (lpString=".zip") returned 4
	[0092.944] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0092.944] lstrlenW (lpString=".rar") returned 4
	[0092.944] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0092.944] lstrlenW (lpString=".bz2") returned 4
	[0092.944] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0092.944] lstrlenW (lpString=".7z") returned 3
	[0092.944] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0092.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105
	[0092.944] lstrlenW (lpString=".dbf") returned 4
	[0092.944] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0092.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105
	[0092.944] lstrlenW (lpString=".1cd") returned 4
	[0092.944] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0092.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105
	[0092.944] lstrlenW (lpString=".jpg") returned 4
	[0092.944] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0092.945] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0092.945] lstrlenW (lpString="OSetupPS.dll") returned 12
	[0092.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0092.945] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=47520) returned 1
	[0092.945] CloseHandle (hObject=0x198) returned 1
	[0092.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 0x20
	[0092.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0092.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0092.946] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.946] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0092.946] GetLastError () returned 0x0
	[0092.947] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xb9a0, lpOverlapped=0x0) returned 1
	[0092.954] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xb9b0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xb9b0, lpOverlapped=0x0) returned 1
	[0092.957] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.957] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0092.957] SetEndOfFile (hFile=0x174) returned 1
	[0092.957] CloseHandle (hObject=0x174) returned 1
	[0092.958] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.958] SetEndOfFile (hFile=0x198) returned 1
	[0092.959] CloseHandle (hObject=0x198) returned 1
	[0092.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0092.959] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 1
	[0093.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92
	[0093.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92
	[0093.023] lstrlenW (lpString=".doc") returned 4
	[0093.023] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0093.023] lstrlenW (lpString=".docx") returned 5
	[0093.023] lstrcmpiW (lpString1=".docx", lpString2="S.dll") returned -1
	[0093.023] lstrlenW (lpString=".pdf") returned 4
	[0093.023] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0093.023] lstrlenW (lpString=".xls") returned 4
	[0093.023] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0093.023] lstrlenW (lpString=".xlsx") returned 5
	[0093.023] lstrcmpiW (lpString1=".xlsx", lpString2="S.dll") returned -1
	[0093.023] lstrlenW (lpString=".ppt") returned 4
	[0093.023] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0093.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92
	[0093.023] lstrlenW (lpString=".zip") returned 4
	[0093.023] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0093.024] lstrlenW (lpString=".rar") returned 4
	[0093.024] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0093.024] lstrlenW (lpString=".bz2") returned 4
	[0093.024] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0093.024] lstrlenW (lpString=".7z") returned 3
	[0093.024] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0093.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92
	[0093.024] lstrlenW (lpString=".dbf") returned 4
	[0093.024] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0093.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92
	[0093.024] lstrlenW (lpString=".1cd") returned 4
	[0093.024] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0093.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92
	[0093.024] lstrlenW (lpString=".jpg") returned 4
	[0093.024] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0093.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92
	[0093.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92
	[0093.024] lstrlenW (lpString=".doc") returned 4
	[0093.024] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0093.024] lstrlenW (lpString=".docx") returned 5
	[0093.024] lstrcmpiW (lpString1=".docx", lpString2="S.dll") returned -1
	[0093.024] lstrlenW (lpString=".pdf") returned 4
	[0093.024] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0093.024] lstrlenW (lpString=".xls") returned 4
	[0093.024] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0093.025] lstrlenW (lpString=".xlsx") returned 5
	[0093.025] lstrcmpiW (lpString1=".xlsx", lpString2="S.dll") returned -1
	[0093.025] lstrlenW (lpString=".ppt") returned 4
	[0093.025] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0093.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92
	[0093.025] lstrlenW (lpString=".zip") returned 4
	[0093.025] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0093.025] lstrlenW (lpString=".rar") returned 4
	[0093.025] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0093.025] lstrlenW (lpString=".bz2") returned 4
	[0093.025] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0093.025] lstrlenW (lpString=".7z") returned 3
	[0093.025] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0093.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92
	[0093.025] lstrlenW (lpString=".dbf") returned 4
	[0093.025] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0093.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92
	[0093.025] lstrlenW (lpString=".1cd") returned 4
	[0093.025] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0093.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92
	[0093.025] lstrlenW (lpString=".jpg") returned 4
	[0093.025] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0093.026] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0093.026] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24
	[0093.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.062] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=15736) returned 1
	[0093.062] CloseHandle (hObject=0x190) returned 1
	[0093.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20
	[0093.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.090] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.090] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0093.108] GetLastError () returned 0x0
	[0093.108] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x3d78, lpOverlapped=0x0) returned 1
	[0093.119] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x3d80, lpOverlapped=0x0) returned 1
	[0093.121] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.121] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x104, lpOverlapped=0x0) returned 1
	[0093.121] SetEndOfFile (hFile=0x1b4) returned 1
	[0093.121] CloseHandle (hObject=0x1b4) returned 1
	[0093.122] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.122] SetEndOfFile (hFile=0x190) returned 1
	[0093.123] CloseHandle (hObject=0x190) returned 1
	[0093.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.124] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 1
	[0093.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0093.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0093.124] lstrlenW (lpString=".doc") returned 4
	[0093.124] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0093.124] lstrlenW (lpString=".docx") returned 5
	[0093.124] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0093.124] lstrlenW (lpString=".pdf") returned 4
	[0093.124] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0093.124] lstrlenW (lpString=".xls") returned 4
	[0093.125] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0093.125] lstrlenW (lpString=".xlsx") returned 5
	[0093.125] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0093.125] lstrlenW (lpString=".ppt") returned 4
	[0093.125] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0093.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0093.125] lstrlenW (lpString=".zip") returned 4
	[0093.125] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0093.125] lstrlenW (lpString=".rar") returned 4
	[0093.125] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0093.125] lstrlenW (lpString=".bz2") returned 4
	[0093.125] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0093.125] lstrlenW (lpString=".7z") returned 3
	[0093.125] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0093.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0093.125] lstrlenW (lpString=".dbf") returned 4
	[0093.125] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0093.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0093.125] lstrlenW (lpString=".1cd") returned 4
	[0093.125] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0093.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0093.125] lstrlenW (lpString=".jpg") returned 4
	[0093.125] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0093.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0093.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0093.126] lstrlenW (lpString=".doc") returned 4
	[0093.126] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0093.126] lstrlenW (lpString=".docx") returned 5
	[0093.126] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0093.126] lstrlenW (lpString=".pdf") returned 4
	[0093.126] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0093.126] lstrlenW (lpString=".xls") returned 4
	[0093.126] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0093.126] lstrlenW (lpString=".xlsx") returned 5
	[0093.126] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0093.126] lstrlenW (lpString=".ppt") returned 4
	[0093.126] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0093.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0093.126] lstrlenW (lpString=".zip") returned 4
	[0093.126] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0093.126] lstrlenW (lpString=".rar") returned 4
	[0093.126] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0093.126] lstrlenW (lpString=".bz2") returned 4
	[0093.126] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0093.126] lstrlenW (lpString=".7z") returned 3
	[0093.126] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0093.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0093.126] lstrlenW (lpString=".dbf") returned 4
	[0093.126] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0093.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0093.126] lstrlenW (lpString=".1cd") returned 4
	[0093.126] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0093.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0093.126] lstrlenW (lpString=".jpg") returned 4
	[0093.126] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0093.127] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0093.127] lstrlenW (lpString="OFFREL.DLL") returned 10
	[0093.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.129] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=9568) returned 1
	[0093.129] CloseHandle (hObject=0x190) returned 1
	[0093.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 0x20
	[0093.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.130] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.130] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0093.130] GetLastError () returned 0x0
	[0093.130] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x2560, lpOverlapped=0x0) returned 1
	[0093.139] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2570, lpOverlapped=0x0) returned 1
	[0093.141] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.141] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0093.141] SetEndOfFile (hFile=0x1b4) returned 1
	[0093.141] CloseHandle (hObject=0x1b4) returned 1
	[0093.141] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.142] SetEndOfFile (hFile=0x190) returned 1
	[0093.142] CloseHandle (hObject=0x190) returned 1
	[0093.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.143] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 1
	[0093.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66
	[0093.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66
	[0093.143] lstrlenW (lpString=".doc") returned 4
	[0093.143] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.143] lstrlenW (lpString=".docx") returned 5
	[0093.143] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0093.143] lstrlenW (lpString=".pdf") returned 4
	[0093.143] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.143] lstrlenW (lpString=".xls") returned 4
	[0093.143] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.143] lstrlenW (lpString=".xlsx") returned 5
	[0093.143] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0093.143] lstrlenW (lpString=".ppt") returned 4
	[0093.143] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66
	[0093.143] lstrlenW (lpString=".zip") returned 4
	[0093.143] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.143] lstrlenW (lpString=".rar") returned 4
	[0093.143] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.143] lstrlenW (lpString=".bz2") returned 4
	[0093.144] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.144] lstrlenW (lpString=".7z") returned 3
	[0093.144] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66
	[0093.144] lstrlenW (lpString=".dbf") returned 4
	[0093.144] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66
	[0093.144] lstrlenW (lpString=".1cd") returned 4
	[0093.144] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66
	[0093.144] lstrlenW (lpString=".jpg") returned 4
	[0093.144] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66
	[0093.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66
	[0093.144] lstrlenW (lpString=".doc") returned 4
	[0093.144] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.144] lstrlenW (lpString=".docx") returned 5
	[0093.144] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0093.144] lstrlenW (lpString=".pdf") returned 4
	[0093.144] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.144] lstrlenW (lpString=".xls") returned 4
	[0093.144] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.144] lstrlenW (lpString=".xlsx") returned 5
	[0093.144] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0093.144] lstrlenW (lpString=".ppt") returned 4
	[0093.144] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66
	[0093.144] lstrlenW (lpString=".zip") returned 4
	[0093.144] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.144] lstrlenW (lpString=".rar") returned 4
	[0093.144] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.144] lstrlenW (lpString=".bz2") returned 4
	[0093.144] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.144] lstrlenW (lpString=".7z") returned 3
	[0093.145] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66
	[0093.145] lstrlenW (lpString=".dbf") returned 4
	[0093.145] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66
	[0093.145] lstrlenW (lpString=".1cd") returned 4
	[0093.145] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66
	[0093.145] lstrlenW (lpString=".jpg") returned 4
	[0093.145] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.145] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0093.145] lstrlenW (lpString="OPHPROXY.DLL") returned 12
	[0093.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.146] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=19848) returned 1
	[0093.146] CloseHandle (hObject=0x190) returned 1
	[0093.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 0x20
	[0093.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.147] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.147] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0093.147] GetLastError () returned 0x0
	[0093.147] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x4d88, lpOverlapped=0x0) returned 1
	[0093.469] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4d90, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x4d90, lpOverlapped=0x0) returned 1
	[0093.470] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.470] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0093.470] SetEndOfFile (hFile=0x1b4) returned 1
	[0093.470] CloseHandle (hObject=0x1b4) returned 1
	[0093.470] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.470] SetEndOfFile (hFile=0x190) returned 1
	[0093.474] CloseHandle (hObject=0x190) returned 1
	[0093.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.474] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 1
	[0093.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68
	[0093.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68
	[0093.475] lstrlenW (lpString=".doc") returned 4
	[0093.476] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.476] lstrlenW (lpString=".docx") returned 5
	[0093.476] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1
	[0093.476] lstrlenW (lpString=".pdf") returned 4
	[0093.476] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.476] lstrlenW (lpString=".xls") returned 4
	[0093.476] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.476] lstrlenW (lpString=".xlsx") returned 5
	[0093.476] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1
	[0093.476] lstrlenW (lpString=".ppt") returned 4
	[0093.476] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68
	[0093.476] lstrlenW (lpString=".zip") returned 4
	[0093.476] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.476] lstrlenW (lpString=".rar") returned 4
	[0093.476] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.476] lstrlenW (lpString=".bz2") returned 4
	[0093.476] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.476] lstrlenW (lpString=".7z") returned 3
	[0093.476] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68
	[0093.476] lstrlenW (lpString=".dbf") returned 4
	[0093.476] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68
	[0093.476] lstrlenW (lpString=".1cd") returned 4
	[0093.476] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68
	[0093.477] lstrlenW (lpString=".jpg") returned 4
	[0093.477] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68
	[0093.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68
	[0093.477] lstrlenW (lpString=".doc") returned 4
	[0093.477] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.477] lstrlenW (lpString=".docx") returned 5
	[0093.477] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1
	[0093.477] lstrlenW (lpString=".pdf") returned 4
	[0093.477] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.477] lstrlenW (lpString=".xls") returned 4
	[0093.477] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.477] lstrlenW (lpString=".xlsx") returned 5
	[0093.477] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1
	[0093.477] lstrlenW (lpString=".ppt") returned 4
	[0093.477] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68
	[0093.477] lstrlenW (lpString=".zip") returned 4
	[0093.477] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.477] lstrlenW (lpString=".rar") returned 4
	[0093.477] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.477] lstrlenW (lpString=".bz2") returned 4
	[0093.477] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.477] lstrlenW (lpString=".7z") returned 3
	[0093.477] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68
	[0093.477] lstrlenW (lpString=".dbf") returned 4
	[0093.477] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68
	[0093.477] lstrlenW (lpString=".1cd") returned 4
	[0093.477] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68
	[0093.477] lstrlenW (lpString=".jpg") returned 4
	[0093.478] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.478] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0093.478] lstrlenW (lpString="PJ11OD11.DLL") returned 12
	[0093.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0093.520] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=752552) returned 1
	[0093.520] CloseHandle (hObject=0x198) returned 1
	[0093.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 0x20
	[0093.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0093.527] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.527] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0093.537] GetLastError () returned 0x0
	[0093.537] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xb7ba8, lpOverlapped=0x0) returned 1
	[0093.579] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xb7bb0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xb7bb0, lpOverlapped=0x0) returned 1
	[0093.593] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.593] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0093.593] SetEndOfFile (hFile=0x188) returned 1
	[0093.621] CloseHandle (hObject=0x188) returned 1
	[0093.624] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.624] SetEndOfFile (hFile=0x1b8) returned 1
	[0093.635] CloseHandle (hObject=0x1b8) returned 1
	[0093.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.637] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 1
	[0093.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68
	[0093.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68
	[0093.645] lstrlenW (lpString=".doc") returned 4
	[0093.645] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.645] lstrlenW (lpString=".docx") returned 5
	[0093.645] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1
	[0093.645] lstrlenW (lpString=".pdf") returned 4
	[0093.645] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.645] lstrlenW (lpString=".xls") returned 4
	[0093.645] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.645] lstrlenW (lpString=".xlsx") returned 5
	[0093.645] lstrcmpiW (lpString1=".xlsx", lpString2="1.DLL") returned -1
	[0093.645] lstrlenW (lpString=".ppt") returned 4
	[0093.645] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68
	[0093.646] lstrlenW (lpString=".zip") returned 4
	[0093.646] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.646] lstrlenW (lpString=".rar") returned 4
	[0093.646] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.646] lstrlenW (lpString=".bz2") returned 4
	[0093.646] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.646] lstrlenW (lpString=".7z") returned 3
	[0093.646] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68
	[0093.646] lstrlenW (lpString=".dbf") returned 4
	[0093.646] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68
	[0093.646] lstrlenW (lpString=".1cd") returned 4
	[0093.646] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68
	[0093.646] lstrlenW (lpString=".jpg") returned 4
	[0093.646] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68
	[0093.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68
	[0093.646] lstrlenW (lpString=".doc") returned 4
	[0093.646] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.646] lstrlenW (lpString=".docx") returned 5
	[0093.646] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1
	[0093.646] lstrlenW (lpString=".pdf") returned 4
	[0093.646] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.646] lstrlenW (lpString=".xls") returned 4
	[0093.646] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.646] lstrlenW (lpString=".xlsx") returned 5
	[0093.646] lstrcmpiW (lpString1=".xlsx", lpString2="1.DLL") returned -1
	[0093.646] lstrlenW (lpString=".ppt") returned 4
	[0093.646] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68
	[0093.647] lstrlenW (lpString=".zip") returned 4
	[0093.647] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.647] lstrlenW (lpString=".rar") returned 4
	[0093.647] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.647] lstrlenW (lpString=".bz2") returned 4
	[0093.647] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.647] lstrlenW (lpString=".7z") returned 3
	[0093.647] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68
	[0093.647] lstrlenW (lpString=".dbf") returned 4
	[0093.647] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68
	[0093.647] lstrlenW (lpString=".1cd") returned 4
	[0093.647] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68
	[0093.647] lstrlenW (lpString=".jpg") returned 4
	[0093.647] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.647] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0093.647] lstrlenW (lpString="USP10.DLL") returned 9
	[0093.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0093.665] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=813824) returned 1
	[0093.665] CloseHandle (hObject=0x1a0) returned 1
	[0093.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll")) returned 0x20
	[0093.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.695] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.695] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0093.705] GetLastError () returned 0x0
	[0093.705] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xc6b00, lpOverlapped=0x0) returned 1
	[0093.732] WriteFile (in: hFile=0x1b8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc6b10, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xc6b10, lpOverlapped=0x0) returned 1
	[0093.750] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.750] WriteFile (in: hFile=0x1b8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0093.750] SetEndOfFile (hFile=0x1b8) returned 1
	[0093.750] CloseHandle (hObject=0x1b8) returned 1
	[0093.751] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.751] SetEndOfFile (hFile=0x190) returned 1
	[0093.758] CloseHandle (hObject=0x190) returned 1
	[0093.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.759] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll")) returned 1
	[0093.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65
	[0093.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65
	[0093.759] lstrlenW (lpString=".doc") returned 4
	[0093.759] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.759] lstrlenW (lpString=".docx") returned 5
	[0093.759] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0093.759] lstrlenW (lpString=".pdf") returned 4
	[0093.759] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.759] lstrlenW (lpString=".xls") returned 4
	[0093.759] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.759] lstrlenW (lpString=".xlsx") returned 5
	[0093.759] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0093.759] lstrlenW (lpString=".ppt") returned 4
	[0093.759] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65
	[0093.759] lstrlenW (lpString=".zip") returned 4
	[0093.759] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.759] lstrlenW (lpString=".rar") returned 4
	[0093.759] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.759] lstrlenW (lpString=".bz2") returned 4
	[0093.759] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.759] lstrlenW (lpString=".7z") returned 3
	[0093.760] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65
	[0093.760] lstrlenW (lpString=".dbf") returned 4
	[0093.760] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65
	[0093.760] lstrlenW (lpString=".1cd") returned 4
	[0093.760] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65
	[0093.760] lstrlenW (lpString=".jpg") returned 4
	[0093.760] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65
	[0093.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65
	[0093.760] lstrlenW (lpString=".doc") returned 4
	[0093.760] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.760] lstrlenW (lpString=".docx") returned 5
	[0093.760] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0093.760] lstrlenW (lpString=".pdf") returned 4
	[0093.760] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.760] lstrlenW (lpString=".xls") returned 4
	[0093.760] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.760] lstrlenW (lpString=".xlsx") returned 5
	[0093.760] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0093.760] lstrlenW (lpString=".ppt") returned 4
	[0093.760] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65
	[0093.761] lstrlenW (lpString=".zip") returned 4
	[0093.761] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.761] lstrlenW (lpString=".rar") returned 4
	[0093.761] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.761] lstrlenW (lpString=".bz2") returned 4
	[0093.761] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.761] lstrlenW (lpString=".7z") returned 3
	[0093.761] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65
	[0093.761] lstrlenW (lpString=".dbf") returned 4
	[0093.761] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65
	[0093.761] lstrlenW (lpString=".1cd") returned 4
	[0093.761] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65
	[0093.808] lstrlenW (lpString=".jpg") returned 4
	[0093.808] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.808] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0093.808] lstrlenW (lpString="OSPPC.DLL") returned 9
	[0093.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0093.810] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=148736) returned 1
	[0093.810] CloseHandle (hObject=0x184) returned 1
	[0093.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")) returned 0x20
	[0093.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0093.813] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.813] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0093.814] GetLastError () returned 0x0
	[0093.814] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x24500, lpOverlapped=0x0) returned 1
	[0093.873] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x24510, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x24510, lpOverlapped=0x0) returned 1
	[0093.877] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.877] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0093.877] SetEndOfFile (hFile=0x1a4) returned 1
	[0093.877] CloseHandle (hObject=0x1a4) returned 1
	[0093.878] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.878] SetEndOfFile (hFile=0x184) returned 1
	[0093.880] CloseHandle (hObject=0x184) returned 1
	[0093.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0093.880] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")) returned 1
	[0093.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89
	[0093.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89
	[0093.880] lstrlenW (lpString=".doc") returned 4
	[0093.880] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.880] lstrlenW (lpString=".docx") returned 5
	[0093.880] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1
	[0093.880] lstrlenW (lpString=".pdf") returned 4
	[0093.880] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.880] lstrlenW (lpString=".xls") returned 4
	[0093.880] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.881] lstrlenW (lpString=".xlsx") returned 5
	[0093.881] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1
	[0093.881] lstrlenW (lpString=".ppt") returned 4
	[0093.881] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89
	[0093.881] lstrlenW (lpString=".zip") returned 4
	[0093.881] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.881] lstrlenW (lpString=".rar") returned 4
	[0093.881] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.881] lstrlenW (lpString=".bz2") returned 4
	[0093.881] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.881] lstrlenW (lpString=".7z") returned 3
	[0093.881] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89
	[0093.881] lstrlenW (lpString=".dbf") returned 4
	[0093.881] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89
	[0093.881] lstrlenW (lpString=".1cd") returned 4
	[0093.881] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89
	[0093.881] lstrlenW (lpString=".jpg") returned 4
	[0093.881] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89
	[0093.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89
	[0093.881] lstrlenW (lpString=".doc") returned 4
	[0093.881] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0093.881] lstrlenW (lpString=".docx") returned 5
	[0093.881] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1
	[0093.881] lstrlenW (lpString=".pdf") returned 4
	[0093.881] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0093.881] lstrlenW (lpString=".xls") returned 4
	[0093.881] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0093.881] lstrlenW (lpString=".xlsx") returned 5
	[0093.882] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1
	[0093.882] lstrlenW (lpString=".ppt") returned 4
	[0093.882] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0093.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89
	[0093.882] lstrlenW (lpString=".zip") returned 4
	[0093.882] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0093.882] lstrlenW (lpString=".rar") returned 4
	[0093.882] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0093.882] lstrlenW (lpString=".bz2") returned 4
	[0093.882] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0093.882] lstrlenW (lpString=".7z") returned 3
	[0093.882] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0093.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89
	[0093.882] lstrlenW (lpString=".dbf") returned 4
	[0093.882] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0093.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89
	[0093.882] lstrlenW (lpString=".1cd") returned 4
	[0093.882] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0093.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89
	[0093.882] lstrlenW (lpString=".jpg") returned 4
	[0093.882] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0093.882] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0093.882] lstrlenW (lpString="OSPPCEXT.DLL") returned 12
	[0093.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0093.883] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1828608) returned 1
	[0093.883] CloseHandle (hObject=0x184) returned 1
	[0093.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll")) returned 0x20
	[0093.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0093.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0093.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0093.885] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0093.885] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.885] ReadFile (in: hFile=0x184, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0093.926] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x94d00, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.926] ReadFile (in: hFile=0x184, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0094.029] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.029] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x17e700, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0094.029] ReadFile (in: hFile=0x184, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0094.090] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.090] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0094.118] SetEndOfFile (hFile=0x184) returned 1
	[0094.118] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x4001020
	[0094.118] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0094.118] WriteFile (in: hFile=0x184, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0094.120] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x94d00, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0094.120] WriteFile (in: hFile=0x184, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0094.135] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x17e700, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0094.135] WriteFile (in: hFile=0x184, lpBuffer=0x4001020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4001020*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0094.137] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x4001020 | out: hHeap=0x5e0000) returned 1
	[0094.137] CloseHandle (hObject=0x184) returned 1
	[0094.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92
	[0094.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92
	[0094.138] lstrlenW (lpString=".doc") returned 4
	[0094.138] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.138] lstrlenW (lpString=".docx") returned 5
	[0094.138] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0094.138] lstrlenW (lpString=".pdf") returned 4
	[0094.138] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.138] lstrlenW (lpString=".xls") returned 4
	[0094.138] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.138] lstrlenW (lpString=".xlsx") returned 5
	[0094.138] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0094.138] lstrlenW (lpString=".ppt") returned 4
	[0094.138] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92
	[0094.138] lstrlenW (lpString=".zip") returned 4
	[0094.138] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.138] lstrlenW (lpString=".rar") returned 4
	[0094.138] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.138] lstrlenW (lpString=".bz2") returned 4
	[0094.138] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.138] lstrlenW (lpString=".7z") returned 3
	[0094.138] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92
	[0094.138] lstrlenW (lpString=".dbf") returned 4
	[0094.138] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92
	[0094.138] lstrlenW (lpString=".1cd") returned 4
	[0094.138] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92
	[0094.138] lstrlenW (lpString=".jpg") returned 4
	[0094.138] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92
	[0094.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92
	[0094.139] lstrlenW (lpString=".doc") returned 4
	[0094.139] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.139] lstrlenW (lpString=".docx") returned 5
	[0094.139] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0094.139] lstrlenW (lpString=".pdf") returned 4
	[0094.139] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.139] lstrlenW (lpString=".xls") returned 4
	[0094.139] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.139] lstrlenW (lpString=".xlsx") returned 5
	[0094.139] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0094.139] lstrlenW (lpString=".ppt") returned 4
	[0094.139] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92
	[0094.139] lstrlenW (lpString=".zip") returned 4
	[0094.139] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.139] lstrlenW (lpString=".rar") returned 4
	[0094.139] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.139] lstrlenW (lpString=".bz2") returned 4
	[0094.139] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.139] lstrlenW (lpString=".7z") returned 3
	[0094.139] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92
	[0094.139] lstrlenW (lpString=".dbf") returned 4
	[0094.139] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92
	[0094.139] lstrlenW (lpString=".1cd") returned 4
	[0094.139] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92
	[0094.139] lstrlenW (lpString=".jpg") returned 4
	[0094.139] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.140] lstrcmpiW (lpString1=".LEX", lpString2=".adobe") returned 1
	[0094.140] lstrlenW (lpString="MSWDS_ES.LEX") returned 12
	[0094.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0094.217] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=395651) returned 1
	[0094.217] CloseHandle (hObject=0x1c4) returned 1
	[0094.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 0x20
	[0094.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0094.248] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.248] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0094.297] GetLastError () returned 0x0
	[0094.297] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x60983, lpOverlapped=0x0) returned 1
	[0094.325] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x60990, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x60990, lpOverlapped=0x0) returned 1
	[0094.335] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.336] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0094.336] SetEndOfFile (hFile=0x198) returned 1
	[0094.336] CloseHandle (hObject=0x198) returned 1
	[0094.336] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.336] SetEndOfFile (hFile=0x188) returned 1
	[0094.341] CloseHandle (hObject=0x188) returned 1
	[0094.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.342] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 1
	[0094.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65
	[0094.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65
	[0094.342] lstrlenW (lpString=".doc") returned 4
	[0094.342] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1
	[0094.342] lstrlenW (lpString=".docx") returned 5
	[0094.342] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1
	[0094.342] lstrlenW (lpString=".pdf") returned 4
	[0094.342] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1
	[0094.342] lstrlenW (lpString=".xls") returned 4
	[0094.342] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1
	[0094.342] lstrlenW (lpString=".xlsx") returned 5
	[0094.342] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1
	[0094.342] lstrlenW (lpString=".ppt") returned 4
	[0094.342] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1
	[0094.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65
	[0094.342] lstrlenW (lpString=".zip") returned 4
	[0094.342] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1
	[0094.342] lstrlenW (lpString=".rar") returned 4
	[0094.342] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1
	[0094.342] lstrlenW (lpString=".bz2") returned 4
	[0094.342] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1
	[0094.343] lstrlenW (lpString=".7z") returned 3
	[0094.343] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1
	[0094.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65
	[0094.343] lstrlenW (lpString=".dbf") returned 4
	[0094.343] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1
	[0094.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65
	[0094.343] lstrlenW (lpString=".1cd") returned 4
	[0094.343] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1
	[0094.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65
	[0094.343] lstrlenW (lpString=".jpg") returned 4
	[0094.343] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1
	[0094.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65
	[0094.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65
	[0094.343] lstrlenW (lpString=".doc") returned 4
	[0094.343] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1
	[0094.343] lstrlenW (lpString=".docx") returned 5
	[0094.343] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1
	[0094.343] lstrlenW (lpString=".pdf") returned 4
	[0094.343] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1
	[0094.343] lstrlenW (lpString=".xls") returned 4
	[0094.343] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1
	[0094.343] lstrlenW (lpString=".xlsx") returned 5
	[0094.344] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1
	[0094.344] lstrlenW (lpString=".ppt") returned 4
	[0094.344] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1
	[0094.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65
	[0094.344] lstrlenW (lpString=".zip") returned 4
	[0094.344] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1
	[0094.344] lstrlenW (lpString=".rar") returned 4
	[0094.344] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1
	[0094.344] lstrlenW (lpString=".bz2") returned 4
	[0094.344] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1
	[0094.344] lstrlenW (lpString=".7z") returned 3
	[0094.344] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1
	[0094.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65
	[0094.344] lstrlenW (lpString=".dbf") returned 4
	[0094.344] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1
	[0094.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65
	[0094.344] lstrlenW (lpString=".1cd") returned 4
	[0094.344] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1
	[0094.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65
	[0094.344] lstrlenW (lpString=".jpg") returned 4
	[0094.344] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1
	[0094.344] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0094.344] lstrlenW (lpString="FBIBLIO.DLL") returned 11
	[0094.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0094.381] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=123776) returned 1
	[0094.381] CloseHandle (hObject=0x1b8) returned 1
	[0094.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll")) returned 0x20
	[0094.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0094.439] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.439] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0094.458] GetLastError () returned 0x0
	[0094.458] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1e380, lpOverlapped=0x0) returned 1
	[0094.464] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1e390, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1e390, lpOverlapped=0x0) returned 1
	[0094.467] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.467] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0094.467] SetEndOfFile (hFile=0x190) returned 1
	[0094.484] CloseHandle (hObject=0x190) returned 1
	[0094.490] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.490] SetEndOfFile (hFile=0x1b8) returned 1
	[0094.497] CloseHandle (hObject=0x1b8) returned 1
	[0094.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.506] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll")) returned 1
	[0094.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68
	[0094.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68
	[0094.507] lstrlenW (lpString=".doc") returned 4
	[0094.507] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.507] lstrlenW (lpString=".docx") returned 5
	[0094.507] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1
	[0094.507] lstrlenW (lpString=".pdf") returned 4
	[0094.507] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.507] lstrlenW (lpString=".xls") returned 4
	[0094.507] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.508] lstrlenW (lpString=".xlsx") returned 5
	[0094.508] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1
	[0094.508] lstrlenW (lpString=".ppt") returned 4
	[0094.508] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68
	[0094.508] lstrlenW (lpString=".zip") returned 4
	[0094.508] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.508] lstrlenW (lpString=".rar") returned 4
	[0094.508] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.508] lstrlenW (lpString=".bz2") returned 4
	[0094.508] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.508] lstrlenW (lpString=".7z") returned 3
	[0094.508] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68
	[0094.508] lstrlenW (lpString=".dbf") returned 4
	[0094.508] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68
	[0094.508] lstrlenW (lpString=".1cd") returned 4
	[0094.508] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68
	[0094.508] lstrlenW (lpString=".jpg") returned 4
	[0094.508] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68
	[0094.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68
	[0094.508] lstrlenW (lpString=".doc") returned 4
	[0094.508] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.509] lstrlenW (lpString=".docx") returned 5
	[0094.509] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1
	[0094.509] lstrlenW (lpString=".pdf") returned 4
	[0094.509] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.509] lstrlenW (lpString=".xls") returned 4
	[0094.509] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.509] lstrlenW (lpString=".xlsx") returned 5
	[0094.509] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1
	[0094.509] lstrlenW (lpString=".ppt") returned 4
	[0094.509] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68
	[0094.509] lstrlenW (lpString=".zip") returned 4
	[0094.509] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.509] lstrlenW (lpString=".rar") returned 4
	[0094.509] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.509] lstrlenW (lpString=".bz2") returned 4
	[0094.509] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.509] lstrlenW (lpString=".7z") returned 3
	[0094.509] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68
	[0094.509] lstrlenW (lpString=".dbf") returned 4
	[0094.509] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68
	[0094.509] lstrlenW (lpString=".1cd") returned 4
	[0094.509] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68
	[0094.509] lstrlenW (lpString=".jpg") returned 4
	[0094.509] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.510] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0094.510] lstrlenW (lpString="IMCONTACT.DLL") returned 13
	[0094.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0094.528] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=101248) returned 1
	[0094.528] CloseHandle (hObject=0x1b8) returned 1
	[0094.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll")) returned 0x20
	[0094.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0094.566] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.566] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0094.580] GetLastError () returned 0x0
	[0094.580] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x18b80, lpOverlapped=0x0) returned 1
	[0094.585] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x18b90, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x18b90, lpOverlapped=0x0) returned 1
	[0094.590] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.590] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xee, lpOverlapped=0x0) returned 1
	[0094.590] SetEndOfFile (hFile=0x1a0) returned 1
	[0094.593] CloseHandle (hObject=0x1a0) returned 1
	[0094.596] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.596] SetEndOfFile (hFile=0x1b8) returned 1
	[0094.603] CloseHandle (hObject=0x1b8) returned 1
	[0094.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.604] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll")) returned 1
	[0094.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70
	[0094.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70
	[0094.626] lstrlenW (lpString=".doc") returned 4
	[0094.626] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.626] lstrlenW (lpString=".docx") returned 5
	[0094.626] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0094.626] lstrlenW (lpString=".pdf") returned 4
	[0094.626] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.626] lstrlenW (lpString=".xls") returned 4
	[0094.626] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.626] lstrlenW (lpString=".xlsx") returned 5
	[0094.626] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0094.626] lstrlenW (lpString=".ppt") returned 4
	[0094.626] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70
	[0094.626] lstrlenW (lpString=".zip") returned 4
	[0094.626] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.626] lstrlenW (lpString=".rar") returned 4
	[0094.626] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.626] lstrlenW (lpString=".bz2") returned 4
	[0094.627] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.627] lstrlenW (lpString=".7z") returned 3
	[0094.627] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70
	[0094.627] lstrlenW (lpString=".dbf") returned 4
	[0094.627] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70
	[0094.627] lstrlenW (lpString=".1cd") returned 4
	[0094.627] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70
	[0094.627] lstrlenW (lpString=".jpg") returned 4
	[0094.627] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70
	[0094.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70
	[0094.627] lstrlenW (lpString=".doc") returned 4
	[0094.627] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.627] lstrlenW (lpString=".docx") returned 5
	[0094.627] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0094.627] lstrlenW (lpString=".pdf") returned 4
	[0094.627] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.627] lstrlenW (lpString=".xls") returned 4
	[0094.627] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.627] lstrlenW (lpString=".xlsx") returned 5
	[0094.627] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0094.627] lstrlenW (lpString=".ppt") returned 4
	[0094.627] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70
	[0094.628] lstrlenW (lpString=".zip") returned 4
	[0094.628] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.628] lstrlenW (lpString=".rar") returned 4
	[0094.628] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.628] lstrlenW (lpString=".bz2") returned 4
	[0094.628] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.628] lstrlenW (lpString=".7z") returned 3
	[0094.628] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70
	[0094.628] lstrlenW (lpString=".dbf") returned 4
	[0094.628] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70
	[0094.628] lstrlenW (lpString=".1cd") returned 4
	[0094.628] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70
	[0094.628] lstrlenW (lpString=".jpg") returned 4
	[0094.628] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.628] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0094.628] lstrlenW (lpString="MOFL.DLL") returned 8
	[0094.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0094.655] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=364928) returned 1
	[0094.656] CloseHandle (hObject=0x1c4) returned 1
	[0094.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll")) returned 0x20
	[0094.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0094.713] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.713] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0094.722] GetLastError () returned 0x0
	[0094.722] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x59180, lpOverlapped=0x0) returned 1
	[0094.861] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x59190, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x59190, lpOverlapped=0x0) returned 1
	[0094.870] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.870] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0094.871] SetEndOfFile (hFile=0x1c8) returned 1
	[0094.871] CloseHandle (hObject=0x1c8) returned 1
	[0094.871] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.871] SetEndOfFile (hFile=0x1c4) returned 1
	[0094.876] CloseHandle (hObject=0x1c4) returned 1
	[0094.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0094.876] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll")) returned 1
	[0094.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65
	[0094.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65
	[0094.877] lstrlenW (lpString=".doc") returned 4
	[0094.877] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.877] lstrlenW (lpString=".docx") returned 5
	[0094.877] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0094.877] lstrlenW (lpString=".pdf") returned 4
	[0094.877] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.877] lstrlenW (lpString=".xls") returned 4
	[0094.877] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.877] lstrlenW (lpString=".xlsx") returned 5
	[0094.877] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0094.877] lstrlenW (lpString=".ppt") returned 4
	[0094.877] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65
	[0094.877] lstrlenW (lpString=".zip") returned 4
	[0094.877] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.877] lstrlenW (lpString=".rar") returned 4
	[0094.877] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.877] lstrlenW (lpString=".bz2") returned 4
	[0094.877] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.877] lstrlenW (lpString=".7z") returned 3
	[0094.877] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65
	[0094.877] lstrlenW (lpString=".dbf") returned 4
	[0094.877] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65
	[0094.877] lstrlenW (lpString=".1cd") returned 4
	[0094.877] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65
	[0094.878] lstrlenW (lpString=".jpg") returned 4
	[0094.878] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65
	[0094.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65
	[0094.878] lstrlenW (lpString=".doc") returned 4
	[0094.878] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0094.878] lstrlenW (lpString=".docx") returned 5
	[0094.878] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0094.878] lstrlenW (lpString=".pdf") returned 4
	[0094.878] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0094.878] lstrlenW (lpString=".xls") returned 4
	[0094.878] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0094.878] lstrlenW (lpString=".xlsx") returned 5
	[0094.878] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0094.878] lstrlenW (lpString=".ppt") returned 4
	[0094.878] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0094.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65
	[0094.878] lstrlenW (lpString=".zip") returned 4
	[0094.878] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0094.878] lstrlenW (lpString=".rar") returned 4
	[0094.878] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0094.878] lstrlenW (lpString=".bz2") returned 4
	[0094.878] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0094.878] lstrlenW (lpString=".7z") returned 3
	[0094.879] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0094.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65
	[0094.879] lstrlenW (lpString=".dbf") returned 4
	[0094.879] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0094.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65
	[0094.879] lstrlenW (lpString=".1cd") returned 4
	[0094.879] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0094.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65
	[0094.879] lstrlenW (lpString=".jpg") returned 4
	[0094.879] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0094.879] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0094.879] lstrlenW (lpString="AFTRNOON.INF") returned 12
	[0094.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0094.954] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=555) returned 1
	[0094.954] CloseHandle (hObject=0x1a0) returned 1
	[0094.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf")) returned 0x20
	[0094.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0094.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0094.994] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.994] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0095.083] GetLastError () returned 0x0
	[0095.083] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x22b, lpOverlapped=0x0) returned 1
	[0095.085] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x230, lpOverlapped=0x0) returned 1
	[0095.086] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.086] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.086] SetEndOfFile (hFile=0x198) returned 1
	[0095.139] CloseHandle (hObject=0x198) returned 1
	[0095.177] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.177] SetEndOfFile (hFile=0x1a0) returned 1
	[0095.178] CloseHandle (hObject=0x1a0) returned 1
	[0095.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.179] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf")) returned 1
	[0095.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77
	[0095.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77
	[0095.179] lstrlenW (lpString=".doc") returned 4
	[0095.179] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.179] lstrlenW (lpString=".docx") returned 5
	[0095.179] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1
	[0095.179] lstrlenW (lpString=".pdf") returned 4
	[0095.179] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.180] lstrlenW (lpString=".xls") returned 4
	[0095.180] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.180] lstrlenW (lpString=".xlsx") returned 5
	[0095.180] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1
	[0095.180] lstrlenW (lpString=".ppt") returned 4
	[0095.180] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77
	[0095.180] lstrlenW (lpString=".zip") returned 4
	[0095.180] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.180] lstrlenW (lpString=".rar") returned 4
	[0095.180] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.180] lstrlenW (lpString=".bz2") returned 4
	[0095.180] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.180] lstrlenW (lpString=".7z") returned 3
	[0095.180] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77
	[0095.180] lstrlenW (lpString=".dbf") returned 4
	[0095.180] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77
	[0095.180] lstrlenW (lpString=".1cd") returned 4
	[0095.180] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77
	[0095.180] lstrlenW (lpString=".jpg") returned 4
	[0095.180] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77
	[0095.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77
	[0095.181] lstrlenW (lpString=".doc") returned 4
	[0095.181] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.181] lstrlenW (lpString=".docx") returned 5
	[0095.181] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1
	[0095.181] lstrlenW (lpString=".pdf") returned 4
	[0095.181] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.181] lstrlenW (lpString=".xls") returned 4
	[0095.181] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.181] lstrlenW (lpString=".xlsx") returned 5
	[0095.181] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1
	[0095.181] lstrlenW (lpString=".ppt") returned 4
	[0095.181] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77
	[0095.181] lstrlenW (lpString=".zip") returned 4
	[0095.181] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.181] lstrlenW (lpString=".rar") returned 4
	[0095.181] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.181] lstrlenW (lpString=".bz2") returned 4
	[0095.181] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.181] lstrlenW (lpString=".7z") returned 3
	[0095.181] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77
	[0095.181] lstrlenW (lpString=".dbf") returned 4
	[0095.181] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77
	[0095.181] lstrlenW (lpString=".1cd") returned 4
	[0095.181] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77
	[0095.182] lstrlenW (lpString=".jpg") returned 4
	[0095.182] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.182] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.182] lstrlenW (lpString="CANYON.ELM") returned 10
	[0095.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.183] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=44745) returned 1
	[0095.183] CloseHandle (hObject=0x1a0) returned 1
	[0095.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm")) returned 0x20
	[0095.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.183] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.183] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.184] GetLastError () returned 0x0
	[0095.184] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xaec9, lpOverlapped=0x0) returned 1
	[0095.204] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xaed0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xaed0, lpOverlapped=0x0) returned 1
	[0095.206] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.206] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0095.206] SetEndOfFile (hFile=0x19c) returned 1
	[0095.206] CloseHandle (hObject=0x19c) returned 1
	[0095.206] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.206] SetEndOfFile (hFile=0x1a0) returned 1
	[0095.207] CloseHandle (hObject=0x1a0) returned 1
	[0095.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.208] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm")) returned 1
	[0095.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73
	[0095.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73
	[0095.212] lstrlenW (lpString=".doc") returned 4
	[0095.212] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.212] lstrlenW (lpString=".docx") returned 5
	[0095.212] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1
	[0095.212] lstrlenW (lpString=".pdf") returned 4
	[0095.212] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.212] lstrlenW (lpString=".xls") returned 4
	[0095.212] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.212] lstrlenW (lpString=".xlsx") returned 5
	[0095.213] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1
	[0095.213] lstrlenW (lpString=".ppt") returned 4
	[0095.213] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73
	[0095.213] lstrlenW (lpString=".zip") returned 4
	[0095.213] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.213] lstrlenW (lpString=".rar") returned 4
	[0095.213] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.213] lstrlenW (lpString=".bz2") returned 4
	[0095.213] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.213] lstrlenW (lpString=".7z") returned 3
	[0095.213] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73
	[0095.213] lstrlenW (lpString=".dbf") returned 4
	[0095.213] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73
	[0095.213] lstrlenW (lpString=".1cd") returned 4
	[0095.213] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73
	[0095.213] lstrlenW (lpString=".jpg") returned 4
	[0095.213] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73
	[0095.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73
	[0095.213] lstrlenW (lpString=".doc") returned 4
	[0095.213] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.213] lstrlenW (lpString=".docx") returned 5
	[0095.213] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1
	[0095.213] lstrlenW (lpString=".pdf") returned 4
	[0095.213] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.213] lstrlenW (lpString=".xls") returned 4
	[0095.213] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.213] lstrlenW (lpString=".xlsx") returned 5
	[0095.214] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1
	[0095.214] lstrlenW (lpString=".ppt") returned 4
	[0095.214] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73
	[0095.214] lstrlenW (lpString=".zip") returned 4
	[0095.214] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.214] lstrlenW (lpString=".rar") returned 4
	[0095.214] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.214] lstrlenW (lpString=".bz2") returned 4
	[0095.214] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.214] lstrlenW (lpString=".7z") returned 3
	[0095.214] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73
	[0095.214] lstrlenW (lpString=".dbf") returned 4
	[0095.214] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73
	[0095.214] lstrlenW (lpString=".1cd") returned 4
	[0095.214] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73
	[0095.214] lstrlenW (lpString=".jpg") returned 4
	[0095.214] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.214] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.214] lstrlenW (lpString="CAPSULES.INF") returned 12
	[0095.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.255] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=501) returned 1
	[0095.255] CloseHandle (hObject=0x1a0) returned 1
	[0095.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf")) returned 0x20
	[0095.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.270] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.270] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0095.277] GetLastError () returned 0x0
	[0095.278] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1f5, lpOverlapped=0x0) returned 1
	[0095.279] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x200, lpOverlapped=0x0) returned 1
	[0095.280] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.280] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.280] SetEndOfFile (hFile=0x198) returned 1
	[0095.288] CloseHandle (hObject=0x198) returned 1
	[0095.297] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.297] SetEndOfFile (hFile=0x1a0) returned 1
	[0095.298] CloseHandle (hObject=0x1a0) returned 1
	[0095.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.298] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf")) returned 1
	[0095.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77
	[0095.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77
	[0095.299] lstrlenW (lpString=".doc") returned 4
	[0095.299] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.299] lstrlenW (lpString=".docx") returned 5
	[0095.299] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0095.299] lstrlenW (lpString=".pdf") returned 4
	[0095.299] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.299] lstrlenW (lpString=".xls") returned 4
	[0095.299] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.299] lstrlenW (lpString=".xlsx") returned 5
	[0095.299] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0095.299] lstrlenW (lpString=".ppt") returned 4
	[0095.299] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77
	[0095.299] lstrlenW (lpString=".zip") returned 4
	[0095.299] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.299] lstrlenW (lpString=".rar") returned 4
	[0095.299] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.299] lstrlenW (lpString=".bz2") returned 4
	[0095.299] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.299] lstrlenW (lpString=".7z") returned 3
	[0095.300] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77
	[0095.300] lstrlenW (lpString=".dbf") returned 4
	[0095.300] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77
	[0095.300] lstrlenW (lpString=".1cd") returned 4
	[0095.300] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77
	[0095.300] lstrlenW (lpString=".jpg") returned 4
	[0095.300] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77
	[0095.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77
	[0095.300] lstrlenW (lpString=".doc") returned 4
	[0095.300] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.300] lstrlenW (lpString=".docx") returned 5
	[0095.300] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0095.300] lstrlenW (lpString=".pdf") returned 4
	[0095.300] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.300] lstrlenW (lpString=".xls") returned 4
	[0095.300] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.300] lstrlenW (lpString=".xlsx") returned 5
	[0095.300] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0095.300] lstrlenW (lpString=".ppt") returned 4
	[0095.300] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77
	[0095.301] lstrlenW (lpString=".zip") returned 4
	[0095.301] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.301] lstrlenW (lpString=".rar") returned 4
	[0095.301] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.301] lstrlenW (lpString=".bz2") returned 4
	[0095.301] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.301] lstrlenW (lpString=".7z") returned 3
	[0095.301] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77
	[0095.301] lstrlenW (lpString=".dbf") returned 4
	[0095.301] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77
	[0095.301] lstrlenW (lpString=".1cd") returned 4
	[0095.301] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77
	[0095.301] lstrlenW (lpString=".jpg") returned 4
	[0095.301] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.302] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.302] lstrlenW (lpString="CONCRETE.ELM") returned 12
	[0095.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.303] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=45528) returned 1
	[0095.303] CloseHandle (hObject=0x1a0) returned 1
	[0095.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm")) returned 0x20
	[0095.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0095.304] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.304] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.304] GetLastError () returned 0x0
	[0095.304] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xb1d8, lpOverlapped=0x0) returned 1
	[0095.321] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xb1e0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xb1e0, lpOverlapped=0x0) returned 1
	[0095.323] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.323] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.323] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.323] CloseHandle (hObject=0x1c8) returned 1
	[0095.323] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.323] SetEndOfFile (hFile=0x1a0) returned 1
	[0095.324] CloseHandle (hObject=0x1a0) returned 1
	[0095.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.325] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm")) returned 1
	[0095.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77
	[0095.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77
	[0095.353] lstrlenW (lpString=".doc") returned 4
	[0095.353] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.353] lstrlenW (lpString=".docx") returned 5
	[0095.353] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.353] lstrlenW (lpString=".pdf") returned 4
	[0095.353] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.353] lstrlenW (lpString=".xls") returned 4
	[0095.353] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.353] lstrlenW (lpString=".xlsx") returned 5
	[0095.353] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.353] lstrlenW (lpString=".ppt") returned 4
	[0095.353] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77
	[0095.353] lstrlenW (lpString=".zip") returned 4
	[0095.353] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.353] lstrlenW (lpString=".rar") returned 4
	[0095.353] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.353] lstrlenW (lpString=".bz2") returned 4
	[0095.353] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.353] lstrlenW (lpString=".7z") returned 3
	[0095.353] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77
	[0095.353] lstrlenW (lpString=".dbf") returned 4
	[0095.353] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77
	[0095.353] lstrlenW (lpString=".1cd") returned 4
	[0095.353] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77
	[0095.353] lstrlenW (lpString=".jpg") returned 4
	[0095.354] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77
	[0095.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77
	[0095.354] lstrlenW (lpString=".doc") returned 4
	[0095.354] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.354] lstrlenW (lpString=".docx") returned 5
	[0095.354] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.354] lstrlenW (lpString=".pdf") returned 4
	[0095.354] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.354] lstrlenW (lpString=".xls") returned 4
	[0095.354] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.354] lstrlenW (lpString=".xlsx") returned 5
	[0095.354] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.354] lstrlenW (lpString=".ppt") returned 4
	[0095.354] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77
	[0095.354] lstrlenW (lpString=".zip") returned 4
	[0095.354] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.354] lstrlenW (lpString=".rar") returned 4
	[0095.354] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.354] lstrlenW (lpString=".bz2") returned 4
	[0095.354] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.354] lstrlenW (lpString=".7z") returned 3
	[0095.354] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77
	[0095.354] lstrlenW (lpString=".dbf") returned 4
	[0095.354] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77
	[0095.354] lstrlenW (lpString=".1cd") returned 4
	[0095.354] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77
	[0095.354] lstrlenW (lpString=".jpg") returned 4
	[0095.354] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.355] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.355] lstrlenW (lpString="ECHO.INF") returned 8
	[0095.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.355] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=503) returned 1
	[0095.355] CloseHandle (hObject=0x1c8) returned 1
	[0095.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf")) returned 0x20
	[0095.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.356] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.356] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.356] GetLastError () returned 0x0
	[0095.356] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1f7, lpOverlapped=0x0) returned 1
	[0095.358] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x200, lpOverlapped=0x0) returned 1
	[0095.359] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.359] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0095.359] SetEndOfFile (hFile=0x19c) returned 1
	[0095.359] CloseHandle (hObject=0x19c) returned 1
	[0095.359] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.359] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.360] CloseHandle (hObject=0x1c8) returned 1
	[0095.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.360] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf")) returned 1
	[0095.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69
	[0095.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69
	[0095.361] lstrlenW (lpString=".doc") returned 4
	[0095.361] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.361] lstrlenW (lpString=".docx") returned 5
	[0095.361] lstrcmpiW (lpString1=".docx", lpString2="O.INF") returned -1
	[0095.361] lstrlenW (lpString=".pdf") returned 4
	[0095.361] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.361] lstrlenW (lpString=".xls") returned 4
	[0095.361] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.361] lstrlenW (lpString=".xlsx") returned 5
	[0095.361] lstrcmpiW (lpString1=".xlsx", lpString2="O.INF") returned -1
	[0095.361] lstrlenW (lpString=".ppt") returned 4
	[0095.361] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69
	[0095.361] lstrlenW (lpString=".zip") returned 4
	[0095.361] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.361] lstrlenW (lpString=".rar") returned 4
	[0095.361] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.361] lstrlenW (lpString=".bz2") returned 4
	[0095.361] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.361] lstrlenW (lpString=".7z") returned 3
	[0095.361] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69
	[0095.361] lstrlenW (lpString=".dbf") returned 4
	[0095.361] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69
	[0095.361] lstrlenW (lpString=".1cd") returned 4
	[0095.361] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69
	[0095.361] lstrlenW (lpString=".jpg") returned 4
	[0095.361] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69
	[0095.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69
	[0095.362] lstrlenW (lpString=".doc") returned 4
	[0095.362] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.362] lstrlenW (lpString=".docx") returned 5
	[0095.362] lstrcmpiW (lpString1=".docx", lpString2="O.INF") returned -1
	[0095.362] lstrlenW (lpString=".pdf") returned 4
	[0095.362] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.362] lstrlenW (lpString=".xls") returned 4
	[0095.362] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.362] lstrlenW (lpString=".xlsx") returned 5
	[0095.362] lstrcmpiW (lpString1=".xlsx", lpString2="O.INF") returned -1
	[0095.362] lstrlenW (lpString=".ppt") returned 4
	[0095.362] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69
	[0095.362] lstrlenW (lpString=".zip") returned 4
	[0095.362] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.362] lstrlenW (lpString=".rar") returned 4
	[0095.362] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.362] lstrlenW (lpString=".bz2") returned 4
	[0095.362] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.362] lstrlenW (lpString=".7z") returned 3
	[0095.362] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69
	[0095.362] lstrlenW (lpString=".dbf") returned 4
	[0095.362] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69
	[0095.362] lstrlenW (lpString=".1cd") returned 4
	[0095.362] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69
	[0095.362] lstrlenW (lpString=".jpg") returned 4
	[0095.362] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.363] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.363] lstrlenW (lpString="ECLIPSE.ELM") returned 11
	[0095.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.363] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=118577) returned 1
	[0095.363] CloseHandle (hObject=0x1c8) returned 1
	[0095.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm")) returned 0x20
	[0095.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.364] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.364] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0095.364] GetLastError () returned 0x0
	[0095.364] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1cf31, lpOverlapped=0x0) returned 1
	[0095.389] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1cf40, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1cf40, lpOverlapped=0x0) returned 1
	[0095.391] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.391] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.392] SetEndOfFile (hFile=0x19c) returned 1
	[0095.392] CloseHandle (hObject=0x19c) returned 1
	[0095.392] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.392] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.396] CloseHandle (hObject=0x1c8) returned 1
	[0095.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.397] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm")) returned 1
	[0095.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75
	[0095.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75
	[0095.425] lstrlenW (lpString=".doc") returned 4
	[0095.425] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.425] lstrlenW (lpString=".docx") returned 5
	[0095.425] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.425] lstrlenW (lpString=".pdf") returned 4
	[0095.425] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.425] lstrlenW (lpString=".xls") returned 4
	[0095.425] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.425] lstrlenW (lpString=".xlsx") returned 5
	[0095.425] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.425] lstrlenW (lpString=".ppt") returned 4
	[0095.425] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75
	[0095.426] lstrlenW (lpString=".zip") returned 4
	[0095.426] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.426] lstrlenW (lpString=".rar") returned 4
	[0095.426] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.426] lstrlenW (lpString=".bz2") returned 4
	[0095.426] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.426] lstrlenW (lpString=".7z") returned 3
	[0095.426] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75
	[0095.426] lstrlenW (lpString=".dbf") returned 4
	[0095.426] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75
	[0095.426] lstrlenW (lpString=".1cd") returned 4
	[0095.426] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75
	[0095.426] lstrlenW (lpString=".jpg") returned 4
	[0095.426] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75
	[0095.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75
	[0095.426] lstrlenW (lpString=".doc") returned 4
	[0095.426] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.426] lstrlenW (lpString=".docx") returned 5
	[0095.426] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0095.426] lstrlenW (lpString=".pdf") returned 4
	[0095.426] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.426] lstrlenW (lpString=".xls") returned 4
	[0095.426] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.426] lstrlenW (lpString=".xlsx") returned 5
	[0095.426] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1
	[0095.426] lstrlenW (lpString=".ppt") returned 4
	[0095.426] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75
	[0095.427] lstrlenW (lpString=".zip") returned 4
	[0095.427] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.427] lstrlenW (lpString=".rar") returned 4
	[0095.427] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.427] lstrlenW (lpString=".bz2") returned 4
	[0095.427] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.427] lstrlenW (lpString=".7z") returned 3
	[0095.427] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75
	[0095.427] lstrlenW (lpString=".dbf") returned 4
	[0095.427] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75
	[0095.427] lstrlenW (lpString=".1cd") returned 4
	[0095.427] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75
	[0095.427] lstrlenW (lpString=".jpg") returned 4
	[0095.427] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.427] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.427] lstrlenW (lpString="EXPEDITN.ELM") returned 12
	[0095.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.428] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=103737) returned 1
	[0095.428] CloseHandle (hObject=0x188) returned 1
	[0095.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm")) returned 0x20
	[0095.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.429] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.429] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.429] GetLastError () returned 0x0
	[0095.429] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x19539, lpOverlapped=0x0) returned 1
	[0095.447] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x19540, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x19540, lpOverlapped=0x0) returned 1
	[0095.450] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.450] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.450] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.450] CloseHandle (hObject=0x1a8) returned 1
	[0095.451] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.451] SetEndOfFile (hFile=0x188) returned 1
	[0095.452] CloseHandle (hObject=0x188) returned 1
	[0095.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.452] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm")) returned 1
	[0095.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77
	[0095.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77
	[0095.465] lstrlenW (lpString=".doc") returned 4
	[0095.465] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.465] lstrlenW (lpString=".docx") returned 5
	[0095.465] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1
	[0095.465] lstrlenW (lpString=".pdf") returned 4
	[0095.465] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.465] lstrlenW (lpString=".xls") returned 4
	[0095.466] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.466] lstrlenW (lpString=".xlsx") returned 5
	[0095.466] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1
	[0095.466] lstrlenW (lpString=".ppt") returned 4
	[0095.466] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77
	[0095.466] lstrlenW (lpString=".zip") returned 4
	[0095.466] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.466] lstrlenW (lpString=".rar") returned 4
	[0095.466] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.466] lstrlenW (lpString=".bz2") returned 4
	[0095.466] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.466] lstrlenW (lpString=".7z") returned 3
	[0095.466] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77
	[0095.466] lstrlenW (lpString=".dbf") returned 4
	[0095.466] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77
	[0095.466] lstrlenW (lpString=".1cd") returned 4
	[0095.466] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77
	[0095.466] lstrlenW (lpString=".jpg") returned 4
	[0095.466] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77
	[0095.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77
	[0095.466] lstrlenW (lpString=".doc") returned 4
	[0095.466] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.466] lstrlenW (lpString=".docx") returned 5
	[0095.466] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1
	[0095.466] lstrlenW (lpString=".pdf") returned 4
	[0095.466] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.466] lstrlenW (lpString=".xls") returned 4
	[0095.467] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.467] lstrlenW (lpString=".xlsx") returned 5
	[0095.467] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1
	[0095.467] lstrlenW (lpString=".ppt") returned 4
	[0095.467] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77
	[0095.467] lstrlenW (lpString=".zip") returned 4
	[0095.467] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.467] lstrlenW (lpString=".rar") returned 4
	[0095.467] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.467] lstrlenW (lpString=".bz2") returned 4
	[0095.467] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.467] lstrlenW (lpString=".7z") returned 3
	[0095.467] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77
	[0095.467] lstrlenW (lpString=".dbf") returned 4
	[0095.467] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77
	[0095.467] lstrlenW (lpString=".1cd") returned 4
	[0095.467] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77
	[0095.467] lstrlenW (lpString=".jpg") returned 4
	[0095.467] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.467] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.467] lstrlenW (lpString="INDUST.ELM") returned 10
	[0095.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.468] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=99561) returned 1
	[0095.468] CloseHandle (hObject=0x188) returned 1
	[0095.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm")) returned 0x20
	[0095.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.469] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.469] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0095.469] GetLastError () returned 0x0
	[0095.469] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x184e9, lpOverlapped=0x0) returned 1
	[0095.481] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x184f0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x184f0, lpOverlapped=0x0) returned 1
	[0095.484] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.484] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0095.484] SetEndOfFile (hFile=0x1a8) returned 1
	[0095.484] CloseHandle (hObject=0x1a8) returned 1
	[0095.484] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.484] SetEndOfFile (hFile=0x188) returned 1
	[0095.486] CloseHandle (hObject=0x188) returned 1
	[0095.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.486] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm")) returned 1
	[0095.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73
	[0095.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73
	[0095.488] lstrlenW (lpString=".doc") returned 4
	[0095.488] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.488] lstrlenW (lpString=".docx") returned 5
	[0095.488] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1
	[0095.488] lstrlenW (lpString=".pdf") returned 4
	[0095.488] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.488] lstrlenW (lpString=".xls") returned 4
	[0095.488] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.488] lstrlenW (lpString=".xlsx") returned 5
	[0095.488] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1
	[0095.488] lstrlenW (lpString=".ppt") returned 4
	[0095.488] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73
	[0095.488] lstrlenW (lpString=".zip") returned 4
	[0095.488] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.488] lstrlenW (lpString=".rar") returned 4
	[0095.488] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.488] lstrlenW (lpString=".bz2") returned 4
	[0095.488] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.488] lstrlenW (lpString=".7z") returned 3
	[0095.488] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73
	[0095.488] lstrlenW (lpString=".dbf") returned 4
	[0095.488] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73
	[0095.488] lstrlenW (lpString=".1cd") returned 4
	[0095.488] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73
	[0095.488] lstrlenW (lpString=".jpg") returned 4
	[0095.488] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73
	[0095.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73
	[0095.489] lstrlenW (lpString=".doc") returned 4
	[0095.489] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.489] lstrlenW (lpString=".docx") returned 5
	[0095.489] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1
	[0095.489] lstrlenW (lpString=".pdf") returned 4
	[0095.489] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.489] lstrlenW (lpString=".xls") returned 4
	[0095.489] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.489] lstrlenW (lpString=".xlsx") returned 5
	[0095.489] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1
	[0095.489] lstrlenW (lpString=".ppt") returned 4
	[0095.489] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73
	[0095.489] lstrlenW (lpString=".zip") returned 4
	[0095.489] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.489] lstrlenW (lpString=".rar") returned 4
	[0095.489] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.489] lstrlenW (lpString=".bz2") returned 4
	[0095.489] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.489] lstrlenW (lpString=".7z") returned 3
	[0095.489] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73
	[0095.489] lstrlenW (lpString=".dbf") returned 4
	[0095.489] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73
	[0095.489] lstrlenW (lpString=".1cd") returned 4
	[0095.489] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73
	[0095.489] lstrlenW (lpString=".jpg") returned 4
	[0095.489] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.490] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.490] lstrlenW (lpString="IRIS.ELM") returned 8
	[0095.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.505] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=65885) returned 1
	[0095.505] CloseHandle (hObject=0x188) returned 1
	[0095.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm")) returned 0x20
	[0095.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.515] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.515] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.541] GetLastError () returned 0x0
	[0095.541] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1015d, lpOverlapped=0x0) returned 1
	[0095.554] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x10160, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x10160, lpOverlapped=0x0) returned 1
	[0095.556] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.556] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0095.556] SetEndOfFile (hFile=0x190) returned 1
	[0095.556] CloseHandle (hObject=0x190) returned 1
	[0095.557] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.557] SetEndOfFile (hFile=0x188) returned 1
	[0095.558] CloseHandle (hObject=0x188) returned 1
	[0095.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.558] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm")) returned 1
	[0095.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69
	[0095.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69
	[0095.559] lstrlenW (lpString=".doc") returned 4
	[0095.559] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.559] lstrlenW (lpString=".docx") returned 5
	[0095.559] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1
	[0095.559] lstrlenW (lpString=".pdf") returned 4
	[0095.559] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.559] lstrlenW (lpString=".xls") returned 4
	[0095.559] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.559] lstrlenW (lpString=".xlsx") returned 5
	[0095.559] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1
	[0095.559] lstrlenW (lpString=".ppt") returned 4
	[0095.559] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69
	[0095.559] lstrlenW (lpString=".zip") returned 4
	[0095.559] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.559] lstrlenW (lpString=".rar") returned 4
	[0095.559] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.559] lstrlenW (lpString=".bz2") returned 4
	[0095.559] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.559] lstrlenW (lpString=".7z") returned 3
	[0095.559] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69
	[0095.559] lstrlenW (lpString=".dbf") returned 4
	[0095.559] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69
	[0095.559] lstrlenW (lpString=".1cd") returned 4
	[0095.559] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69
	[0095.559] lstrlenW (lpString=".jpg") returned 4
	[0095.559] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69
	[0095.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69
	[0095.560] lstrlenW (lpString=".doc") returned 4
	[0095.560] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.560] lstrlenW (lpString=".docx") returned 5
	[0095.560] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1
	[0095.560] lstrlenW (lpString=".pdf") returned 4
	[0095.560] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.560] lstrlenW (lpString=".xls") returned 4
	[0095.560] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.560] lstrlenW (lpString=".xlsx") returned 5
	[0095.560] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1
	[0095.560] lstrlenW (lpString=".ppt") returned 4
	[0095.560] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69
	[0095.560] lstrlenW (lpString=".zip") returned 4
	[0095.560] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.560] lstrlenW (lpString=".rar") returned 4
	[0095.560] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.560] lstrlenW (lpString=".bz2") returned 4
	[0095.560] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.560] lstrlenW (lpString=".7z") returned 3
	[0095.560] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69
	[0095.560] lstrlenW (lpString=".dbf") returned 4
	[0095.560] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69
	[0095.560] lstrlenW (lpString=".1cd") returned 4
	[0095.560] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69
	[0095.560] lstrlenW (lpString=".jpg") returned 4
	[0095.560] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.561] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.561] lstrlenW (lpString="LAYERS.INF") returned 10
	[0095.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.575] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=533) returned 1
	[0095.575] CloseHandle (hObject=0x1c8) returned 1
	[0095.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf")) returned 0x20
	[0095.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.575] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.575] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.576] GetLastError () returned 0x0
	[0095.576] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x215, lpOverlapped=0x0) returned 1
	[0095.576] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x220, lpOverlapped=0x0) returned 1
	[0095.577] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.577] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0095.578] SetEndOfFile (hFile=0x188) returned 1
	[0095.578] CloseHandle (hObject=0x188) returned 1
	[0095.578] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.578] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.579] CloseHandle (hObject=0x1c8) returned 1
	[0095.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.579] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf")) returned 1
	[0095.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73
	[0095.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73
	[0095.579] lstrlenW (lpString=".doc") returned 4
	[0095.579] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.579] lstrlenW (lpString=".docx") returned 5
	[0095.579] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0095.579] lstrlenW (lpString=".pdf") returned 4
	[0095.579] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.579] lstrlenW (lpString=".xls") returned 4
	[0095.579] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.579] lstrlenW (lpString=".xlsx") returned 5
	[0095.579] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0095.580] lstrlenW (lpString=".ppt") returned 4
	[0095.580] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73
	[0095.580] lstrlenW (lpString=".zip") returned 4
	[0095.580] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.580] lstrlenW (lpString=".rar") returned 4
	[0095.580] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.580] lstrlenW (lpString=".bz2") returned 4
	[0095.580] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.580] lstrlenW (lpString=".7z") returned 3
	[0095.580] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73
	[0095.580] lstrlenW (lpString=".dbf") returned 4
	[0095.580] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73
	[0095.580] lstrlenW (lpString=".1cd") returned 4
	[0095.580] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73
	[0095.580] lstrlenW (lpString=".jpg") returned 4
	[0095.580] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73
	[0095.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73
	[0095.580] lstrlenW (lpString=".doc") returned 4
	[0095.580] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.580] lstrlenW (lpString=".docx") returned 5
	[0095.580] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1
	[0095.580] lstrlenW (lpString=".pdf") returned 4
	[0095.580] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.580] lstrlenW (lpString=".xls") returned 4
	[0095.580] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.580] lstrlenW (lpString=".xlsx") returned 5
	[0095.580] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1
	[0095.581] lstrlenW (lpString=".ppt") returned 4
	[0095.581] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73
	[0095.581] lstrlenW (lpString=".zip") returned 4
	[0095.581] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.581] lstrlenW (lpString=".rar") returned 4
	[0095.581] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.581] lstrlenW (lpString=".bz2") returned 4
	[0095.581] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.581] lstrlenW (lpString=".7z") returned 3
	[0095.581] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73
	[0095.581] lstrlenW (lpString=".dbf") returned 4
	[0095.581] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73
	[0095.581] lstrlenW (lpString=".1cd") returned 4
	[0095.581] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73
	[0095.581] lstrlenW (lpString=".jpg") returned 4
	[0095.581] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.581] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.581] lstrlenW (lpString="LEVEL.INF") returned 9
	[0095.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.582] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=526) returned 1
	[0095.582] CloseHandle (hObject=0x1c8) returned 1
	[0095.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf")) returned 0x20
	[0095.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.582] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.582] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.583] GetLastError () returned 0x0
	[0095.583] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x20e, lpOverlapped=0x0) returned 1
	[0095.584] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x210, lpOverlapped=0x0) returned 1
	[0095.584] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.584] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0095.585] SetEndOfFile (hFile=0x188) returned 1
	[0095.585] CloseHandle (hObject=0x188) returned 1
	[0095.585] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.585] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.586] CloseHandle (hObject=0x1c8) returned 1
	[0095.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.586] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf")) returned 1
	[0095.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71
	[0095.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71
	[0095.587] lstrlenW (lpString=".doc") returned 4
	[0095.587] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.587] lstrlenW (lpString=".docx") returned 5
	[0095.587] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1
	[0095.587] lstrlenW (lpString=".pdf") returned 4
	[0095.587] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.587] lstrlenW (lpString=".xls") returned 4
	[0095.587] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.587] lstrlenW (lpString=".xlsx") returned 5
	[0095.587] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1
	[0095.587] lstrlenW (lpString=".ppt") returned 4
	[0095.587] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71
	[0095.587] lstrlenW (lpString=".zip") returned 4
	[0095.587] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.587] lstrlenW (lpString=".rar") returned 4
	[0095.587] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.587] lstrlenW (lpString=".bz2") returned 4
	[0095.587] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.587] lstrlenW (lpString=".7z") returned 3
	[0095.587] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71
	[0095.588] lstrlenW (lpString=".dbf") returned 4
	[0095.588] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71
	[0095.588] lstrlenW (lpString=".1cd") returned 4
	[0095.588] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71
	[0095.588] lstrlenW (lpString=".jpg") returned 4
	[0095.588] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71
	[0095.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71
	[0095.588] lstrlenW (lpString=".doc") returned 4
	[0095.588] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.588] lstrlenW (lpString=".docx") returned 5
	[0095.588] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1
	[0095.588] lstrlenW (lpString=".pdf") returned 4
	[0095.588] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.588] lstrlenW (lpString=".xls") returned 4
	[0095.588] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.588] lstrlenW (lpString=".xlsx") returned 5
	[0095.588] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1
	[0095.588] lstrlenW (lpString=".ppt") returned 4
	[0095.588] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71
	[0095.588] lstrlenW (lpString=".zip") returned 4
	[0095.588] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.588] lstrlenW (lpString=".rar") returned 4
	[0095.588] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.588] lstrlenW (lpString=".bz2") returned 4
	[0095.588] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.588] lstrlenW (lpString=".7z") returned 3
	[0095.588] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71
	[0095.588] lstrlenW (lpString=".dbf") returned 4
	[0095.589] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71
	[0095.589] lstrlenW (lpString=".1cd") returned 4
	[0095.589] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71
	[0095.589] lstrlenW (lpString=".jpg") returned 4
	[0095.589] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.589] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.589] lstrlenW (lpString="NETWORK.ELM") returned 11
	[0095.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.589] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=50761) returned 1
	[0095.589] CloseHandle (hObject=0x1c8) returned 1
	[0095.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm")) returned 0x20
	[0095.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.590] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.590] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.591] GetLastError () returned 0x0
	[0095.591] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xc649, lpOverlapped=0x0) returned 1
	[0095.602] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc650, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xc650, lpOverlapped=0x0) returned 1
	[0095.604] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.604] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.604] SetEndOfFile (hFile=0x188) returned 1
	[0095.604] CloseHandle (hObject=0x188) returned 1
	[0095.604] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.604] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.605] CloseHandle (hObject=0x1c8) returned 1
	[0095.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.606] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm")) returned 1
	[0095.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75
	[0095.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75
	[0095.606] lstrlenW (lpString=".doc") returned 4
	[0095.606] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.606] lstrlenW (lpString=".docx") returned 5
	[0095.606] lstrcmpiW (lpString1=".docx", lpString2="K.ELM") returned -1
	[0095.606] lstrlenW (lpString=".pdf") returned 4
	[0095.607] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.607] lstrlenW (lpString=".xls") returned 4
	[0095.607] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.607] lstrlenW (lpString=".xlsx") returned 5
	[0095.607] lstrcmpiW (lpString1=".xlsx", lpString2="K.ELM") returned -1
	[0095.607] lstrlenW (lpString=".ppt") returned 4
	[0095.607] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75
	[0095.607] lstrlenW (lpString=".zip") returned 4
	[0095.607] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.607] lstrlenW (lpString=".rar") returned 4
	[0095.607] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.607] lstrlenW (lpString=".bz2") returned 4
	[0095.607] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.607] lstrlenW (lpString=".7z") returned 3
	[0095.607] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75
	[0095.607] lstrlenW (lpString=".dbf") returned 4
	[0095.607] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75
	[0095.607] lstrlenW (lpString=".1cd") returned 4
	[0095.607] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75
	[0095.607] lstrlenW (lpString=".jpg") returned 4
	[0095.607] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75
	[0095.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75
	[0095.607] lstrlenW (lpString=".doc") returned 4
	[0095.607] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.607] lstrlenW (lpString=".docx") returned 5
	[0095.607] lstrcmpiW (lpString1=".docx", lpString2="K.ELM") returned -1
	[0095.607] lstrlenW (lpString=".pdf") returned 4
	[0095.607] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.607] lstrlenW (lpString=".xls") returned 4
	[0095.607] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.608] lstrlenW (lpString=".xlsx") returned 5
	[0095.608] lstrcmpiW (lpString1=".xlsx", lpString2="K.ELM") returned -1
	[0095.608] lstrlenW (lpString=".ppt") returned 4
	[0095.608] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75
	[0095.608] lstrlenW (lpString=".zip") returned 4
	[0095.608] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.608] lstrlenW (lpString=".rar") returned 4
	[0095.608] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.608] lstrlenW (lpString=".bz2") returned 4
	[0095.608] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.608] lstrlenW (lpString=".7z") returned 3
	[0095.608] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75
	[0095.608] lstrlenW (lpString=".dbf") returned 4
	[0095.608] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75
	[0095.608] lstrlenW (lpString=".1cd") returned 4
	[0095.608] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75
	[0095.608] lstrlenW (lpString=".jpg") returned 4
	[0095.608] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.608] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.608] lstrlenW (lpString="PAPYRUS.ELM") returned 11
	[0095.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.609] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=91861) returned 1
	[0095.609] CloseHandle (hObject=0x1c8) returned 1
	[0095.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm")) returned 0x20
	[0095.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.609] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.610] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.610] GetLastError () returned 0x0
	[0095.610] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x166d5, lpOverlapped=0x0) returned 1
	[0095.622] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x166e0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x166e0, lpOverlapped=0x0) returned 1
	[0095.624] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.625] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.625] SetEndOfFile (hFile=0x188) returned 1
	[0095.625] CloseHandle (hObject=0x188) returned 1
	[0095.625] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.625] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.626] CloseHandle (hObject=0x1c8) returned 1
	[0095.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.627] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm")) returned 1
	[0095.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75
	[0095.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75
	[0095.628] lstrlenW (lpString=".doc") returned 4
	[0095.628] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.628] lstrlenW (lpString=".docx") returned 5
	[0095.628] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1
	[0095.628] lstrlenW (lpString=".pdf") returned 4
	[0095.628] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.628] lstrlenW (lpString=".xls") returned 4
	[0095.628] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.628] lstrlenW (lpString=".xlsx") returned 5
	[0095.628] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1
	[0095.628] lstrlenW (lpString=".ppt") returned 4
	[0095.628] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75
	[0095.628] lstrlenW (lpString=".zip") returned 4
	[0095.628] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.628] lstrlenW (lpString=".rar") returned 4
	[0095.628] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.628] lstrlenW (lpString=".bz2") returned 4
	[0095.628] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.628] lstrlenW (lpString=".7z") returned 3
	[0095.628] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75
	[0095.629] lstrlenW (lpString=".dbf") returned 4
	[0095.629] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75
	[0095.629] lstrlenW (lpString=".1cd") returned 4
	[0095.629] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75
	[0095.629] lstrlenW (lpString=".jpg") returned 4
	[0095.629] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75
	[0095.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75
	[0095.629] lstrlenW (lpString=".doc") returned 4
	[0095.629] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.629] lstrlenW (lpString=".docx") returned 5
	[0095.629] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1
	[0095.629] lstrlenW (lpString=".pdf") returned 4
	[0095.629] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.629] lstrlenW (lpString=".xls") returned 4
	[0095.629] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.629] lstrlenW (lpString=".xlsx") returned 5
	[0095.629] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1
	[0095.629] lstrlenW (lpString=".ppt") returned 4
	[0095.629] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75
	[0095.629] lstrlenW (lpString=".zip") returned 4
	[0095.629] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.629] lstrlenW (lpString=".rar") returned 4
	[0095.629] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.629] lstrlenW (lpString=".bz2") returned 4
	[0095.629] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.629] lstrlenW (lpString=".7z") returned 3
	[0095.629] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75
	[0095.629] lstrlenW (lpString=".dbf") returned 4
	[0095.630] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75
	[0095.630] lstrlenW (lpString=".1cd") returned 4
	[0095.630] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75
	[0095.630] lstrlenW (lpString=".jpg") returned 4
	[0095.630] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.630] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.630] lstrlenW (lpString="PIXEL.ELM") returned 9
	[0095.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.631] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=53477) returned 1
	[0095.631] CloseHandle (hObject=0x1c8) returned 1
	[0095.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm")) returned 0x20
	[0095.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.631] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.631] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0095.632] GetLastError () returned 0x0
	[0095.632] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xd0e5, lpOverlapped=0x0) returned 1
	[0095.650] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xd0f0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xd0f0, lpOverlapped=0x0) returned 1
	[0095.652] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.652] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0095.652] SetEndOfFile (hFile=0x188) returned 1
	[0095.652] CloseHandle (hObject=0x188) returned 1
	[0095.653] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.653] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.654] CloseHandle (hObject=0x1c8) returned 1
	[0095.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.654] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm")) returned 1
	[0095.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71
	[0095.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71
	[0095.654] lstrlenW (lpString=".doc") returned 4
	[0095.654] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.654] lstrlenW (lpString=".docx") returned 5
	[0095.654] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1
	[0095.654] lstrlenW (lpString=".pdf") returned 4
	[0095.654] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.654] lstrlenW (lpString=".xls") returned 4
	[0095.654] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.654] lstrlenW (lpString=".xlsx") returned 5
	[0095.654] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1
	[0095.654] lstrlenW (lpString=".ppt") returned 4
	[0095.655] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71
	[0095.655] lstrlenW (lpString=".zip") returned 4
	[0095.655] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.655] lstrlenW (lpString=".rar") returned 4
	[0095.655] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.655] lstrlenW (lpString=".bz2") returned 4
	[0095.655] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.655] lstrlenW (lpString=".7z") returned 3
	[0095.655] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71
	[0095.655] lstrlenW (lpString=".dbf") returned 4
	[0095.655] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71
	[0095.655] lstrlenW (lpString=".1cd") returned 4
	[0095.655] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71
	[0095.655] lstrlenW (lpString=".jpg") returned 4
	[0095.655] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71
	[0095.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71
	[0095.655] lstrlenW (lpString=".doc") returned 4
	[0095.655] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.655] lstrlenW (lpString=".docx") returned 5
	[0095.655] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1
	[0095.655] lstrlenW (lpString=".pdf") returned 4
	[0095.655] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.655] lstrlenW (lpString=".xls") returned 4
	[0095.655] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.655] lstrlenW (lpString=".xlsx") returned 5
	[0095.655] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1
	[0095.655] lstrlenW (lpString=".ppt") returned 4
	[0095.655] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71
	[0095.655] lstrlenW (lpString=".zip") returned 4
	[0095.656] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.656] lstrlenW (lpString=".rar") returned 4
	[0095.656] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.656] lstrlenW (lpString=".bz2") returned 4
	[0095.656] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.656] lstrlenW (lpString=".7z") returned 3
	[0095.656] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71
	[0095.656] lstrlenW (lpString=".dbf") returned 4
	[0095.656] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71
	[0095.656] lstrlenW (lpString=".1cd") returned 4
	[0095.656] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71
	[0095.656] lstrlenW (lpString=".jpg") returned 4
	[0095.656] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.656] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.656] lstrlenW (lpString="PROFILE.INF") returned 11
	[0095.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0095.700] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=587) returned 1
	[0095.700] CloseHandle (hObject=0x1b4) returned 1
	[0095.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf")) returned 0x20
	[0095.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.736] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.736] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0095.742] GetLastError () returned 0x0
	[0095.742] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x24b, lpOverlapped=0x0) returned 1
	[0095.743] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x250, lpOverlapped=0x0) returned 1
	[0095.744] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.744] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.744] SetEndOfFile (hFile=0x184) returned 1
	[0095.744] CloseHandle (hObject=0x184) returned 1
	[0095.745] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.745] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.745] CloseHandle (hObject=0x1c8) returned 1
	[0095.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.746] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf")) returned 1
	[0095.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75
	[0095.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75
	[0095.746] lstrlenW (lpString=".doc") returned 4
	[0095.746] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.746] lstrlenW (lpString=".docx") returned 5
	[0095.746] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.746] lstrlenW (lpString=".pdf") returned 4
	[0095.746] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.746] lstrlenW (lpString=".xls") returned 4
	[0095.746] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.746] lstrlenW (lpString=".xlsx") returned 5
	[0095.746] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.746] lstrlenW (lpString=".ppt") returned 4
	[0095.746] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75
	[0095.746] lstrlenW (lpString=".zip") returned 4
	[0095.746] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.746] lstrlenW (lpString=".rar") returned 4
	[0095.746] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.747] lstrlenW (lpString=".bz2") returned 4
	[0095.747] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.747] lstrlenW (lpString=".7z") returned 3
	[0095.747] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75
	[0095.747] lstrlenW (lpString=".dbf") returned 4
	[0095.747] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75
	[0095.747] lstrlenW (lpString=".1cd") returned 4
	[0095.747] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75
	[0095.747] lstrlenW (lpString=".jpg") returned 4
	[0095.747] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75
	[0095.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75
	[0095.747] lstrlenW (lpString=".doc") returned 4
	[0095.747] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.747] lstrlenW (lpString=".docx") returned 5
	[0095.747] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1
	[0095.747] lstrlenW (lpString=".pdf") returned 4
	[0095.747] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.747] lstrlenW (lpString=".xls") returned 4
	[0095.747] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.747] lstrlenW (lpString=".xlsx") returned 5
	[0095.747] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1
	[0095.747] lstrlenW (lpString=".ppt") returned 4
	[0095.747] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75
	[0095.747] lstrlenW (lpString=".zip") returned 4
	[0095.747] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.747] lstrlenW (lpString=".rar") returned 4
	[0095.747] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.747] lstrlenW (lpString=".bz2") returned 4
	[0095.748] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.748] lstrlenW (lpString=".7z") returned 3
	[0095.748] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75
	[0095.748] lstrlenW (lpString=".dbf") returned 4
	[0095.748] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75
	[0095.748] lstrlenW (lpString=".1cd") returned 4
	[0095.748] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75
	[0095.748] lstrlenW (lpString=".jpg") returned 4
	[0095.748] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.748] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.748] lstrlenW (lpString="RADIAL.ELM") returned 10
	[0095.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.749] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=46942) returned 1
	[0095.749] CloseHandle (hObject=0x1c8) returned 1
	[0095.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm")) returned 0x20
	[0095.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.749] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.749] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0095.750] GetLastError () returned 0x0
	[0095.750] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xb75e, lpOverlapped=0x0) returned 1
	[0095.778] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xb760, lpOverlapped=0x0) returned 1
	[0095.780] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.780] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0095.780] SetEndOfFile (hFile=0x184) returned 1
	[0095.780] CloseHandle (hObject=0x184) returned 1
	[0095.781] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.781] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.782] CloseHandle (hObject=0x1c8) returned 1
	[0095.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.782] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm")) returned 1
	[0095.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73
	[0095.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73
	[0095.783] lstrlenW (lpString=".doc") returned 4
	[0095.783] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.783] lstrlenW (lpString=".docx") returned 5
	[0095.783] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1
	[0095.783] lstrlenW (lpString=".pdf") returned 4
	[0095.783] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.783] lstrlenW (lpString=".xls") returned 4
	[0095.783] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.783] lstrlenW (lpString=".xlsx") returned 5
	[0095.783] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1
	[0095.783] lstrlenW (lpString=".ppt") returned 4
	[0095.783] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73
	[0095.783] lstrlenW (lpString=".zip") returned 4
	[0095.783] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.783] lstrlenW (lpString=".rar") returned 4
	[0095.783] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.783] lstrlenW (lpString=".bz2") returned 4
	[0095.783] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.783] lstrlenW (lpString=".7z") returned 3
	[0095.783] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73
	[0095.783] lstrlenW (lpString=".dbf") returned 4
	[0095.783] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73
	[0095.784] lstrlenW (lpString=".1cd") returned 4
	[0095.784] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73
	[0095.784] lstrlenW (lpString=".jpg") returned 4
	[0095.784] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73
	[0095.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73
	[0095.784] lstrlenW (lpString=".doc") returned 4
	[0095.784] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0095.784] lstrlenW (lpString=".docx") returned 5
	[0095.784] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1
	[0095.784] lstrlenW (lpString=".pdf") returned 4
	[0095.784] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0095.784] lstrlenW (lpString=".xls") returned 4
	[0095.784] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0095.784] lstrlenW (lpString=".xlsx") returned 5
	[0095.784] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1
	[0095.784] lstrlenW (lpString=".ppt") returned 4
	[0095.784] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0095.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73
	[0095.784] lstrlenW (lpString=".zip") returned 4
	[0095.784] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0095.784] lstrlenW (lpString=".rar") returned 4
	[0095.784] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0095.784] lstrlenW (lpString=".bz2") returned 4
	[0095.784] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0095.784] lstrlenW (lpString=".7z") returned 3
	[0095.785] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0095.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73
	[0095.785] lstrlenW (lpString=".dbf") returned 4
	[0095.785] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0095.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73
	[0095.785] lstrlenW (lpString=".1cd") returned 4
	[0095.785] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0095.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73
	[0095.785] lstrlenW (lpString=".jpg") returned 4
	[0095.785] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0095.785] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0095.785] lstrlenW (lpString="REFINED.INF") returned 11
	[0095.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.786] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=586) returned 1
	[0095.786] CloseHandle (hObject=0x1c8) returned 1
	[0095.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf")) returned 0x20
	[0095.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.787] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.787] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0095.788] GetLastError () returned 0x0
	[0095.788] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x24a, lpOverlapped=0x0) returned 1
	[0095.789] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x250, lpOverlapped=0x0) returned 1
	[0095.791] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.791] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0095.791] SetEndOfFile (hFile=0x184) returned 1
	[0095.791] CloseHandle (hObject=0x184) returned 1
	[0095.791] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.791] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.792] CloseHandle (hObject=0x1c8) returned 1
	[0095.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0095.793] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf")) returned 1
	[0095.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75
	[0095.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75
	[0095.793] lstrlenW (lpString=".doc") returned 4
	[0095.793] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.793] lstrlenW (lpString=".docx") returned 5
	[0095.793] lstrcmpiW (lpString1=".docx", lpString2="D.INF") returned -1
	[0095.793] lstrlenW (lpString=".pdf") returned 4
	[0095.793] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.793] lstrlenW (lpString=".xls") returned 4
	[0095.793] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.793] lstrlenW (lpString=".xlsx") returned 5
	[0095.793] lstrcmpiW (lpString1=".xlsx", lpString2="D.INF") returned -1
	[0095.793] lstrlenW (lpString=".ppt") returned 4
	[0095.793] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75
	[0095.793] lstrlenW (lpString=".zip") returned 4
	[0095.793] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.793] lstrlenW (lpString=".rar") returned 4
	[0095.794] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.794] lstrlenW (lpString=".bz2") returned 4
	[0095.794] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.794] lstrlenW (lpString=".7z") returned 3
	[0095.794] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75
	[0095.794] lstrlenW (lpString=".dbf") returned 4
	[0095.794] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75
	[0095.794] lstrlenW (lpString=".1cd") returned 4
	[0095.794] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75
	[0095.794] lstrlenW (lpString=".jpg") returned 4
	[0095.794] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75
	[0095.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75
	[0095.794] lstrlenW (lpString=".doc") returned 4
	[0095.794] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0095.794] lstrlenW (lpString=".docx") returned 5
	[0095.794] lstrcmpiW (lpString1=".docx", lpString2="D.INF") returned -1
	[0095.794] lstrlenW (lpString=".pdf") returned 4
	[0095.794] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0095.794] lstrlenW (lpString=".xls") returned 4
	[0095.794] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0095.794] lstrlenW (lpString=".xlsx") returned 5
	[0095.794] lstrcmpiW (lpString1=".xlsx", lpString2="D.INF") returned -1
	[0095.794] lstrlenW (lpString=".ppt") returned 4
	[0095.795] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0095.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75
	[0095.795] lstrlenW (lpString=".zip") returned 4
	[0095.795] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0095.795] lstrlenW (lpString=".rar") returned 4
	[0095.795] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0095.795] lstrlenW (lpString=".bz2") returned 4
	[0095.795] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0095.795] lstrlenW (lpString=".7z") returned 3
	[0095.795] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0095.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75
	[0095.795] lstrlenW (lpString=".dbf") returned 4
	[0095.795] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0095.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75
	[0095.795] lstrlenW (lpString=".1cd") returned 4
	[0095.795] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0095.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75
	[0095.795] lstrlenW (lpString=".jpg") returned 4
	[0095.795] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0095.795] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0095.795] lstrlenW (lpString="RICEPAPR.ELM") returned 12
	[0095.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0095.815] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=73822) returned 1
	[0095.816] CloseHandle (hObject=0x190) returned 1
	[0095.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm")) returned 0x20
	[0095.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0095.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0095.911] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.911] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0095.943] GetLastError () returned 0x0
	[0095.943] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1205e, lpOverlapped=0x0) returned 1
	[0096.043] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x12060, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x12060, lpOverlapped=0x0) returned 1
	[0096.046] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.046] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0096.046] SetEndOfFile (hFile=0x184) returned 1
	[0096.046] CloseHandle (hObject=0x184) returned 1
	[0096.047] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.047] SetEndOfFile (hFile=0x1c8) returned 1
	[0096.048] CloseHandle (hObject=0x1c8) returned 1
	[0096.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.049] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm")) returned 1
	[0096.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77
	[0096.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77
	[0096.049] lstrlenW (lpString=".doc") returned 4
	[0096.049] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.049] lstrlenW (lpString=".docx") returned 5
	[0096.049] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1
	[0096.049] lstrlenW (lpString=".pdf") returned 4
	[0096.049] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.049] lstrlenW (lpString=".xls") returned 4
	[0096.049] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.049] lstrlenW (lpString=".xlsx") returned 5
	[0096.049] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1
	[0096.049] lstrlenW (lpString=".ppt") returned 4
	[0096.049] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77
	[0096.049] lstrlenW (lpString=".zip") returned 4
	[0096.050] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.050] lstrlenW (lpString=".rar") returned 4
	[0096.050] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.050] lstrlenW (lpString=".bz2") returned 4
	[0096.050] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.050] lstrlenW (lpString=".7z") returned 3
	[0096.050] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77
	[0096.050] lstrlenW (lpString=".dbf") returned 4
	[0096.050] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77
	[0096.050] lstrlenW (lpString=".1cd") returned 4
	[0096.050] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77
	[0096.050] lstrlenW (lpString=".jpg") returned 4
	[0096.050] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77
	[0096.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77
	[0096.050] lstrlenW (lpString=".doc") returned 4
	[0096.050] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.050] lstrlenW (lpString=".docx") returned 5
	[0096.050] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1
	[0096.050] lstrlenW (lpString=".pdf") returned 4
	[0096.050] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.050] lstrlenW (lpString=".xls") returned 4
	[0096.050] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.051] lstrlenW (lpString=".xlsx") returned 5
	[0096.051] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1
	[0096.051] lstrlenW (lpString=".ppt") returned 4
	[0096.051] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77
	[0096.051] lstrlenW (lpString=".zip") returned 4
	[0096.051] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.051] lstrlenW (lpString=".rar") returned 4
	[0096.051] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.051] lstrlenW (lpString=".bz2") returned 4
	[0096.051] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.051] lstrlenW (lpString=".7z") returned 3
	[0096.051] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77
	[0096.051] lstrlenW (lpString=".dbf") returned 4
	[0096.051] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77
	[0096.051] lstrlenW (lpString=".1cd") returned 4
	[0096.051] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77
	[0096.051] lstrlenW (lpString=".jpg") returned 4
	[0096.051] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.051] lstrcmpiW (lpString1=".INF", lpString2=".adobe") returned 1
	[0096.052] lstrlenW (lpString="SPRING.INF") returned 10
	[0096.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0096.057] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=466) returned 1
	[0096.057] CloseHandle (hObject=0x1b4) returned 1
	[0096.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf")) returned 0x20
	[0096.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0096.177] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.177] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0096.206] GetLastError () returned 0x0
	[0096.206] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1d2, lpOverlapped=0x0) returned 1
	[0096.208] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1e0, lpOverlapped=0x0) returned 1
	[0096.209] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.209] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0096.209] SetEndOfFile (hFile=0x188) returned 1
	[0096.209] CloseHandle (hObject=0x188) returned 1
	[0096.210] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.210] SetEndOfFile (hFile=0x1a4) returned 1
	[0096.210] CloseHandle (hObject=0x1a4) returned 1
	[0096.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.211] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf")) returned 1
	[0096.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73
	[0096.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73
	[0096.211] lstrlenW (lpString=".doc") returned 4
	[0096.211] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.211] lstrlenW (lpString=".docx") returned 5
	[0096.211] lstrcmpiW (lpString1=".docx", lpString2="G.INF") returned -1
	[0096.211] lstrlenW (lpString=".pdf") returned 4
	[0096.211] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.211] lstrlenW (lpString=".xls") returned 4
	[0096.211] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.211] lstrlenW (lpString=".xlsx") returned 5
	[0096.211] lstrcmpiW (lpString1=".xlsx", lpString2="G.INF") returned -1
	[0096.211] lstrlenW (lpString=".ppt") returned 4
	[0096.211] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73
	[0096.212] lstrlenW (lpString=".zip") returned 4
	[0096.212] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.212] lstrlenW (lpString=".rar") returned 4
	[0096.212] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.212] lstrlenW (lpString=".bz2") returned 4
	[0096.212] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.212] lstrlenW (lpString=".7z") returned 3
	[0096.212] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73
	[0096.212] lstrlenW (lpString=".dbf") returned 4
	[0096.212] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73
	[0096.212] lstrlenW (lpString=".1cd") returned 4
	[0096.212] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73
	[0096.212] lstrlenW (lpString=".jpg") returned 4
	[0096.212] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73
	[0096.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73
	[0096.212] lstrlenW (lpString=".doc") returned 4
	[0096.212] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1
	[0096.212] lstrlenW (lpString=".docx") returned 5
	[0096.212] lstrcmpiW (lpString1=".docx", lpString2="G.INF") returned -1
	[0096.212] lstrlenW (lpString=".pdf") returned 4
	[0096.212] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1
	[0096.212] lstrlenW (lpString=".xls") returned 4
	[0096.213] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1
	[0096.213] lstrlenW (lpString=".xlsx") returned 5
	[0096.213] lstrcmpiW (lpString1=".xlsx", lpString2="G.INF") returned -1
	[0096.213] lstrlenW (lpString=".ppt") returned 4
	[0096.213] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1
	[0096.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73
	[0096.213] lstrlenW (lpString=".zip") returned 4
	[0096.213] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1
	[0096.213] lstrlenW (lpString=".rar") returned 4
	[0096.213] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1
	[0096.213] lstrlenW (lpString=".bz2") returned 4
	[0096.213] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1
	[0096.213] lstrlenW (lpString=".7z") returned 3
	[0096.213] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1
	[0096.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73
	[0096.213] lstrlenW (lpString=".dbf") returned 4
	[0096.213] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1
	[0096.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73
	[0096.213] lstrlenW (lpString=".1cd") returned 4
	[0096.213] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1
	[0096.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73
	[0096.213] lstrlenW (lpString=".jpg") returned 4
	[0096.213] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1
	[0096.214] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0096.214] lstrlenW (lpString="SUMIPNTG.ELM") returned 12
	[0096.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0096.242] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=106004) returned 1
	[0096.242] CloseHandle (hObject=0x1a8) returned 1
	[0096.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm")) returned 0x20
	[0096.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0096.272] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.272] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0096.277] GetLastError () returned 0x0
	[0096.277] ReadFile (in: hFile=0x1b4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x19e14, lpOverlapped=0x0) returned 1
	[0096.313] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x19e20, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x19e20, lpOverlapped=0x0) returned 1
	[0096.315] ReadFile (in: hFile=0x1b4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.315] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0096.315] SetEndOfFile (hFile=0x188) returned 1
	[0096.316] CloseHandle (hObject=0x188) returned 1
	[0096.316] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.316] SetEndOfFile (hFile=0x1b4) returned 1
	[0096.317] CloseHandle (hObject=0x1b4) returned 1
	[0096.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.318] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm")) returned 1
	[0096.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77
	[0096.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77
	[0096.318] lstrlenW (lpString=".doc") returned 4
	[0096.318] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.318] lstrlenW (lpString=".docx") returned 5
	[0096.318] lstrcmpiW (lpString1=".docx", lpString2="G.ELM") returned -1
	[0096.318] lstrlenW (lpString=".pdf") returned 4
	[0096.318] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.318] lstrlenW (lpString=".xls") returned 4
	[0096.318] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.318] lstrlenW (lpString=".xlsx") returned 5
	[0096.318] lstrcmpiW (lpString1=".xlsx", lpString2="G.ELM") returned -1
	[0096.318] lstrlenW (lpString=".ppt") returned 4
	[0096.318] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77
	[0096.318] lstrlenW (lpString=".zip") returned 4
	[0096.318] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.318] lstrlenW (lpString=".rar") returned 4
	[0096.318] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.318] lstrlenW (lpString=".bz2") returned 4
	[0096.318] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.318] lstrlenW (lpString=".7z") returned 3
	[0096.318] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77
	[0096.319] lstrlenW (lpString=".dbf") returned 4
	[0096.319] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77
	[0096.319] lstrlenW (lpString=".1cd") returned 4
	[0096.319] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77
	[0096.319] lstrlenW (lpString=".jpg") returned 4
	[0096.319] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77
	[0096.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77
	[0096.319] lstrlenW (lpString=".doc") returned 4
	[0096.319] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.319] lstrlenW (lpString=".docx") returned 5
	[0096.319] lstrcmpiW (lpString1=".docx", lpString2="G.ELM") returned -1
	[0096.319] lstrlenW (lpString=".pdf") returned 4
	[0096.319] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.319] lstrlenW (lpString=".xls") returned 4
	[0096.319] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.319] lstrlenW (lpString=".xlsx") returned 5
	[0096.319] lstrcmpiW (lpString1=".xlsx", lpString2="G.ELM") returned -1
	[0096.319] lstrlenW (lpString=".ppt") returned 4
	[0096.319] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77
	[0096.319] lstrlenW (lpString=".zip") returned 4
	[0096.319] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.319] lstrlenW (lpString=".rar") returned 4
	[0096.320] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.320] lstrlenW (lpString=".bz2") returned 4
	[0096.320] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.320] lstrlenW (lpString=".7z") returned 3
	[0096.320] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77
	[0096.320] lstrlenW (lpString=".dbf") returned 4
	[0096.320] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77
	[0096.320] lstrlenW (lpString=".1cd") returned 4
	[0096.320] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77
	[0096.320] lstrlenW (lpString=".jpg") returned 4
	[0096.320] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.320] lstrcmpiW (lpString1=".ELM", lpString2=".adobe") returned 1
	[0096.320] lstrlenW (lpString="WATERMAR.ELM") returned 12
	[0096.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0096.332] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=49094) returned 1
	[0096.332] CloseHandle (hObject=0x1b4) returned 1
	[0096.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm")) returned 0x20
	[0096.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.350] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.350] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0096.366] GetLastError () returned 0x0
	[0096.366] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xbfc6, lpOverlapped=0x0) returned 1
	[0096.382] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xbfd0, lpOverlapped=0x0) returned 1
	[0096.383] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.384] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0096.384] SetEndOfFile (hFile=0x160) returned 1
	[0096.384] CloseHandle (hObject=0x160) returned 1
	[0096.384] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.384] SetEndOfFile (hFile=0x184) returned 1
	[0096.385] CloseHandle (hObject=0x184) returned 1
	[0096.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.385] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm")) returned 1
	[0096.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77
	[0096.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77
	[0096.386] lstrlenW (lpString=".doc") returned 4
	[0096.386] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.386] lstrlenW (lpString=".docx") returned 5
	[0096.386] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1
	[0096.386] lstrlenW (lpString=".pdf") returned 4
	[0096.386] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.386] lstrlenW (lpString=".xls") returned 4
	[0096.386] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.386] lstrlenW (lpString=".xlsx") returned 5
	[0096.386] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1
	[0096.386] lstrlenW (lpString=".ppt") returned 4
	[0096.386] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77
	[0096.386] lstrlenW (lpString=".zip") returned 4
	[0096.386] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.386] lstrlenW (lpString=".rar") returned 4
	[0096.386] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.386] lstrlenW (lpString=".bz2") returned 4
	[0096.386] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.386] lstrlenW (lpString=".7z") returned 3
	[0096.386] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77
	[0096.386] lstrlenW (lpString=".dbf") returned 4
	[0096.386] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77
	[0096.386] lstrlenW (lpString=".1cd") returned 4
	[0096.386] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77
	[0096.387] lstrlenW (lpString=".jpg") returned 4
	[0096.387] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77
	[0096.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77
	[0096.387] lstrlenW (lpString=".doc") returned 4
	[0096.387] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0096.387] lstrlenW (lpString=".docx") returned 5
	[0096.387] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1
	[0096.387] lstrlenW (lpString=".pdf") returned 4
	[0096.387] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0096.387] lstrlenW (lpString=".xls") returned 4
	[0096.387] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1
	[0096.387] lstrlenW (lpString=".xlsx") returned 5
	[0096.387] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1
	[0096.387] lstrlenW (lpString=".ppt") returned 4
	[0096.387] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0096.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77
	[0096.387] lstrlenW (lpString=".zip") returned 4
	[0096.387] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1
	[0096.387] lstrlenW (lpString=".rar") returned 4
	[0096.387] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0096.387] lstrlenW (lpString=".bz2") returned 4
	[0096.387] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0096.387] lstrlenW (lpString=".7z") returned 3
	[0096.387] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0096.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77
	[0096.387] lstrlenW (lpString=".dbf") returned 4
	[0096.387] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0096.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77
	[0096.387] lstrlenW (lpString=".1cd") returned 4
	[0096.387] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0096.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77
	[0096.387] lstrlenW (lpString=".jpg") returned 4
	[0096.387] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0096.388] lstrcmpiW (lpString1=".ITS", lpString2=".adobe") returned 1
	[0096.388] lstrlenW (lpString="MSB1ENES.ITS") returned 12
	[0096.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.388] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=978206) returned 1
	[0096.388] CloseHandle (hObject=0x184) returned 1
	[0096.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its")) returned 0x20
	[0096.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.389] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.389] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0096.389] GetLastError () returned 0x0
	[0096.389] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xeed1e, lpOverlapped=0x0) returned 1
	[0096.493] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xeed20, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xeed20, lpOverlapped=0x0) returned 1
	[0096.514] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.514] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0096.514] SetEndOfFile (hFile=0x160) returned 1
	[0096.514] CloseHandle (hObject=0x160) returned 1
	[0096.515] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.515] SetEndOfFile (hFile=0x184) returned 1
	[0096.543] CloseHandle (hObject=0x184) returned 1
	[0096.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.543] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its")) returned 1
	[0096.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73
	[0096.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73
	[0096.543] lstrlenW (lpString=".doc") returned 4
	[0096.543] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1
	[0096.543] lstrlenW (lpString=".docx") returned 5
	[0096.543] lstrcmpiW (lpString1=".docx", lpString2="S.ITS") returned -1
	[0096.543] lstrlenW (lpString=".pdf") returned 4
	[0096.543] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1
	[0096.543] lstrlenW (lpString=".xls") returned 4
	[0096.543] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1
	[0096.543] lstrlenW (lpString=".xlsx") returned 5
	[0096.544] lstrcmpiW (lpString1=".xlsx", lpString2="S.ITS") returned -1
	[0096.544] lstrlenW (lpString=".ppt") returned 4
	[0096.544] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1
	[0096.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73
	[0096.544] lstrlenW (lpString=".zip") returned 4
	[0096.544] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1
	[0096.544] lstrlenW (lpString=".rar") returned 4
	[0096.544] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1
	[0096.544] lstrlenW (lpString=".bz2") returned 4
	[0096.544] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1
	[0096.544] lstrlenW (lpString=".7z") returned 3
	[0096.544] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1
	[0096.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73
	[0096.544] lstrlenW (lpString=".dbf") returned 4
	[0096.544] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1
	[0096.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73
	[0096.544] lstrlenW (lpString=".1cd") returned 4
	[0096.544] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1
	[0096.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73
	[0096.544] lstrlenW (lpString=".jpg") returned 4
	[0096.544] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1
	[0096.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73
	[0096.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73
	[0096.544] lstrlenW (lpString=".doc") returned 4
	[0096.544] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1
	[0096.544] lstrlenW (lpString=".docx") returned 5
	[0096.544] lstrcmpiW (lpString1=".docx", lpString2="S.ITS") returned -1
	[0096.544] lstrlenW (lpString=".pdf") returned 4
	[0096.544] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1
	[0096.544] lstrlenW (lpString=".xls") returned 4
	[0096.544] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1
	[0096.545] lstrlenW (lpString=".xlsx") returned 5
	[0096.545] lstrcmpiW (lpString1=".xlsx", lpString2="S.ITS") returned -1
	[0096.545] lstrlenW (lpString=".ppt") returned 4
	[0096.545] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1
	[0096.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73
	[0096.545] lstrlenW (lpString=".zip") returned 4
	[0096.545] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1
	[0096.545] lstrlenW (lpString=".rar") returned 4
	[0096.545] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1
	[0096.545] lstrlenW (lpString=".bz2") returned 4
	[0096.545] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1
	[0096.545] lstrlenW (lpString=".7z") returned 3
	[0096.545] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1
	[0096.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73
	[0096.545] lstrlenW (lpString=".dbf") returned 4
	[0096.545] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1
	[0096.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73
	[0096.545] lstrlenW (lpString=".1cd") returned 4
	[0096.545] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1
	[0096.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73
	[0096.545] lstrlenW (lpString=".jpg") returned 4
	[0096.545] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1
	[0096.546] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0096.546] lstrlenW (lpString="MSB1ESEN.DLL") returned 12
	[0096.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.547] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=229888) returned 1
	[0096.547] CloseHandle (hObject=0x184) returned 1
	[0096.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll")) returned 0x20
	[0096.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.547] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.547] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0096.548] GetLastError () returned 0x0
	[0096.548] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x38200, lpOverlapped=0x0) returned 1
	[0096.565] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x38210, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x38210, lpOverlapped=0x0) returned 1
	[0096.569] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.570] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0096.570] SetEndOfFile (hFile=0x1c8) returned 1
	[0096.570] CloseHandle (hObject=0x1c8) returned 1
	[0096.570] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.570] SetEndOfFile (hFile=0x184) returned 1
	[0096.572] CloseHandle (hObject=0x184) returned 1
	[0096.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.573] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll")) returned 1
	[0096.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73
	[0096.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73
	[0096.573] lstrlenW (lpString=".doc") returned 4
	[0096.573] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0096.573] lstrlenW (lpString=".docx") returned 5
	[0096.573] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1
	[0096.573] lstrlenW (lpString=".pdf") returned 4
	[0096.573] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0096.573] lstrlenW (lpString=".xls") returned 4
	[0096.573] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0096.573] lstrlenW (lpString=".xlsx") returned 5
	[0096.573] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1
	[0096.573] lstrlenW (lpString=".ppt") returned 4
	[0096.573] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0096.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73
	[0096.573] lstrlenW (lpString=".zip") returned 4
	[0096.573] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0096.573] lstrlenW (lpString=".rar") returned 4
	[0096.573] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0096.573] lstrlenW (lpString=".bz2") returned 4
	[0096.573] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0096.573] lstrlenW (lpString=".7z") returned 3
	[0096.574] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0096.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73
	[0096.574] lstrlenW (lpString=".dbf") returned 4
	[0096.574] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0096.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73
	[0096.574] lstrlenW (lpString=".1cd") returned 4
	[0096.574] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0096.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73
	[0096.574] lstrlenW (lpString=".jpg") returned 4
	[0096.574] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0096.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73
	[0096.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73
	[0096.574] lstrlenW (lpString=".doc") returned 4
	[0096.574] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0096.574] lstrlenW (lpString=".docx") returned 5
	[0096.574] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1
	[0096.574] lstrlenW (lpString=".pdf") returned 4
	[0096.574] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0096.574] lstrlenW (lpString=".xls") returned 4
	[0096.574] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0096.574] lstrlenW (lpString=".xlsx") returned 5
	[0096.574] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1
	[0096.575] lstrlenW (lpString=".ppt") returned 4
	[0096.575] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0096.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73
	[0096.575] lstrlenW (lpString=".zip") returned 4
	[0096.575] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0096.575] lstrlenW (lpString=".rar") returned 4
	[0096.575] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0096.575] lstrlenW (lpString=".bz2") returned 4
	[0096.575] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0096.575] lstrlenW (lpString=".7z") returned 3
	[0096.575] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0096.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73
	[0096.575] lstrlenW (lpString=".dbf") returned 4
	[0096.575] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0096.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73
	[0096.575] lstrlenW (lpString=".1cd") returned 4
	[0096.575] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0096.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73
	[0096.575] lstrlenW (lpString=".jpg") returned 4
	[0096.575] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0096.575] lstrcmpiW (lpString1=".ITS", lpString2=".adobe") returned 1
	[0096.575] lstrlenW (lpString="MSB1ESEN.ITS") returned 12
	[0096.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.576] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1046514) returned 1
	[0096.576] CloseHandle (hObject=0x184) returned 1
	[0096.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its")) returned 0x20
	[0096.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.577] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.577] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0096.579] GetLastError () returned 0x0
	[0096.579] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xff7f2, lpOverlapped=0x0) returned 1
	[0096.799] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xff800, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xff800, lpOverlapped=0x0) returned 1
	[0096.873] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.873] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0096.873] SetEndOfFile (hFile=0x1c8) returned 1
	[0096.873] CloseHandle (hObject=0x1c8) returned 1
	[0096.873] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.874] SetEndOfFile (hFile=0x184) returned 1
	[0096.884] CloseHandle (hObject=0x184) returned 1
	[0096.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.885] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its")) returned 1
	[0096.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73
	[0096.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73
	[0096.885] lstrlenW (lpString=".doc") returned 4
	[0096.885] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1
	[0096.885] lstrlenW (lpString=".docx") returned 5
	[0096.885] lstrcmpiW (lpString1=".docx", lpString2="N.ITS") returned -1
	[0096.885] lstrlenW (lpString=".pdf") returned 4
	[0096.885] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1
	[0096.885] lstrlenW (lpString=".xls") returned 4
	[0096.885] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1
	[0096.885] lstrlenW (lpString=".xlsx") returned 5
	[0096.885] lstrcmpiW (lpString1=".xlsx", lpString2="N.ITS") returned -1
	[0096.885] lstrlenW (lpString=".ppt") returned 4
	[0096.885] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1
	[0096.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73
	[0096.885] lstrlenW (lpString=".zip") returned 4
	[0096.885] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1
	[0096.885] lstrlenW (lpString=".rar") returned 4
	[0096.886] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1
	[0096.886] lstrlenW (lpString=".bz2") returned 4
	[0096.886] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1
	[0096.886] lstrlenW (lpString=".7z") returned 3
	[0096.886] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1
	[0096.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73
	[0096.886] lstrlenW (lpString=".dbf") returned 4
	[0096.886] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1
	[0096.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73
	[0096.886] lstrlenW (lpString=".1cd") returned 4
	[0096.886] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1
	[0096.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73
	[0096.886] lstrlenW (lpString=".jpg") returned 4
	[0096.886] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1
	[0096.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73
	[0096.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73
	[0096.886] lstrlenW (lpString=".doc") returned 4
	[0096.886] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1
	[0096.886] lstrlenW (lpString=".docx") returned 5
	[0096.886] lstrcmpiW (lpString1=".docx", lpString2="N.ITS") returned -1
	[0096.886] lstrlenW (lpString=".pdf") returned 4
	[0096.886] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1
	[0096.886] lstrlenW (lpString=".xls") returned 4
	[0096.886] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1
	[0096.886] lstrlenW (lpString=".xlsx") returned 5
	[0096.887] lstrcmpiW (lpString1=".xlsx", lpString2="N.ITS") returned -1
	[0096.887] lstrlenW (lpString=".ppt") returned 4
	[0096.887] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1
	[0096.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73
	[0096.887] lstrlenW (lpString=".zip") returned 4
	[0096.887] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1
	[0096.887] lstrlenW (lpString=".rar") returned 4
	[0096.887] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1
	[0096.887] lstrlenW (lpString=".bz2") returned 4
	[0096.887] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1
	[0096.887] lstrlenW (lpString=".7z") returned 3
	[0096.887] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1
	[0096.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73
	[0096.887] lstrlenW (lpString=".dbf") returned 4
	[0096.887] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1
	[0096.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73
	[0096.887] lstrlenW (lpString=".1cd") returned 4
	[0096.887] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1
	[0096.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73
	[0096.887] lstrlenW (lpString=".jpg") returned 4
	[0096.887] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1
	[0096.887] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0096.888] lstrlenW (lpString="MSB1FREN.DLL") returned 12
	[0096.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.888] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=229888) returned 1
	[0096.888] CloseHandle (hObject=0x184) returned 1
	[0096.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll")) returned 0x20
	[0096.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.889] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.889] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0096.890] GetLastError () returned 0x0
	[0096.890] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x38200, lpOverlapped=0x0) returned 1
	[0096.964] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x38210, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x38210, lpOverlapped=0x0) returned 1
	[0096.969] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.969] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0096.969] SetEndOfFile (hFile=0x1c8) returned 1
	[0096.969] CloseHandle (hObject=0x1c8) returned 1
	[0096.970] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.970] SetEndOfFile (hFile=0x184) returned 1
	[0096.972] CloseHandle (hObject=0x184) returned 1
	[0096.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0096.973] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll")) returned 1
	[0096.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73
	[0096.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73
	[0096.973] lstrlenW (lpString=".doc") returned 4
	[0096.973] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0096.973] lstrlenW (lpString=".docx") returned 5
	[0096.973] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1
	[0096.973] lstrlenW (lpString=".pdf") returned 4
	[0096.973] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0096.973] lstrlenW (lpString=".xls") returned 4
	[0096.973] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0096.973] lstrlenW (lpString=".xlsx") returned 5
	[0096.973] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1
	[0096.973] lstrlenW (lpString=".ppt") returned 4
	[0096.973] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0096.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73
	[0096.973] lstrlenW (lpString=".zip") returned 4
	[0096.973] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0096.973] lstrlenW (lpString=".rar") returned 4
	[0096.973] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0096.974] lstrlenW (lpString=".bz2") returned 4
	[0096.974] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0096.974] lstrlenW (lpString=".7z") returned 3
	[0096.974] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0096.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73
	[0096.974] lstrlenW (lpString=".dbf") returned 4
	[0096.974] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0096.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73
	[0096.974] lstrlenW (lpString=".1cd") returned 4
	[0096.974] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0096.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73
	[0096.974] lstrlenW (lpString=".jpg") returned 4
	[0096.974] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0096.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73
	[0096.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73
	[0096.974] lstrlenW (lpString=".doc") returned 4
	[0096.974] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0096.974] lstrlenW (lpString=".docx") returned 5
	[0096.974] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1
	[0096.974] lstrlenW (lpString=".pdf") returned 4
	[0096.974] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0096.974] lstrlenW (lpString=".xls") returned 4
	[0096.974] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0096.974] lstrlenW (lpString=".xlsx") returned 5
	[0096.974] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1
	[0096.975] lstrlenW (lpString=".ppt") returned 4
	[0096.975] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0096.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73
	[0096.975] lstrlenW (lpString=".zip") returned 4
	[0096.975] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0096.975] lstrlenW (lpString=".rar") returned 4
	[0096.975] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0096.975] lstrlenW (lpString=".bz2") returned 4
	[0096.975] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0096.975] lstrlenW (lpString=".7z") returned 3
	[0096.975] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0096.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73
	[0096.975] lstrlenW (lpString=".dbf") returned 4
	[0096.975] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0096.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73
	[0096.975] lstrlenW (lpString=".1cd") returned 4
	[0096.975] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0096.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73
	[0096.975] lstrlenW (lpString=".jpg") returned 4
	[0096.975] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0096.976] lstrcmpiW (lpString1=".ITS", lpString2=".adobe") returned 1
	[0096.976] lstrlenW (lpString="MSB1FREN.ITS") returned 12
	[0096.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.976] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=840364) returned 1
	[0096.976] CloseHandle (hObject=0x184) returned 1
	[0096.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its")) returned 0x20
	[0096.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0096.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.977] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.977] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0096.987] GetLastError () returned 0x0
	[0096.987] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xcd2ac, lpOverlapped=0x0) returned 1
	[0097.068] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xcd2b0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xcd2b0, lpOverlapped=0x0) returned 1
	[0097.085] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.085] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0097.085] SetEndOfFile (hFile=0x174) returned 1
	[0097.085] CloseHandle (hObject=0x174) returned 1
	[0097.085] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.086] SetEndOfFile (hFile=0x184) returned 1
	[0097.093] CloseHandle (hObject=0x184) returned 1
	[0097.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.094] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its")) returned 1
	[0097.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73
	[0097.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73
	[0097.094] lstrlenW (lpString=".doc") returned 4
	[0097.094] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1
	[0097.094] lstrlenW (lpString=".docx") returned 5
	[0097.094] lstrcmpiW (lpString1=".docx", lpString2="N.ITS") returned -1
	[0097.094] lstrlenW (lpString=".pdf") returned 4
	[0097.094] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1
	[0097.094] lstrlenW (lpString=".xls") returned 4
	[0097.094] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1
	[0097.094] lstrlenW (lpString=".xlsx") returned 5
	[0097.094] lstrcmpiW (lpString1=".xlsx", lpString2="N.ITS") returned -1
	[0097.094] lstrlenW (lpString=".ppt") returned 4
	[0097.094] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1
	[0097.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73
	[0097.094] lstrlenW (lpString=".zip") returned 4
	[0097.094] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1
	[0097.094] lstrlenW (lpString=".rar") returned 4
	[0097.094] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1
	[0097.094] lstrlenW (lpString=".bz2") returned 4
	[0097.095] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1
	[0097.095] lstrlenW (lpString=".7z") returned 3
	[0097.095] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1
	[0097.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73
	[0097.095] lstrlenW (lpString=".dbf") returned 4
	[0097.095] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1
	[0097.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73
	[0097.095] lstrlenW (lpString=".1cd") returned 4
	[0097.095] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1
	[0097.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73
	[0097.095] lstrlenW (lpString=".jpg") returned 4
	[0097.095] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1
	[0097.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73
	[0097.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73
	[0097.095] lstrlenW (lpString=".doc") returned 4
	[0097.095] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1
	[0097.095] lstrlenW (lpString=".docx") returned 5
	[0097.095] lstrcmpiW (lpString1=".docx", lpString2="N.ITS") returned -1
	[0097.095] lstrlenW (lpString=".pdf") returned 4
	[0097.095] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1
	[0097.095] lstrlenW (lpString=".xls") returned 4
	[0097.095] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1
	[0097.095] lstrlenW (lpString=".xlsx") returned 5
	[0097.095] lstrcmpiW (lpString1=".xlsx", lpString2="N.ITS") returned -1
	[0097.095] lstrlenW (lpString=".ppt") returned 4
	[0097.095] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1
	[0097.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73
	[0097.095] lstrlenW (lpString=".zip") returned 4
	[0097.095] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1
	[0097.095] lstrlenW (lpString=".rar") returned 4
	[0097.096] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1
	[0097.096] lstrlenW (lpString=".bz2") returned 4
	[0097.096] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1
	[0097.096] lstrlenW (lpString=".7z") returned 3
	[0097.096] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1
	[0097.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73
	[0097.096] lstrlenW (lpString=".dbf") returned 4
	[0097.096] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1
	[0097.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73
	[0097.096] lstrlenW (lpString=".1cd") returned 4
	[0097.096] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1
	[0097.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73
	[0097.096] lstrlenW (lpString=".jpg") returned 4
	[0097.096] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1
	[0097.096] lstrcmpiW (lpString1=".LEX", lpString2=".adobe") returned 1
	[0097.096] lstrlenW (lpString="MSB1CACH.LEX") returned 12
	[0097.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0097.128] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1536) returned 1
	[0097.128] CloseHandle (hObject=0x1a0) returned 1
	[0097.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex")) returned 0x20
	[0097.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0097.141] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.141] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0097.148] GetLastError () returned 0x0
	[0097.148] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x600, lpOverlapped=0x0) returned 1
	[0097.155] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x610, lpOverlapped=0x0) returned 1
	[0097.156] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.156] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0097.156] SetEndOfFile (hFile=0x178) returned 1
	[0097.156] CloseHandle (hObject=0x178) returned 1
	[0097.156] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.156] SetEndOfFile (hFile=0x160) returned 1
	[0097.157] CloseHandle (hObject=0x160) returned 1
	[0097.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.157] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex")) returned 1
	[0097.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68
	[0097.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68
	[0097.158] lstrlenW (lpString=".doc") returned 4
	[0097.158] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1
	[0097.158] lstrlenW (lpString=".docx") returned 5
	[0097.158] lstrcmpiW (lpString1=".docx", lpString2="H.LEX") returned -1
	[0097.158] lstrlenW (lpString=".pdf") returned 4
	[0097.158] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1
	[0097.158] lstrlenW (lpString=".xls") returned 4
	[0097.158] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1
	[0097.158] lstrlenW (lpString=".xlsx") returned 5
	[0097.158] lstrcmpiW (lpString1=".xlsx", lpString2="H.LEX") returned -1
	[0097.158] lstrlenW (lpString=".ppt") returned 4
	[0097.158] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1
	[0097.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68
	[0097.158] lstrlenW (lpString=".zip") returned 4
	[0097.158] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1
	[0097.158] lstrlenW (lpString=".rar") returned 4
	[0097.158] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1
	[0097.158] lstrlenW (lpString=".bz2") returned 4
	[0097.158] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1
	[0097.158] lstrlenW (lpString=".7z") returned 3
	[0097.158] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1
	[0097.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68
	[0097.158] lstrlenW (lpString=".dbf") returned 4
	[0097.158] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1
	[0097.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68
	[0097.158] lstrlenW (lpString=".1cd") returned 4
	[0097.158] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1
	[0097.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68
	[0097.158] lstrlenW (lpString=".jpg") returned 4
	[0097.158] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1
	[0097.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68
	[0097.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68
	[0097.159] lstrlenW (lpString=".doc") returned 4
	[0097.159] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1
	[0097.159] lstrlenW (lpString=".docx") returned 5
	[0097.159] lstrcmpiW (lpString1=".docx", lpString2="H.LEX") returned -1
	[0097.159] lstrlenW (lpString=".pdf") returned 4
	[0097.159] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1
	[0097.159] lstrlenW (lpString=".xls") returned 4
	[0097.159] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1
	[0097.159] lstrlenW (lpString=".xlsx") returned 5
	[0097.159] lstrcmpiW (lpString1=".xlsx", lpString2="H.LEX") returned -1
	[0097.159] lstrlenW (lpString=".ppt") returned 4
	[0097.159] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1
	[0097.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68
	[0097.159] lstrlenW (lpString=".zip") returned 4
	[0097.159] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1
	[0097.159] lstrlenW (lpString=".rar") returned 4
	[0097.159] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1
	[0097.159] lstrlenW (lpString=".bz2") returned 4
	[0097.159] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1
	[0097.159] lstrlenW (lpString=".7z") returned 3
	[0097.159] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1
	[0097.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68
	[0097.159] lstrlenW (lpString=".dbf") returned 4
	[0097.159] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1
	[0097.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68
	[0097.159] lstrlenW (lpString=".1cd") returned 4
	[0097.159] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1
	[0097.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68
	[0097.159] lstrlenW (lpString=".jpg") returned 4
	[0097.159] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1
	[0097.160] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0097.160] lstrlenW (lpString="MSB1CORE.DLL") returned 12
	[0097.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0097.161] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=178576) returned 1
	[0097.161] CloseHandle (hObject=0x178) returned 1
	[0097.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll")) returned 0x20
	[0097.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0097.161] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.161] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0097.162] GetLastError () returned 0x0
	[0097.162] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x2b990, lpOverlapped=0x0) returned 1
	[0097.169] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2b9a0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2b9a0, lpOverlapped=0x0) returned 1
	[0097.173] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.173] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0097.173] SetEndOfFile (hFile=0x174) returned 1
	[0097.173] CloseHandle (hObject=0x174) returned 1
	[0097.173] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.173] SetEndOfFile (hFile=0x178) returned 1
	[0097.175] CloseHandle (hObject=0x178) returned 1
	[0097.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.175] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll")) returned 1
	[0097.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68
	[0097.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68
	[0097.175] lstrlenW (lpString=".doc") returned 4
	[0097.175] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0097.175] lstrlenW (lpString=".docx") returned 5
	[0097.175] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1
	[0097.175] lstrlenW (lpString=".pdf") returned 4
	[0097.175] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0097.175] lstrlenW (lpString=".xls") returned 4
	[0097.176] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0097.176] lstrlenW (lpString=".xlsx") returned 5
	[0097.176] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1
	[0097.176] lstrlenW (lpString=".ppt") returned 4
	[0097.176] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0097.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68
	[0097.176] lstrlenW (lpString=".zip") returned 4
	[0097.176] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0097.176] lstrlenW (lpString=".rar") returned 4
	[0097.176] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0097.176] lstrlenW (lpString=".bz2") returned 4
	[0097.176] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0097.176] lstrlenW (lpString=".7z") returned 3
	[0097.176] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0097.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68
	[0097.176] lstrlenW (lpString=".dbf") returned 4
	[0097.176] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0097.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68
	[0097.176] lstrlenW (lpString=".1cd") returned 4
	[0097.176] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0097.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68
	[0097.176] lstrlenW (lpString=".jpg") returned 4
	[0097.176] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0097.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68
	[0097.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68
	[0097.176] lstrlenW (lpString=".doc") returned 4
	[0097.176] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0097.176] lstrlenW (lpString=".docx") returned 5
	[0097.176] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1
	[0097.176] lstrlenW (lpString=".pdf") returned 4
	[0097.176] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0097.176] lstrlenW (lpString=".xls") returned 4
	[0097.176] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0097.176] lstrlenW (lpString=".xlsx") returned 5
	[0097.177] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1
	[0097.177] lstrlenW (lpString=".ppt") returned 4
	[0097.177] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0097.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68
	[0097.177] lstrlenW (lpString=".zip") returned 4
	[0097.177] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0097.177] lstrlenW (lpString=".rar") returned 4
	[0097.177] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0097.177] lstrlenW (lpString=".bz2") returned 4
	[0097.177] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0097.177] lstrlenW (lpString=".7z") returned 3
	[0097.177] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0097.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68
	[0097.177] lstrlenW (lpString=".dbf") returned 4
	[0097.177] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0097.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68
	[0097.177] lstrlenW (lpString=".1cd") returned 4
	[0097.177] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0097.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68
	[0097.177] lstrlenW (lpString=".jpg") returned 4
	[0097.177] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0097.177] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0097.177] lstrlenW (lpString="MSB1STAR.DLL") returned 12
	[0097.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0097.178] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=266096) returned 1
	[0097.178] CloseHandle (hObject=0x178) returned 1
	[0097.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll")) returned 0x20
	[0097.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0097.179] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.179] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0097.180] GetLastError () returned 0x0
	[0097.180] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x40f70, lpOverlapped=0x0) returned 1
	[0097.234] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x40f80, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x40f80, lpOverlapped=0x0) returned 1
	[0097.241] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.241] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0097.242] SetEndOfFile (hFile=0x174) returned 1
	[0097.242] CloseHandle (hObject=0x174) returned 1
	[0097.242] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.242] SetEndOfFile (hFile=0x178) returned 1
	[0097.245] CloseHandle (hObject=0x178) returned 1
	[0097.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.246] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll")) returned 1
	[0097.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68
	[0097.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68
	[0097.246] lstrlenW (lpString=".doc") returned 4
	[0097.246] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0097.246] lstrlenW (lpString=".docx") returned 5
	[0097.246] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0097.246] lstrlenW (lpString=".pdf") returned 4
	[0097.246] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0097.246] lstrlenW (lpString=".xls") returned 4
	[0097.246] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0097.246] lstrlenW (lpString=".xlsx") returned 5
	[0097.246] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0097.247] lstrlenW (lpString=".ppt") returned 4
	[0097.247] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0097.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68
	[0097.247] lstrlenW (lpString=".zip") returned 4
	[0097.247] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0097.247] lstrlenW (lpString=".rar") returned 4
	[0097.247] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0097.247] lstrlenW (lpString=".bz2") returned 4
	[0097.247] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0097.247] lstrlenW (lpString=".7z") returned 3
	[0097.247] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0097.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68
	[0097.247] lstrlenW (lpString=".dbf") returned 4
	[0097.247] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0097.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68
	[0097.247] lstrlenW (lpString=".1cd") returned 4
	[0097.247] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0097.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68
	[0097.247] lstrlenW (lpString=".jpg") returned 4
	[0097.247] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0097.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68
	[0097.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68
	[0097.247] lstrlenW (lpString=".doc") returned 4
	[0097.248] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0097.248] lstrlenW (lpString=".docx") returned 5
	[0097.248] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0097.248] lstrlenW (lpString=".pdf") returned 4
	[0097.248] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0097.248] lstrlenW (lpString=".xls") returned 4
	[0097.248] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0097.248] lstrlenW (lpString=".xlsx") returned 5
	[0097.248] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0097.248] lstrlenW (lpString=".ppt") returned 4
	[0097.248] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0097.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68
	[0097.248] lstrlenW (lpString=".zip") returned 4
	[0097.248] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0097.248] lstrlenW (lpString=".rar") returned 4
	[0097.248] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0097.248] lstrlenW (lpString=".bz2") returned 4
	[0097.248] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0097.248] lstrlenW (lpString=".7z") returned 3
	[0097.248] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0097.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68
	[0097.248] lstrlenW (lpString=".dbf") returned 4
	[0097.248] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0097.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68
	[0097.248] lstrlenW (lpString=".1cd") returned 4
	[0097.248] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0097.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68
	[0097.249] lstrlenW (lpString=".jpg") returned 4
	[0097.249] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0097.249] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0097.249] lstrlenW (lpString="MSB1XTOR.DLL") returned 12
	[0097.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0097.256] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=70544) returned 1
	[0097.256] CloseHandle (hObject=0x190) returned 1
	[0097.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll")) returned 0x20
	[0097.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0097.257] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.257] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0097.257] GetLastError () returned 0x0
	[0097.257] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x11390, lpOverlapped=0x0) returned 1
	[0097.264] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x113a0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x113a0, lpOverlapped=0x0) returned 1
	[0097.267] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.267] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0097.267] SetEndOfFile (hFile=0x178) returned 1
	[0097.267] CloseHandle (hObject=0x178) returned 1
	[0097.267] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.267] SetEndOfFile (hFile=0x190) returned 1
	[0097.272] CloseHandle (hObject=0x190) returned 1
	[0097.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.272] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll")) returned 1
	[0097.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68
	[0097.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68
	[0097.273] lstrlenW (lpString=".doc") returned 4
	[0097.273] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0097.273] lstrlenW (lpString=".docx") returned 5
	[0097.273] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0097.273] lstrlenW (lpString=".pdf") returned 4
	[0097.273] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0097.273] lstrlenW (lpString=".xls") returned 4
	[0097.273] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0097.273] lstrlenW (lpString=".xlsx") returned 5
	[0097.273] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0097.273] lstrlenW (lpString=".ppt") returned 4
	[0097.273] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0097.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68
	[0097.273] lstrlenW (lpString=".zip") returned 4
	[0097.273] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0097.273] lstrlenW (lpString=".rar") returned 4
	[0097.273] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0097.273] lstrlenW (lpString=".bz2") returned 4
	[0097.273] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0097.273] lstrlenW (lpString=".7z") returned 3
	[0097.274] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0097.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68
	[0097.274] lstrlenW (lpString=".dbf") returned 4
	[0097.274] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0097.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68
	[0097.274] lstrlenW (lpString=".1cd") returned 4
	[0097.274] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0097.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68
	[0097.274] lstrlenW (lpString=".jpg") returned 4
	[0097.274] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0097.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68
	[0097.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68
	[0097.274] lstrlenW (lpString=".doc") returned 4
	[0097.274] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0097.274] lstrlenW (lpString=".docx") returned 5
	[0097.274] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0097.274] lstrlenW (lpString=".pdf") returned 4
	[0097.274] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0097.274] lstrlenW (lpString=".xls") returned 4
	[0097.274] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0097.274] lstrlenW (lpString=".xlsx") returned 5
	[0097.274] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0097.274] lstrlenW (lpString=".ppt") returned 4
	[0097.274] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0097.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68
	[0097.274] lstrlenW (lpString=".zip") returned 4
	[0097.275] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0097.275] lstrlenW (lpString=".rar") returned 4
	[0097.275] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0097.275] lstrlenW (lpString=".bz2") returned 4
	[0097.275] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0097.275] lstrlenW (lpString=".7z") returned 3
	[0097.275] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0097.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68
	[0097.275] lstrlenW (lpString=".dbf") returned 4
	[0097.275] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0097.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68
	[0097.275] lstrlenW (lpString=".1cd") returned 4
	[0097.275] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0097.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68
	[0097.275] lstrlenW (lpString=".jpg") returned 4
	[0097.275] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0097.275] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0097.275] lstrlenW (lpString="WTSP61MS.DLL") returned 12
	[0097.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0097.276] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=221184) returned 1
	[0097.276] CloseHandle (hObject=0x190) returned 1
	[0097.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll")) returned 0x20
	[0097.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0097.277] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.277] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0097.278] GetLastError () returned 0x0
	[0097.278] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x36000, lpOverlapped=0x0) returned 1
	[0097.323] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x36010, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x36010, lpOverlapped=0x0) returned 1
	[0097.329] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.329] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0097.329] SetEndOfFile (hFile=0x178) returned 1
	[0097.329] CloseHandle (hObject=0x178) returned 1
	[0097.329] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.329] SetEndOfFile (hFile=0x190) returned 1
	[0097.332] CloseHandle (hObject=0x190) returned 1
	[0097.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.333] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll")) returned 1
	[0097.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68
	[0097.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68
	[0097.333] lstrlenW (lpString=".doc") returned 4
	[0097.333] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0097.333] lstrlenW (lpString=".docx") returned 5
	[0097.333] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0097.333] lstrlenW (lpString=".pdf") returned 4
	[0097.333] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0097.333] lstrlenW (lpString=".xls") returned 4
	[0097.333] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0097.333] lstrlenW (lpString=".xlsx") returned 5
	[0097.333] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0097.333] lstrlenW (lpString=".ppt") returned 4
	[0097.333] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0097.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68
	[0097.334] lstrlenW (lpString=".zip") returned 4
	[0097.334] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0097.334] lstrlenW (lpString=".rar") returned 4
	[0097.334] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0097.334] lstrlenW (lpString=".bz2") returned 4
	[0097.334] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0097.334] lstrlenW (lpString=".7z") returned 3
	[0097.334] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0097.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68
	[0097.334] lstrlenW (lpString=".dbf") returned 4
	[0097.334] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0097.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68
	[0097.334] lstrlenW (lpString=".1cd") returned 4
	[0097.334] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0097.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68
	[0097.334] lstrlenW (lpString=".jpg") returned 4
	[0097.334] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0097.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68
	[0097.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68
	[0097.334] lstrlenW (lpString=".doc") returned 4
	[0097.334] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0097.334] lstrlenW (lpString=".docx") returned 5
	[0097.334] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0097.334] lstrlenW (lpString=".pdf") returned 4
	[0097.334] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0097.335] lstrlenW (lpString=".xls") returned 4
	[0097.335] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0097.335] lstrlenW (lpString=".xlsx") returned 5
	[0097.335] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0097.335] lstrlenW (lpString=".ppt") returned 4
	[0097.335] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0097.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68
	[0097.335] lstrlenW (lpString=".zip") returned 4
	[0097.335] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0097.335] lstrlenW (lpString=".rar") returned 4
	[0097.335] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0097.335] lstrlenW (lpString=".bz2") returned 4
	[0097.335] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0097.335] lstrlenW (lpString=".7z") returned 3
	[0097.335] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0097.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68
	[0097.335] lstrlenW (lpString=".dbf") returned 4
	[0097.335] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0097.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68
	[0097.335] lstrlenW (lpString=".1cd") returned 4
	[0097.335] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0097.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68
	[0097.335] lstrlenW (lpString=".jpg") returned 4
	[0097.335] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0097.336] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0097.336] lstrlenW (lpString="VBE7INTL.DLL") returned 12
	[0097.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0097.365] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=154960) returned 1
	[0097.365] CloseHandle (hObject=0x188) returned 1
	[0097.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll")) returned 0x20
	[0097.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0097.366] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.366] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0097.369] GetLastError () returned 0x0
	[0097.369] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x25d50, lpOverlapped=0x0) returned 1
	[0097.424] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x25d60, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x25d60, lpOverlapped=0x0) returned 1
	[0097.429] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.429] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0097.430] SetEndOfFile (hFile=0x178) returned 1
	[0097.430] CloseHandle (hObject=0x178) returned 1
	[0097.430] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.430] SetEndOfFile (hFile=0x188) returned 1
	[0097.432] CloseHandle (hObject=0x188) returned 1
	[0097.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.432] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll")) returned 1
	[0097.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73
	[0097.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73
	[0097.433] lstrlenW (lpString=".doc") returned 4
	[0097.433] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0097.433] lstrlenW (lpString=".docx") returned 5
	[0097.433] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0097.433] lstrlenW (lpString=".pdf") returned 4
	[0097.433] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0097.433] lstrlenW (lpString=".xls") returned 4
	[0097.433] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0097.433] lstrlenW (lpString=".xlsx") returned 5
	[0097.433] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0097.433] lstrlenW (lpString=".ppt") returned 4
	[0097.433] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0097.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73
	[0097.433] lstrlenW (lpString=".zip") returned 4
	[0097.433] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0097.433] lstrlenW (lpString=".rar") returned 4
	[0097.433] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0097.433] lstrlenW (lpString=".bz2") returned 4
	[0097.433] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0097.433] lstrlenW (lpString=".7z") returned 3
	[0097.433] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0097.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73
	[0097.434] lstrlenW (lpString=".dbf") returned 4
	[0097.434] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0097.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73
	[0097.434] lstrlenW (lpString=".1cd") returned 4
	[0097.434] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0097.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73
	[0097.434] lstrlenW (lpString=".jpg") returned 4
	[0097.434] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0097.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73
	[0097.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73
	[0097.434] lstrlenW (lpString=".doc") returned 4
	[0097.434] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0097.434] lstrlenW (lpString=".docx") returned 5
	[0097.434] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0097.434] lstrlenW (lpString=".pdf") returned 4
	[0097.434] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0097.434] lstrlenW (lpString=".xls") returned 4
	[0097.434] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0097.434] lstrlenW (lpString=".xlsx") returned 5
	[0097.434] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0097.434] lstrlenW (lpString=".ppt") returned 4
	[0097.434] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0097.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73
	[0097.434] lstrlenW (lpString=".zip") returned 4
	[0097.435] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0097.435] lstrlenW (lpString=".rar") returned 4
	[0097.435] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0097.435] lstrlenW (lpString=".bz2") returned 4
	[0097.435] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0097.435] lstrlenW (lpString=".7z") returned 3
	[0097.435] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0097.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73
	[0097.435] lstrlenW (lpString=".dbf") returned 4
	[0097.435] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0097.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73
	[0097.435] lstrlenW (lpString=".1cd") returned 4
	[0097.435] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0097.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73
	[0097.435] lstrlenW (lpString=".jpg") returned 4
	[0097.435] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0097.435] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0097.435] lstrlenW (lpString="msdia100.dll") returned 12
	[0097.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0097.437] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=990032) returned 1
	[0097.437] CloseHandle (hObject=0x188) returned 1
	[0097.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20
	[0097.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0097.439] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.439] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0097.440] GetLastError () returned 0x0
	[0097.440] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xf1b50, lpOverlapped=0x0) returned 1
	[0097.589] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf1b60, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf1b60, lpOverlapped=0x0) returned 1
	[0097.617] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.617] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0097.617] SetEndOfFile (hFile=0x178) returned 1
	[0097.617] CloseHandle (hObject=0x178) returned 1
	[0097.617] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.617] SetEndOfFile (hFile=0x188) returned 1
	[0097.627] CloseHandle (hObject=0x188) returned 1
	[0097.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.627] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 1
	[0097.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62
	[0097.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62
	[0097.627] lstrlenW (lpString=".doc") returned 4
	[0097.627] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0097.627] lstrlenW (lpString=".docx") returned 5
	[0097.627] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0097.627] lstrlenW (lpString=".pdf") returned 4
	[0097.627] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0097.627] lstrlenW (lpString=".xls") returned 4
	[0097.627] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0097.628] lstrlenW (lpString=".xlsx") returned 5
	[0097.628] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0097.628] lstrlenW (lpString=".ppt") returned 4
	[0097.628] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0097.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62
	[0097.628] lstrlenW (lpString=".zip") returned 4
	[0097.628] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0097.628] lstrlenW (lpString=".rar") returned 4
	[0097.628] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0097.628] lstrlenW (lpString=".bz2") returned 4
	[0097.628] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0097.628] lstrlenW (lpString=".7z") returned 3
	[0097.628] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0097.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62
	[0097.628] lstrlenW (lpString=".dbf") returned 4
	[0097.628] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0097.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62
	[0097.628] lstrlenW (lpString=".1cd") returned 4
	[0097.628] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0097.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62
	[0097.628] lstrlenW (lpString=".jpg") returned 4
	[0097.628] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0097.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62
	[0097.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62
	[0097.628] lstrlenW (lpString=".doc") returned 4
	[0097.628] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0097.629] lstrlenW (lpString=".docx") returned 5
	[0097.629] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0097.629] lstrlenW (lpString=".pdf") returned 4
	[0097.629] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0097.629] lstrlenW (lpString=".xls") returned 4
	[0097.629] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0097.629] lstrlenW (lpString=".xlsx") returned 5
	[0097.629] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0097.629] lstrlenW (lpString=".ppt") returned 4
	[0097.629] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0097.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62
	[0097.629] lstrlenW (lpString=".zip") returned 4
	[0097.629] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0097.629] lstrlenW (lpString=".rar") returned 4
	[0097.629] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0097.629] lstrlenW (lpString=".bz2") returned 4
	[0097.629] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0097.629] lstrlenW (lpString=".7z") returned 3
	[0097.629] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0097.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62
	[0097.629] lstrlenW (lpString=".dbf") returned 4
	[0097.629] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0097.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62
	[0097.629] lstrlenW (lpString=".1cd") returned 4
	[0097.629] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0097.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62
	[0097.629] lstrlenW (lpString=".jpg") returned 4
	[0097.629] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0097.630] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0097.630] lstrlenW (lpString="VGX.dll") returned 7
	[0097.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0097.631] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1110528) returned 1
	[0097.631] CloseHandle (hObject=0x188) returned 1
	[0097.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20
	[0097.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0097.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58
	[0097.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58
	[0097.631] lstrlenW (lpString=".doc") returned 4
	[0097.631] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0097.632] lstrlenW (lpString=".docx") returned 5
	[0097.632] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0097.632] lstrlenW (lpString=".pdf") returned 4
	[0097.632] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0097.632] lstrlenW (lpString=".xls") returned 4
	[0097.632] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0097.632] lstrlenW (lpString=".xlsx") returned 5
	[0097.632] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0097.632] lstrlenW (lpString=".ppt") returned 4
	[0097.632] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0097.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58
	[0097.632] lstrlenW (lpString=".zip") returned 4
	[0097.632] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0097.632] lstrlenW (lpString=".rar") returned 4
	[0097.632] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0097.632] lstrlenW (lpString=".bz2") returned 4
	[0097.632] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0097.632] lstrlenW (lpString=".7z") returned 3
	[0097.632] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0097.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58
	[0097.632] lstrlenW (lpString=".dbf") returned 4
	[0097.632] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0097.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58
	[0097.632] lstrlenW (lpString=".1cd") returned 4
	[0097.632] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0097.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58
	[0097.633] lstrlenW (lpString=".jpg") returned 4
	[0097.633] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0097.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58
	[0097.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58
	[0097.633] lstrlenW (lpString=".doc") returned 4
	[0097.633] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0097.633] lstrlenW (lpString=".docx") returned 5
	[0097.633] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0097.633] lstrlenW (lpString=".pdf") returned 4
	[0097.633] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0097.633] lstrlenW (lpString=".xls") returned 4
	[0097.633] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0097.633] lstrlenW (lpString=".xlsx") returned 5
	[0097.633] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0097.633] lstrlenW (lpString=".ppt") returned 4
	[0097.633] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0097.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58
	[0097.633] lstrlenW (lpString=".zip") returned 4
	[0097.633] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0097.633] lstrlenW (lpString=".rar") returned 4
	[0097.633] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0097.633] lstrlenW (lpString=".bz2") returned 4
	[0097.633] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0097.634] lstrlenW (lpString=".7z") returned 3
	[0097.634] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0097.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58
	[0097.634] lstrlenW (lpString=".dbf") returned 4
	[0097.634] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0097.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58
	[0097.634] lstrlenW (lpString=".1cd") returned 4
	[0097.634] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0097.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58
	[0097.634] lstrlenW (lpString=".jpg") returned 4
	[0097.634] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0097.634] lstrcmpiW (lpString1=".SHX", lpString2=".adobe") returned 1
	[0097.634] lstrlenW (lpString="BIGFONT.SHX") returned 11
	[0097.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0097.636] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=324330) returned 1
	[0097.636] CloseHandle (hObject=0x188) returned 1
	[0097.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx")) returned 0x20
	[0097.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0097.640] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.640] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0097.641] GetLastError () returned 0x0
	[0097.641] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x4f2ea, lpOverlapped=0x0) returned 1
	[0097.731] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4f2f0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x4f2f0, lpOverlapped=0x0) returned 1
	[0097.744] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.744] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0097.744] SetEndOfFile (hFile=0x178) returned 1
	[0097.744] CloseHandle (hObject=0x178) returned 1
	[0097.745] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.745] SetEndOfFile (hFile=0x188) returned 1
	[0097.749] CloseHandle (hObject=0x188) returned 1
	[0097.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.749] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx")) returned 1
	[0097.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77
	[0097.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77
	[0097.750] lstrlenW (lpString=".doc") returned 4
	[0097.750] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0097.750] lstrlenW (lpString=".docx") returned 5
	[0097.750] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0097.750] lstrlenW (lpString=".pdf") returned 4
	[0097.750] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0097.750] lstrlenW (lpString=".xls") returned 4
	[0097.750] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0097.750] lstrlenW (lpString=".xlsx") returned 5
	[0097.750] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0097.750] lstrlenW (lpString=".ppt") returned 4
	[0097.750] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0097.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77
	[0097.750] lstrlenW (lpString=".zip") returned 4
	[0097.750] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0097.750] lstrlenW (lpString=".rar") returned 4
	[0097.750] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0097.750] lstrlenW (lpString=".bz2") returned 4
	[0097.750] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0097.751] lstrlenW (lpString=".7z") returned 3
	[0097.751] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0097.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77
	[0097.751] lstrlenW (lpString=".dbf") returned 4
	[0097.751] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0097.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77
	[0097.751] lstrlenW (lpString=".1cd") returned 4
	[0097.751] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0097.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77
	[0097.751] lstrlenW (lpString=".jpg") returned 4
	[0097.751] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0097.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77
	[0097.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77
	[0097.751] lstrlenW (lpString=".doc") returned 4
	[0097.751] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0097.751] lstrlenW (lpString=".docx") returned 5
	[0097.751] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0097.751] lstrlenW (lpString=".pdf") returned 4
	[0097.751] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0097.751] lstrlenW (lpString=".xls") returned 4
	[0097.752] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0097.752] lstrlenW (lpString=".xlsx") returned 5
	[0097.752] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0097.752] lstrlenW (lpString=".ppt") returned 4
	[0097.752] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0097.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77
	[0097.752] lstrlenW (lpString=".zip") returned 4
	[0097.752] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0097.752] lstrlenW (lpString=".rar") returned 4
	[0097.752] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0097.752] lstrlenW (lpString=".bz2") returned 4
	[0097.752] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0097.752] lstrlenW (lpString=".7z") returned 3
	[0097.752] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0097.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77
	[0097.752] lstrlenW (lpString=".dbf") returned 4
	[0097.752] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0097.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77
	[0097.752] lstrlenW (lpString=".1cd") returned 4
	[0097.752] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0097.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77
	[0097.752] lstrlenW (lpString=".jpg") returned 4
	[0097.752] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0097.753] lstrcmpiW (lpString1=".SHX", lpString2=".adobe") returned 1
	[0097.753] lstrlenW (lpString="EXTFONT.SHX") returned 11
	[0097.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0097.754] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=436710) returned 1
	[0097.754] CloseHandle (hObject=0x188) returned 1
	[0097.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx")) returned 0x20
	[0097.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0097.754] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.754] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0097.755] GetLastError () returned 0x0
	[0097.755] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x6a9e6, lpOverlapped=0x0) returned 1
	[0097.809] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x6a9f0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x6a9f0, lpOverlapped=0x0) returned 1
	[0097.819] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.819] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0097.819] SetEndOfFile (hFile=0x178) returned 1
	[0097.819] CloseHandle (hObject=0x178) returned 1
	[0097.819] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.819] SetEndOfFile (hFile=0x188) returned 1
	[0097.823] CloseHandle (hObject=0x188) returned 1
	[0097.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.824] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx")) returned 1
	[0097.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77
	[0097.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77
	[0097.824] lstrlenW (lpString=".doc") returned 4
	[0097.824] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0097.824] lstrlenW (lpString=".docx") returned 5
	[0097.824] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0097.824] lstrlenW (lpString=".pdf") returned 4
	[0097.824] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0097.824] lstrlenW (lpString=".xls") returned 4
	[0097.824] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0097.824] lstrlenW (lpString=".xlsx") returned 5
	[0097.824] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0097.824] lstrlenW (lpString=".ppt") returned 4
	[0097.824] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0097.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77
	[0097.824] lstrlenW (lpString=".zip") returned 4
	[0097.824] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0097.824] lstrlenW (lpString=".rar") returned 4
	[0097.824] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0097.824] lstrlenW (lpString=".bz2") returned 4
	[0097.824] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0097.824] lstrlenW (lpString=".7z") returned 3
	[0097.824] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0097.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77
	[0097.824] lstrlenW (lpString=".dbf") returned 4
	[0097.824] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0097.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77
	[0097.825] lstrlenW (lpString=".1cd") returned 4
	[0097.825] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0097.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77
	[0097.825] lstrlenW (lpString=".jpg") returned 4
	[0097.825] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0097.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77
	[0097.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77
	[0097.825] lstrlenW (lpString=".doc") returned 4
	[0097.825] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0097.825] lstrlenW (lpString=".docx") returned 5
	[0097.825] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0097.825] lstrlenW (lpString=".pdf") returned 4
	[0097.825] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0097.825] lstrlenW (lpString=".xls") returned 4
	[0097.825] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0097.825] lstrlenW (lpString=".xlsx") returned 5
	[0097.825] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0097.825] lstrlenW (lpString=".ppt") returned 4
	[0097.825] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0097.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77
	[0097.825] lstrlenW (lpString=".zip") returned 4
	[0097.825] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0097.825] lstrlenW (lpString=".rar") returned 4
	[0097.825] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0097.825] lstrlenW (lpString=".bz2") returned 4
	[0097.825] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0097.825] lstrlenW (lpString=".7z") returned 3
	[0097.825] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0097.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77
	[0097.825] lstrlenW (lpString=".dbf") returned 4
	[0097.825] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0097.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77
	[0097.826] lstrlenW (lpString=".1cd") returned 4
	[0097.826] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0097.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77
	[0097.826] lstrlenW (lpString=".jpg") returned 4
	[0097.826] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0097.826] lstrcmpiW (lpString1=".SHX", lpString2=".adobe") returned 1
	[0097.826] lstrlenW (lpString="GBCBIG.SHX") returned 10
	[0097.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0097.827] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=902841) returned 1
	[0097.827] CloseHandle (hObject=0x188) returned 1
	[0097.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx")) returned 0x20
	[0097.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0097.827] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.827] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0097.828] GetLastError () returned 0x0
	[0097.828] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xdc6b9, lpOverlapped=0x0) returned 1
	[0097.927] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xdc6c0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xdc6c0, lpOverlapped=0x0) returned 1
	[0097.943] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.943] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0097.945] SetEndOfFile (hFile=0x178) returned 1
	[0097.946] CloseHandle (hObject=0x178) returned 1
	[0097.946] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.946] SetEndOfFile (hFile=0x188) returned 1
	[0097.953] CloseHandle (hObject=0x188) returned 1
	[0097.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0097.953] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx")) returned 1
	[0097.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76
	[0097.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76
	[0097.954] lstrlenW (lpString=".doc") returned 4
	[0097.954] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0097.954] lstrlenW (lpString=".docx") returned 5
	[0097.954] lstrcmpiW (lpString1=".docx", lpString2="G.SHX") returned -1
	[0097.954] lstrlenW (lpString=".pdf") returned 4
	[0097.954] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0097.954] lstrlenW (lpString=".xls") returned 4
	[0097.954] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0097.954] lstrlenW (lpString=".xlsx") returned 5
	[0097.954] lstrcmpiW (lpString1=".xlsx", lpString2="G.SHX") returned -1
	[0097.954] lstrlenW (lpString=".ppt") returned 4
	[0097.954] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0097.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76
	[0097.954] lstrlenW (lpString=".zip") returned 4
	[0097.954] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0097.954] lstrlenW (lpString=".rar") returned 4
	[0097.954] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0097.954] lstrlenW (lpString=".bz2") returned 4
	[0097.954] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0097.954] lstrlenW (lpString=".7z") returned 3
	[0097.954] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0097.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76
	[0097.954] lstrlenW (lpString=".dbf") returned 4
	[0097.955] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0097.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76
	[0097.955] lstrlenW (lpString=".1cd") returned 4
	[0097.955] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0097.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76
	[0097.955] lstrlenW (lpString=".jpg") returned 4
	[0097.955] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0097.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76
	[0097.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76
	[0097.955] lstrlenW (lpString=".doc") returned 4
	[0097.955] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0097.955] lstrlenW (lpString=".docx") returned 5
	[0097.955] lstrcmpiW (lpString1=".docx", lpString2="G.SHX") returned -1
	[0097.955] lstrlenW (lpString=".pdf") returned 4
	[0097.955] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0097.955] lstrlenW (lpString=".xls") returned 4
	[0097.955] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0097.955] lstrlenW (lpString=".xlsx") returned 5
	[0097.955] lstrcmpiW (lpString1=".xlsx", lpString2="G.SHX") returned -1
	[0097.955] lstrlenW (lpString=".ppt") returned 4
	[0097.955] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0097.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76
	[0097.955] lstrlenW (lpString=".zip") returned 4
	[0097.955] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0097.955] lstrlenW (lpString=".rar") returned 4
	[0097.955] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0097.955] lstrlenW (lpString=".bz2") returned 4
	[0097.956] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0097.956] lstrlenW (lpString=".7z") returned 3
	[0097.956] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0097.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76
	[0097.956] lstrlenW (lpString=".dbf") returned 4
	[0097.956] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0097.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76
	[0097.956] lstrlenW (lpString=".1cd") returned 4
	[0097.956] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0097.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76
	[0097.956] lstrlenW (lpString=".jpg") returned 4
	[0097.956] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0097.956] lstrcmpiW (lpString1=".SHX", lpString2=".adobe") returned 1
	[0097.956] lstrlenW (lpString="WHTGTXT.SHX") returned 11
	[0097.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0097.957] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=648211) returned 1
	[0097.957] CloseHandle (hObject=0x188) returned 1
	[0097.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx")) returned 0x20
	[0097.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0097.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0097.974] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.974] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0097.975] GetLastError () returned 0x0
	[0097.975] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x9e413, lpOverlapped=0x0) returned 1
	[0098.069] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x9e420, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x9e420, lpOverlapped=0x0) returned 1
	[0098.089] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.089] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0098.089] SetEndOfFile (hFile=0x178) returned 1
	[0098.089] CloseHandle (hObject=0x178) returned 1
	[0098.089] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.089] SetEndOfFile (hFile=0x188) returned 1
	[0098.096] CloseHandle (hObject=0x188) returned 1
	[0098.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.097] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx")) returned 1
	[0098.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77
	[0098.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77
	[0098.097] lstrlenW (lpString=".doc") returned 4
	[0098.097] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0098.097] lstrlenW (lpString=".docx") returned 5
	[0098.097] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0098.097] lstrlenW (lpString=".pdf") returned 4
	[0098.097] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0098.097] lstrlenW (lpString=".xls") returned 4
	[0098.097] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0098.097] lstrlenW (lpString=".xlsx") returned 5
	[0098.097] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0098.097] lstrlenW (lpString=".ppt") returned 4
	[0098.097] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0098.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77
	[0098.098] lstrlenW (lpString=".zip") returned 4
	[0098.098] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0098.098] lstrlenW (lpString=".rar") returned 4
	[0098.098] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0098.098] lstrlenW (lpString=".bz2") returned 4
	[0098.098] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0098.098] lstrlenW (lpString=".7z") returned 3
	[0098.098] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0098.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77
	[0098.100] lstrlenW (lpString=".dbf") returned 4
	[0098.100] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0098.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77
	[0098.100] lstrlenW (lpString=".1cd") returned 4
	[0098.101] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0098.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77
	[0098.101] lstrlenW (lpString=".jpg") returned 4
	[0098.101] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0098.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77
	[0098.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77
	[0098.101] lstrlenW (lpString=".doc") returned 4
	[0098.101] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1
	[0098.101] lstrlenW (lpString=".docx") returned 5
	[0098.101] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1
	[0098.101] lstrlenW (lpString=".pdf") returned 4
	[0098.101] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1
	[0098.101] lstrlenW (lpString=".xls") returned 4
	[0098.101] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1
	[0098.101] lstrlenW (lpString=".xlsx") returned 5
	[0098.101] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1
	[0098.101] lstrlenW (lpString=".ppt") returned 4
	[0098.101] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1
	[0098.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77
	[0098.101] lstrlenW (lpString=".zip") returned 4
	[0098.101] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1
	[0098.101] lstrlenW (lpString=".rar") returned 4
	[0098.101] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1
	[0098.101] lstrlenW (lpString=".bz2") returned 4
	[0098.101] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1
	[0098.101] lstrlenW (lpString=".7z") returned 3
	[0098.102] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1
	[0098.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77
	[0098.102] lstrlenW (lpString=".dbf") returned 4
	[0098.102] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1
	[0098.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77
	[0098.102] lstrlenW (lpString=".1cd") returned 4
	[0098.102] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1
	[0098.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77
	[0098.102] lstrlenW (lpString=".jpg") returned 4
	[0098.102] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1
	[0098.102] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0098.102] lstrlenW (lpString="VSTOInstallerUI.dll") returned 19
	[0098.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0098.103] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=10080) returned 1
	[0098.103] CloseHandle (hObject=0x188) returned 1
	[0098.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20
	[0098.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0098.104] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.104] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.161] GetLastError () returned 0x0
	[0098.161] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x2760, lpOverlapped=0x0) returned 1
	[0098.166] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2770, lpOverlapped=0x0) returned 1
	[0098.167] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.167] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0098.167] SetEndOfFile (hFile=0x160) returned 1
	[0098.168] CloseHandle (hObject=0x160) returned 1
	[0098.168] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.168] SetEndOfFile (hFile=0x188) returned 1
	[0098.169] CloseHandle (hObject=0x188) returned 1
	[0098.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.169] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 1
	[0098.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0098.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0098.169] lstrlenW (lpString=".doc") returned 4
	[0098.169] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.169] lstrlenW (lpString=".docx") returned 5
	[0098.170] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0098.170] lstrlenW (lpString=".pdf") returned 4
	[0098.170] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.170] lstrlenW (lpString=".xls") returned 4
	[0098.170] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.170] lstrlenW (lpString=".xlsx") returned 5
	[0098.170] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0098.170] lstrlenW (lpString=".ppt") returned 4
	[0098.170] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0098.170] lstrlenW (lpString=".zip") returned 4
	[0098.170] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.170] lstrlenW (lpString=".rar") returned 4
	[0098.170] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.170] lstrlenW (lpString=".bz2") returned 4
	[0098.170] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.170] lstrlenW (lpString=".7z") returned 3
	[0098.170] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0098.170] lstrlenW (lpString=".dbf") returned 4
	[0098.170] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0098.170] lstrlenW (lpString=".1cd") returned 4
	[0098.170] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0098.170] lstrlenW (lpString=".jpg") returned 4
	[0098.170] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0098.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0098.170] lstrlenW (lpString=".doc") returned 4
	[0098.170] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.170] lstrlenW (lpString=".docx") returned 5
	[0098.171] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0098.171] lstrlenW (lpString=".pdf") returned 4
	[0098.171] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.171] lstrlenW (lpString=".xls") returned 4
	[0098.171] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.171] lstrlenW (lpString=".xlsx") returned 5
	[0098.171] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0098.171] lstrlenW (lpString=".ppt") returned 4
	[0098.171] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0098.171] lstrlenW (lpString=".zip") returned 4
	[0098.171] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.171] lstrlenW (lpString=".rar") returned 4
	[0098.171] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.171] lstrlenW (lpString=".bz2") returned 4
	[0098.171] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.171] lstrlenW (lpString=".7z") returned 3
	[0098.171] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0098.171] lstrlenW (lpString=".dbf") returned 4
	[0098.171] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0098.171] lstrlenW (lpString=".1cd") returned 4
	[0098.171] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0098.171] lstrlenW (lpString=".jpg") returned 4
	[0098.171] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.172] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0098.172] lstrlenW (lpString="VSTOInstaller.exe") returned 17
	[0098.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.184] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=99672) returned 1
	[0098.184] CloseHandle (hObject=0x1a8) returned 1
	[0098.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20
	[0098.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.214] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.214] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0098.223] GetLastError () returned 0x0
	[0098.223] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x18558, lpOverlapped=0x0) returned 1
	[0098.229] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x18560, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x18560, lpOverlapped=0x0) returned 1
	[0098.231] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.231] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0098.232] SetEndOfFile (hFile=0x178) returned 1
	[0098.232] CloseHandle (hObject=0x178) returned 1
	[0098.232] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.232] SetEndOfFile (hFile=0x160) returned 1
	[0098.233] CloseHandle (hObject=0x160) returned 1
	[0098.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.233] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 1
	[0098.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0098.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0098.234] lstrlenW (lpString=".doc") returned 4
	[0098.234] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0098.234] lstrlenW (lpString=".docx") returned 5
	[0098.234] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0098.234] lstrlenW (lpString=".pdf") returned 4
	[0098.234] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0098.234] lstrlenW (lpString=".xls") returned 4
	[0098.234] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0098.234] lstrlenW (lpString=".xlsx") returned 5
	[0098.234] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0098.234] lstrlenW (lpString=".ppt") returned 4
	[0098.234] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0098.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0098.234] lstrlenW (lpString=".zip") returned 4
	[0098.234] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0098.234] lstrlenW (lpString=".rar") returned 4
	[0098.234] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0098.234] lstrlenW (lpString=".bz2") returned 4
	[0098.234] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0098.234] lstrlenW (lpString=".7z") returned 3
	[0098.234] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0098.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0098.235] lstrlenW (lpString=".dbf") returned 4
	[0098.235] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0098.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0098.235] lstrlenW (lpString=".1cd") returned 4
	[0098.235] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0098.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0098.235] lstrlenW (lpString=".jpg") returned 4
	[0098.235] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0098.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0098.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0098.235] lstrlenW (lpString=".doc") returned 4
	[0098.235] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0098.235] lstrlenW (lpString=".docx") returned 5
	[0098.235] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0098.235] lstrlenW (lpString=".pdf") returned 4
	[0098.235] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0098.235] lstrlenW (lpString=".xls") returned 4
	[0098.235] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0098.235] lstrlenW (lpString=".xlsx") returned 5
	[0098.235] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0098.235] lstrlenW (lpString=".ppt") returned 4
	[0098.235] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0098.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0098.235] lstrlenW (lpString=".zip") returned 4
	[0098.235] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0098.235] lstrlenW (lpString=".rar") returned 4
	[0098.235] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0098.235] lstrlenW (lpString=".bz2") returned 4
	[0098.235] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0098.235] lstrlenW (lpString=".7z") returned 3
	[0098.235] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0098.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0098.236] lstrlenW (lpString=".dbf") returned 4
	[0098.236] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0098.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0098.236] lstrlenW (lpString=".1cd") returned 4
	[0098.236] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0098.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0098.236] lstrlenW (lpString=".jpg") returned 4
	[0098.236] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0098.236] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0098.236] lstrlenW (lpString="VSTOMessageProvider.dll") returned 23
	[0098.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.237] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=47976) returned 1
	[0098.237] CloseHandle (hObject=0x160) returned 1
	[0098.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20
	[0098.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.238] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.238] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0098.238] GetLastError () returned 0x0
	[0098.238] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xbb68, lpOverlapped=0x0) returned 1
	[0098.243] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xbb70, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xbb70, lpOverlapped=0x0) returned 1
	[0098.244] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.245] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x102, lpOverlapped=0x0) returned 1
	[0098.245] SetEndOfFile (hFile=0x178) returned 1
	[0098.245] CloseHandle (hObject=0x178) returned 1
	[0098.245] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.245] SetEndOfFile (hFile=0x160) returned 1
	[0098.246] CloseHandle (hObject=0x160) returned 1
	[0098.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.246] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 1
	[0098.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0098.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0098.247] lstrlenW (lpString=".doc") returned 4
	[0098.247] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.247] lstrlenW (lpString=".docx") returned 5
	[0098.247] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0098.247] lstrlenW (lpString=".pdf") returned 4
	[0098.247] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.247] lstrlenW (lpString=".xls") returned 4
	[0098.247] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.247] lstrlenW (lpString=".xlsx") returned 5
	[0098.247] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0098.247] lstrlenW (lpString=".ppt") returned 4
	[0098.247] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0098.247] lstrlenW (lpString=".zip") returned 4
	[0098.247] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.247] lstrlenW (lpString=".rar") returned 4
	[0098.247] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.247] lstrlenW (lpString=".bz2") returned 4
	[0098.247] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.247] lstrlenW (lpString=".7z") returned 3
	[0098.247] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0098.247] lstrlenW (lpString=".dbf") returned 4
	[0098.247] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0098.247] lstrlenW (lpString=".1cd") returned 4
	[0098.247] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0098.247] lstrlenW (lpString=".jpg") returned 4
	[0098.247] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0098.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0098.248] lstrlenW (lpString=".doc") returned 4
	[0098.248] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.248] lstrlenW (lpString=".docx") returned 5
	[0098.248] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0098.248] lstrlenW (lpString=".pdf") returned 4
	[0098.248] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.248] lstrlenW (lpString=".xls") returned 4
	[0098.248] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.248] lstrlenW (lpString=".xlsx") returned 5
	[0098.248] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0098.248] lstrlenW (lpString=".ppt") returned 4
	[0098.248] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0098.248] lstrlenW (lpString=".zip") returned 4
	[0098.248] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.248] lstrlenW (lpString=".rar") returned 4
	[0098.248] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.248] lstrlenW (lpString=".bz2") returned 4
	[0098.248] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.248] lstrlenW (lpString=".7z") returned 3
	[0098.248] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0098.248] lstrlenW (lpString=".dbf") returned 4
	[0098.248] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0098.248] lstrlenW (lpString=".1cd") returned 4
	[0098.248] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0098.248] lstrlenW (lpString=".jpg") returned 4
	[0098.248] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.249] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0098.249] lstrlenW (lpString="vstoee.dll") returned 10
	[0098.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0098.252] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=184648) returned 1
	[0098.252] CloseHandle (hObject=0x178) returned 1
	[0098.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20
	[0098.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0098.252] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.252] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.256] GetLastError () returned 0x0
	[0098.256] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x2d148, lpOverlapped=0x0) returned 1
	[0098.293] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2d150, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2d150, lpOverlapped=0x0) returned 1
	[0098.298] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.298] WriteFile (in: hFile=0x160, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0098.299] SetEndOfFile (hFile=0x160) returned 1
	[0098.299] CloseHandle (hObject=0x160) returned 1
	[0098.299] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.299] SetEndOfFile (hFile=0x178) returned 1
	[0098.301] CloseHandle (hObject=0x178) returned 1
	[0098.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.301] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1
	[0098.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62
	[0098.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62
	[0098.302] lstrlenW (lpString=".doc") returned 4
	[0098.302] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.302] lstrlenW (lpString=".docx") returned 5
	[0098.302] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0098.302] lstrlenW (lpString=".pdf") returned 4
	[0098.302] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.302] lstrlenW (lpString=".xls") returned 4
	[0098.302] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.302] lstrlenW (lpString=".xlsx") returned 5
	[0098.302] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0098.302] lstrlenW (lpString=".ppt") returned 4
	[0098.302] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62
	[0098.302] lstrlenW (lpString=".zip") returned 4
	[0098.302] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.302] lstrlenW (lpString=".rar") returned 4
	[0098.302] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.302] lstrlenW (lpString=".bz2") returned 4
	[0098.302] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.302] lstrlenW (lpString=".7z") returned 3
	[0098.303] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62
	[0098.303] lstrlenW (lpString=".dbf") returned 4
	[0098.303] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62
	[0098.303] lstrlenW (lpString=".1cd") returned 4
	[0098.303] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62
	[0098.303] lstrlenW (lpString=".jpg") returned 4
	[0098.303] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62
	[0098.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62
	[0098.303] lstrlenW (lpString=".doc") returned 4
	[0098.303] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.303] lstrlenW (lpString=".docx") returned 5
	[0098.303] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0098.303] lstrlenW (lpString=".pdf") returned 4
	[0098.303] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.303] lstrlenW (lpString=".xls") returned 4
	[0098.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.303] lstrlenW (lpString=".xlsx") returned 5
	[0098.303] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0098.303] lstrlenW (lpString=".ppt") returned 4
	[0098.303] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62
	[0098.304] lstrlenW (lpString=".zip") returned 4
	[0098.304] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.304] lstrlenW (lpString=".rar") returned 4
	[0098.304] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.304] lstrlenW (lpString=".bz2") returned 4
	[0098.304] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.304] lstrlenW (lpString=".7z") returned 3
	[0098.304] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62
	[0098.304] lstrlenW (lpString=".dbf") returned 4
	[0098.304] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62
	[0098.304] lstrlenW (lpString=".1cd") returned 4
	[0098.304] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62
	[0098.304] lstrlenW (lpString=".jpg") returned 4
	[0098.304] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.304] lstrcmpiW (lpString1=".tlb", lpString2=".adobe") returned 1
	[0098.304] lstrlenW (lpString="vstoee90.tlb") returned 12
	[0098.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.316] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=21840) returned 1
	[0098.316] CloseHandle (hObject=0x19c) returned 1
	[0098.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20
	[0098.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.317] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.317] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0098.318] GetLastError () returned 0x0
	[0098.318] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x5550, lpOverlapped=0x0) returned 1
	[0098.326] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x5560, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x5560, lpOverlapped=0x0) returned 1
	[0098.328] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.328] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.328] SetEndOfFile (hFile=0x1c8) returned 1
	[0098.328] CloseHandle (hObject=0x1c8) returned 1
	[0098.328] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.329] SetEndOfFile (hFile=0x19c) returned 1
	[0098.330] CloseHandle (hObject=0x19c) returned 1
	[0098.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.330] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1
	[0098.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64
	[0098.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64
	[0098.330] lstrlenW (lpString=".doc") returned 4
	[0098.330] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0098.330] lstrlenW (lpString=".docx") returned 5
	[0098.330] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0098.330] lstrlenW (lpString=".pdf") returned 4
	[0098.330] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0098.331] lstrlenW (lpString=".xls") returned 4
	[0098.331] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0098.331] lstrlenW (lpString=".xlsx") returned 5
	[0098.331] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0098.331] lstrlenW (lpString=".ppt") returned 4
	[0098.331] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0098.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64
	[0098.331] lstrlenW (lpString=".zip") returned 4
	[0098.331] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0098.331] lstrlenW (lpString=".rar") returned 4
	[0098.331] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0098.331] lstrlenW (lpString=".bz2") returned 4
	[0098.331] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0098.331] lstrlenW (lpString=".7z") returned 3
	[0098.331] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0098.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64
	[0098.331] lstrlenW (lpString=".dbf") returned 4
	[0098.331] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0098.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64
	[0098.331] lstrlenW (lpString=".1cd") returned 4
	[0098.331] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0098.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64
	[0098.331] lstrlenW (lpString=".jpg") returned 4
	[0098.331] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0098.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64
	[0098.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64
	[0098.332] lstrlenW (lpString=".doc") returned 4
	[0098.332] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0098.332] lstrlenW (lpString=".docx") returned 5
	[0098.332] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0098.332] lstrlenW (lpString=".pdf") returned 4
	[0098.332] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0098.332] lstrlenW (lpString=".xls") returned 4
	[0098.332] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0098.332] lstrlenW (lpString=".xlsx") returned 5
	[0098.332] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0098.332] lstrlenW (lpString=".ppt") returned 4
	[0098.332] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0098.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64
	[0098.332] lstrlenW (lpString=".zip") returned 4
	[0098.332] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0098.332] lstrlenW (lpString=".rar") returned 4
	[0098.332] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0098.332] lstrlenW (lpString=".bz2") returned 4
	[0098.332] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0098.332] lstrlenW (lpString=".7z") returned 3
	[0098.332] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0098.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64
	[0098.332] lstrlenW (lpString=".dbf") returned 4
	[0098.332] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0098.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64
	[0098.332] lstrlenW (lpString=".1cd") returned 4
	[0098.332] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0098.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64
	[0098.333] lstrlenW (lpString=".jpg") returned 4
	[0098.333] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0098.333] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0098.333] lstrlenW (lpString="MSOSV.DLL") returned 9
	[0098.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.334] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=44936) returned 1
	[0098.334] CloseHandle (hObject=0x19c) returned 1
	[0098.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll")) returned 0x20
	[0098.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.335] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.335] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0098.335] GetLastError () returned 0x0
	[0098.336] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xaf88, lpOverlapped=0x0) returned 1
	[0098.380] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xaf90, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xaf90, lpOverlapped=0x0) returned 1
	[0098.382] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.382] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0098.382] SetEndOfFile (hFile=0x1c8) returned 1
	[0098.382] CloseHandle (hObject=0x1c8) returned 1
	[0098.382] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.382] SetEndOfFile (hFile=0x19c) returned 1
	[0098.383] CloseHandle (hObject=0x19c) returned 1
	[0098.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.384] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll")) returned 1
	[0098.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68
	[0098.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68
	[0098.384] lstrlenW (lpString=".doc") returned 4
	[0098.384] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0098.384] lstrlenW (lpString=".docx") returned 5
	[0098.384] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1
	[0098.385] lstrlenW (lpString=".pdf") returned 4
	[0098.385] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0098.385] lstrlenW (lpString=".xls") returned 4
	[0098.385] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0098.385] lstrlenW (lpString=".xlsx") returned 5
	[0098.385] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1
	[0098.385] lstrlenW (lpString=".ppt") returned 4
	[0098.385] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0098.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68
	[0098.385] lstrlenW (lpString=".zip") returned 4
	[0098.385] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0098.385] lstrlenW (lpString=".rar") returned 4
	[0098.385] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0098.385] lstrlenW (lpString=".bz2") returned 4
	[0098.385] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0098.385] lstrlenW (lpString=".7z") returned 3
	[0098.385] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0098.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68
	[0098.385] lstrlenW (lpString=".dbf") returned 4
	[0098.385] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0098.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68
	[0098.385] lstrlenW (lpString=".1cd") returned 4
	[0098.385] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0098.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68
	[0098.385] lstrlenW (lpString=".jpg") returned 4
	[0098.385] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0098.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68
	[0098.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68
	[0098.386] lstrlenW (lpString=".doc") returned 4
	[0098.386] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0098.386] lstrlenW (lpString=".docx") returned 5
	[0098.386] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1
	[0098.386] lstrlenW (lpString=".pdf") returned 4
	[0098.386] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0098.386] lstrlenW (lpString=".xls") returned 4
	[0098.386] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0098.386] lstrlenW (lpString=".xlsx") returned 5
	[0098.386] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1
	[0098.386] lstrlenW (lpString=".ppt") returned 4
	[0098.386] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0098.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68
	[0098.386] lstrlenW (lpString=".zip") returned 4
	[0098.386] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0098.386] lstrlenW (lpString=".rar") returned 4
	[0098.386] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0098.386] lstrlenW (lpString=".bz2") returned 4
	[0098.386] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0098.386] lstrlenW (lpString=".7z") returned 3
	[0098.386] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0098.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68
	[0098.386] lstrlenW (lpString=".dbf") returned 4
	[0098.386] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0098.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68
	[0098.386] lstrlenW (lpString=".1cd") returned 4
	[0098.387] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0098.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68
	[0098.387] lstrlenW (lpString=".jpg") returned 4
	[0098.387] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0098.387] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0098.387] lstrlenW (lpString="FPWEC.DLL") returned 9
	[0098.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.388] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1363344) returned 1
	[0098.388] CloseHandle (hObject=0x19c) returned 1
	[0098.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll")) returned 0x20
	[0098.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0098.388] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.388] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0098.427] GetLastError () returned 0x0
	[0098.427] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0098.545] WriteFile (in: hFile=0x1cc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0098.588] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x4cda0, lpOverlapped=0x0) returned 1
	[0098.689] WriteFile (in: hFile=0x1cc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4cdb0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x4cdb0, lpOverlapped=0x0) returned 1
	[0098.699] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.699] WriteFile (in: hFile=0x1cc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0098.700] SetEndOfFile (hFile=0x1cc) returned 1
	[0098.700] CloseHandle (hObject=0x1cc) returned 1
	[0098.700] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.700] SetEndOfFile (hFile=0x19c) returned 1
	[0098.704] CloseHandle (hObject=0x19c) returned 1
	[0098.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0098.704] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll")) returned 1
	[0098.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85
	[0098.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85
	[0098.704] lstrlenW (lpString=".doc") returned 4
	[0098.704] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0098.704] lstrlenW (lpString=".docx") returned 5
	[0098.704] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1
	[0098.704] lstrlenW (lpString=".pdf") returned 4
	[0098.704] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0098.704] lstrlenW (lpString=".xls") returned 4
	[0098.704] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0098.705] lstrlenW (lpString=".xlsx") returned 5
	[0098.705] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1
	[0098.705] lstrlenW (lpString=".ppt") returned 4
	[0098.705] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0098.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85
	[0098.705] lstrlenW (lpString=".zip") returned 4
	[0098.705] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0098.705] lstrlenW (lpString=".rar") returned 4
	[0098.705] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0098.705] lstrlenW (lpString=".bz2") returned 4
	[0098.705] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0098.705] lstrlenW (lpString=".7z") returned 3
	[0098.705] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0098.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85
	[0098.705] lstrlenW (lpString=".dbf") returned 4
	[0098.705] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0098.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85
	[0098.705] lstrlenW (lpString=".1cd") returned 4
	[0098.705] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0098.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85
	[0098.705] lstrlenW (lpString=".jpg") returned 4
	[0098.705] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0098.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85
	[0098.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85
	[0098.706] lstrlenW (lpString=".doc") returned 4
	[0098.706] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0098.706] lstrlenW (lpString=".docx") returned 5
	[0098.706] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1
	[0098.706] lstrlenW (lpString=".pdf") returned 4
	[0098.706] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0098.706] lstrlenW (lpString=".xls") returned 4
	[0098.706] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0098.706] lstrlenW (lpString=".xlsx") returned 5
	[0098.706] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1
	[0098.706] lstrlenW (lpString=".ppt") returned 4
	[0098.706] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0098.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85
	[0098.706] lstrlenW (lpString=".zip") returned 4
	[0098.706] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0098.706] lstrlenW (lpString=".rar") returned 4
	[0098.706] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0098.706] lstrlenW (lpString=".bz2") returned 4
	[0098.706] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0098.706] lstrlenW (lpString=".7z") returned 3
	[0098.706] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0098.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85
	[0098.706] lstrlenW (lpString=".dbf") returned 4
	[0098.706] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0098.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85
	[0098.706] lstrlenW (lpString=".1cd") returned 4
	[0098.707] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0098.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85
	[0098.707] lstrlenW (lpString=".jpg") returned 4
	[0098.707] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0098.707] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0098.707] lstrlenW (lpString="MSTTSLoc.dll.mui") returned 16
	[0098.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.720] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2560) returned 1
	[0098.720] CloseHandle (hObject=0x190) returned 1
	[0098.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui")) returned 0x20
	[0098.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82
	[0098.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82
	[0098.800] lstrlenW (lpString=".doc") returned 4
	[0098.800] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0098.800] lstrlenW (lpString=".docx") returned 5
	[0098.800] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0098.800] lstrlenW (lpString=".pdf") returned 4
	[0098.800] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0098.800] lstrlenW (lpString=".xls") returned 4
	[0098.800] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0098.800] lstrlenW (lpString=".xlsx") returned 5
	[0098.800] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0098.800] lstrlenW (lpString=".ppt") returned 4
	[0098.800] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0098.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82
	[0098.800] lstrlenW (lpString=".zip") returned 4
	[0098.800] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0098.800] lstrlenW (lpString=".rar") returned 4
	[0098.800] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0098.800] lstrlenW (lpString=".bz2") returned 4
	[0098.800] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0098.800] lstrlenW (lpString=".7z") returned 3
	[0098.800] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0098.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82
	[0098.800] lstrlenW (lpString=".dbf") returned 4
	[0098.800] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0098.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82
	[0098.800] lstrlenW (lpString=".1cd") returned 4
	[0098.800] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0098.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82
	[0098.801] lstrlenW (lpString=".jpg") returned 4
	[0098.801] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0098.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82
	[0098.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82
	[0098.801] lstrlenW (lpString=".doc") returned 4
	[0098.801] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0098.801] lstrlenW (lpString=".docx") returned 5
	[0098.801] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0098.801] lstrlenW (lpString=".pdf") returned 4
	[0098.801] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0098.801] lstrlenW (lpString=".xls") returned 4
	[0098.801] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0098.801] lstrlenW (lpString=".xlsx") returned 5
	[0098.801] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0098.801] lstrlenW (lpString=".ppt") returned 4
	[0098.801] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0098.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82
	[0098.801] lstrlenW (lpString=".zip") returned 4
	[0098.801] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0098.801] lstrlenW (lpString=".rar") returned 4
	[0098.801] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0098.801] lstrlenW (lpString=".bz2") returned 4
	[0098.801] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0098.801] lstrlenW (lpString=".7z") returned 3
	[0098.801] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0098.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82
	[0098.801] lstrlenW (lpString=".dbf") returned 4
	[0098.801] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0098.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82
	[0098.801] lstrlenW (lpString=".1cd") returned 4
	[0098.801] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0098.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82
	[0098.802] lstrlenW (lpString=".jpg") returned 4
	[0098.802] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0098.802] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0098.802] lstrlenW (lpString="msader15.dll") returned 12
	[0098.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0098.802] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=8192) returned 1
	[0098.802] CloseHandle (hObject=0x198) returned 1
	[0098.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20
	[0098.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0098.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0098.803] lstrlenW (lpString=".doc") returned 4
	[0098.803] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.803] lstrlenW (lpString=".docx") returned 5
	[0098.803] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0098.803] lstrlenW (lpString=".pdf") returned 4
	[0098.803] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.803] lstrlenW (lpString=".xls") returned 4
	[0098.803] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.803] lstrlenW (lpString=".xlsx") returned 5
	[0098.803] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0098.803] lstrlenW (lpString=".ppt") returned 4
	[0098.803] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0098.803] lstrlenW (lpString=".zip") returned 4
	[0098.803] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.803] lstrlenW (lpString=".rar") returned 4
	[0098.803] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.803] lstrlenW (lpString=".bz2") returned 4
	[0098.803] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.803] lstrlenW (lpString=".7z") returned 3
	[0098.803] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0098.803] lstrlenW (lpString=".dbf") returned 4
	[0098.803] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0098.804] lstrlenW (lpString=".1cd") returned 4
	[0098.804] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0098.804] lstrlenW (lpString=".jpg") returned 4
	[0098.804] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0098.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0098.804] lstrlenW (lpString=".doc") returned 4
	[0098.804] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.804] lstrlenW (lpString=".docx") returned 5
	[0098.804] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0098.804] lstrlenW (lpString=".pdf") returned 4
	[0098.804] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.804] lstrlenW (lpString=".xls") returned 4
	[0098.804] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.804] lstrlenW (lpString=".xlsx") returned 5
	[0098.804] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0098.804] lstrlenW (lpString=".ppt") returned 4
	[0098.804] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0098.804] lstrlenW (lpString=".zip") returned 4
	[0098.804] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.804] lstrlenW (lpString=".rar") returned 4
	[0098.804] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.804] lstrlenW (lpString=".bz2") returned 4
	[0098.804] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.804] lstrlenW (lpString=".7z") returned 3
	[0098.805] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0098.805] lstrlenW (lpString=".dbf") returned 4
	[0098.805] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0098.805] lstrlenW (lpString=".1cd") returned 4
	[0098.805] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0098.805] lstrlenW (lpString=".jpg") returned 4
	[0098.805] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.805] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0098.805] lstrlenW (lpString="msado15.dll") returned 11
	[0098.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.823] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1499136) returned 1
	[0098.823] CloseHandle (hObject=0x190) returned 1
	[0098.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20
	[0098.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0098.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0098.845] lstrlenW (lpString=".doc") returned 4
	[0098.845] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.845] lstrlenW (lpString=".docx") returned 5
	[0098.845] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0098.845] lstrlenW (lpString=".pdf") returned 4
	[0098.845] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.845] lstrlenW (lpString=".xls") returned 4
	[0098.845] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.845] lstrlenW (lpString=".xlsx") returned 5
	[0098.845] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0098.845] lstrlenW (lpString=".ppt") returned 4
	[0098.845] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0098.845] lstrlenW (lpString=".zip") returned 4
	[0098.845] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.845] lstrlenW (lpString=".rar") returned 4
	[0098.845] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.845] lstrlenW (lpString=".bz2") returned 4
	[0098.845] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.845] lstrlenW (lpString=".7z") returned 3
	[0098.845] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0098.845] lstrlenW (lpString=".dbf") returned 4
	[0098.845] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0098.845] lstrlenW (lpString=".1cd") returned 4
	[0098.845] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0098.845] lstrlenW (lpString=".jpg") returned 4
	[0098.845] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0098.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0098.846] lstrlenW (lpString=".doc") returned 4
	[0098.846] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0098.846] lstrlenW (lpString=".docx") returned 5
	[0098.846] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0098.846] lstrlenW (lpString=".pdf") returned 4
	[0098.846] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0098.846] lstrlenW (lpString=".xls") returned 4
	[0098.846] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0098.846] lstrlenW (lpString=".xlsx") returned 5
	[0098.846] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0098.846] lstrlenW (lpString=".ppt") returned 4
	[0098.846] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0098.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0098.846] lstrlenW (lpString=".zip") returned 4
	[0098.846] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0098.846] lstrlenW (lpString=".rar") returned 4
	[0098.846] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0098.846] lstrlenW (lpString=".bz2") returned 4
	[0098.846] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0098.846] lstrlenW (lpString=".7z") returned 3
	[0098.846] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0098.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0098.846] lstrlenW (lpString=".dbf") returned 4
	[0098.846] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0098.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0098.846] lstrlenW (lpString=".1cd") returned 4
	[0098.846] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0098.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0098.846] lstrlenW (lpString=".jpg") returned 4
	[0098.846] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0098.847] lstrcmpiW (lpString1=".tlb", lpString2=".adobe") returned 1
	[0098.847] lstrlenW (lpString="msado21.tlb") returned 11
	[0098.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0098.862] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=73728) returned 1
	[0098.862] CloseHandle (hObject=0x160) returned 1
	[0098.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20
	[0098.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0098.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0098.884] lstrlenW (lpString=".doc") returned 4
	[0098.884] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0098.884] lstrlenW (lpString=".docx") returned 5
	[0098.884] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1
	[0098.884] lstrlenW (lpString=".pdf") returned 4
	[0098.884] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0098.884] lstrlenW (lpString=".xls") returned 4
	[0098.884] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0098.884] lstrlenW (lpString=".xlsx") returned 5
	[0098.884] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1
	[0098.885] lstrlenW (lpString=".ppt") returned 4
	[0098.885] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0098.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0098.885] lstrlenW (lpString=".zip") returned 4
	[0098.885] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0098.885] lstrlenW (lpString=".rar") returned 4
	[0098.885] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0098.885] lstrlenW (lpString=".bz2") returned 4
	[0098.885] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0098.885] lstrlenW (lpString=".7z") returned 3
	[0098.885] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0098.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0098.885] lstrlenW (lpString=".dbf") returned 4
	[0098.885] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0098.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0098.885] lstrlenW (lpString=".1cd") returned 4
	[0098.885] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0098.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0098.885] lstrlenW (lpString=".jpg") returned 4
	[0098.885] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0098.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0098.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0098.885] lstrlenW (lpString=".doc") returned 4
	[0098.885] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0098.885] lstrlenW (lpString=".docx") returned 5
	[0098.885] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1
	[0098.885] lstrlenW (lpString=".pdf") returned 4
	[0098.885] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0098.886] lstrlenW (lpString=".xls") returned 4
	[0098.886] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0098.886] lstrlenW (lpString=".xlsx") returned 5
	[0098.886] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1
	[0098.886] lstrlenW (lpString=".ppt") returned 4
	[0098.886] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0098.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0098.886] lstrlenW (lpString=".zip") returned 4
	[0098.886] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0098.886] lstrlenW (lpString=".rar") returned 4
	[0098.886] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0098.886] lstrlenW (lpString=".bz2") returned 4
	[0098.886] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0098.886] lstrlenW (lpString=".7z") returned 3
	[0098.886] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0098.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0098.886] lstrlenW (lpString=".dbf") returned 4
	[0098.886] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0098.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0098.886] lstrlenW (lpString=".1cd") returned 4
	[0098.886] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0098.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0098.887] lstrlenW (lpString=".jpg") returned 4
	[0098.887] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0098.887] lstrcmpiW (lpString1=".tlb", lpString2=".adobe") returned 1
	[0098.887] lstrlenW (lpString="msado25.tlb") returned 11
	[0098.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0098.909] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=94208) returned 1
	[0098.909] CloseHandle (hObject=0x190) returned 1
	[0098.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20
	[0098.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0098.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0098.928] lstrlenW (lpString=".doc") returned 4
	[0098.928] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0098.928] lstrlenW (lpString=".docx") returned 5
	[0098.928] lstrcmpiW (lpString1=".docx", lpString2="5.tlb") returned -1
	[0098.928] lstrlenW (lpString=".pdf") returned 4
	[0098.928] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0098.928] lstrlenW (lpString=".xls") returned 4
	[0098.928] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0098.928] lstrlenW (lpString=".xlsx") returned 5
	[0098.928] lstrcmpiW (lpString1=".xlsx", lpString2="5.tlb") returned -1
	[0098.928] lstrlenW (lpString=".ppt") returned 4
	[0098.928] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0098.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0098.928] lstrlenW (lpString=".zip") returned 4
	[0098.928] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0098.928] lstrlenW (lpString=".rar") returned 4
	[0098.928] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0098.928] lstrlenW (lpString=".bz2") returned 4
	[0098.928] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0098.928] lstrlenW (lpString=".7z") returned 3
	[0098.928] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0098.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0098.928] lstrlenW (lpString=".dbf") returned 4
	[0098.928] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0098.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0098.929] lstrlenW (lpString=".1cd") returned 4
	[0098.929] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0098.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0098.929] lstrlenW (lpString=".jpg") returned 4
	[0098.929] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0098.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0098.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0098.929] lstrlenW (lpString=".doc") returned 4
	[0098.929] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0098.929] lstrlenW (lpString=".docx") returned 5
	[0098.929] lstrcmpiW (lpString1=".docx", lpString2="5.tlb") returned -1
	[0098.929] lstrlenW (lpString=".pdf") returned 4
	[0098.929] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0098.929] lstrlenW (lpString=".xls") returned 4
	[0098.929] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0098.929] lstrlenW (lpString=".xlsx") returned 5
	[0098.929] lstrcmpiW (lpString1=".xlsx", lpString2="5.tlb") returned -1
	[0098.929] lstrlenW (lpString=".ppt") returned 4
	[0098.929] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0098.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0098.929] lstrlenW (lpString=".zip") returned 4
	[0098.929] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0098.929] lstrlenW (lpString=".rar") returned 4
	[0098.929] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0098.929] lstrlenW (lpString=".bz2") returned 4
	[0098.929] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0098.929] lstrlenW (lpString=".7z") returned 3
	[0098.929] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0098.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0098.929] lstrlenW (lpString=".dbf") returned 4
	[0098.929] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0098.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0098.930] lstrlenW (lpString=".1cd") returned 4
	[0098.930] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0098.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0098.930] lstrlenW (lpString=".jpg") returned 4
	[0098.930] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0098.930] lstrcmpiW (lpString1=".tlb", lpString2=".adobe") returned 1
	[0098.930] lstrlenW (lpString="msado28.tlb") returned 11
	[0098.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0098.967] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=98304) returned 1
	[0098.968] CloseHandle (hObject=0x1a8) returned 1
	[0098.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20
	[0098.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0098.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0098.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0098.985] lstrlenW (lpString=".doc") returned 4
	[0098.985] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0098.985] lstrlenW (lpString=".docx") returned 5
	[0098.985] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1
	[0098.985] lstrlenW (lpString=".pdf") returned 4
	[0098.985] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0098.985] lstrlenW (lpString=".xls") returned 4
	[0098.985] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0098.985] lstrlenW (lpString=".xlsx") returned 5
	[0098.985] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1
	[0098.986] lstrlenW (lpString=".ppt") returned 4
	[0098.986] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0098.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0098.986] lstrlenW (lpString=".zip") returned 4
	[0098.986] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0098.986] lstrlenW (lpString=".rar") returned 4
	[0098.986] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0098.986] lstrlenW (lpString=".bz2") returned 4
	[0098.986] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0098.986] lstrlenW (lpString=".7z") returned 3
	[0098.986] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0098.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0098.986] lstrlenW (lpString=".dbf") returned 4
	[0098.986] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0099.702] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.702] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.705] GetLastError () returned 0x0
	[0099.705] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x30a18, lpOverlapped=0x0) returned 1
	[0099.736] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x30a20, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x30a20, lpOverlapped=0x0) returned 1
	[0099.740] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.740] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.740] SetEndOfFile (hFile=0x1c0) returned 1
	[0099.741] CloseHandle (hObject=0x1c0) returned 1
	[0099.741] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.741] SetEndOfFile (hFile=0x184) returned 1
	[0099.743] CloseHandle (hObject=0x184) returned 1
	[0099.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0099.743] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll")) returned 1
	[0099.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56
	[0099.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56
	[0099.744] lstrlenW (lpString=".doc") returned 4
	[0099.744] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0099.744] lstrlenW (lpString=".docx") returned 5
	[0099.744] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0099.744] lstrlenW (lpString=".pdf") returned 4
	[0099.744] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0099.744] lstrlenW (lpString=".xls") returned 4
	[0099.744] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0099.744] lstrlenW (lpString=".xlsx") returned 5
	[0099.744] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0099.744] lstrlenW (lpString=".ppt") returned 4
	[0099.744] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0099.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56
	[0099.744] lstrlenW (lpString=".zip") returned 4
	[0099.744] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0099.744] lstrlenW (lpString=".rar") returned 4
	[0099.744] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0099.744] lstrlenW (lpString=".bz2") returned 4
	[0099.745] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0099.745] lstrlenW (lpString=".7z") returned 3
	[0099.745] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0099.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56
	[0099.745] lstrlenW (lpString=".dbf") returned 4
	[0099.745] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0099.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56
	[0099.745] lstrlenW (lpString=".1cd") returned 4
	[0099.745] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0099.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56
	[0099.745] lstrlenW (lpString=".jpg") returned 4
	[0099.745] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0099.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56
	[0099.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56
	[0099.745] lstrlenW (lpString=".doc") returned 4
	[0099.745] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0099.745] lstrlenW (lpString=".docx") returned 5
	[0099.745] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0099.745] lstrlenW (lpString=".pdf") returned 4
	[0099.745] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0099.745] lstrlenW (lpString=".xls") returned 4
	[0099.745] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0099.745] lstrlenW (lpString=".xlsx") returned 5
	[0099.745] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0099.745] lstrlenW (lpString=".ppt") returned 4
	[0099.745] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0099.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56
	[0099.745] lstrlenW (lpString=".zip") returned 4
	[0099.745] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0099.745] lstrlenW (lpString=".rar") returned 4
	[0099.745] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0099.746] lstrlenW (lpString=".bz2") returned 4
	[0099.746] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0099.746] lstrlenW (lpString=".7z") returned 3
	[0099.746] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0099.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56
	[0099.746] lstrlenW (lpString=".dbf") returned 4
	[0099.746] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0099.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56
	[0099.746] lstrlenW (lpString=".1cd") returned 4
	[0099.746] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0099.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56
	[0099.746] lstrlenW (lpString=".jpg") returned 4
	[0099.746] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0099.746] lstrcmpiW (lpString1=".TTF", lpString2=".adobe") returned 1
	[0099.746] lstrlenW (lpString="bod_r.TTF") returned 9
	[0099.746] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.750] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=77884) returned 1
	[0099.750] CloseHandle (hObject=0x160) returned 1
	[0099.750] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf")) returned 0x20
	[0099.754] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.754] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36
	[0099.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36
	[0099.754] lstrlenW (lpString=".doc") returned 4
	[0099.754] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1
	[0099.754] lstrlenW (lpString=".docx") returned 5
	[0099.754] lstrcmpiW (lpString1=".docx", lpString2="r.TTF") returned -1
	[0099.754] lstrlenW (lpString=".pdf") returned 4
	[0099.754] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1
	[0099.754] lstrlenW (lpString=".xls") returned 4
	[0099.754] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1
	[0099.754] lstrlenW (lpString=".xlsx") returned 5
	[0099.754] lstrcmpiW (lpString1=".xlsx", lpString2="r.TTF") returned -1
	[0099.754] lstrlenW (lpString=".ppt") returned 4
	[0099.754] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1
	[0099.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36
	[0099.754] lstrlenW (lpString=".zip") returned 4
	[0099.754] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1
	[0099.754] lstrlenW (lpString=".rar") returned 4
	[0099.754] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1
	[0099.754] lstrlenW (lpString=".bz2") returned 4
	[0099.754] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1
	[0099.754] lstrlenW (lpString=".7z") returned 3
	[0099.754] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1
	[0099.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36
	[0099.755] lstrlenW (lpString=".dbf") returned 4
	[0099.755] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1
	[0099.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36
	[0099.755] lstrlenW (lpString=".1cd") returned 4
	[0099.755] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1
	[0099.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36
	[0099.755] lstrlenW (lpString=".jpg") returned 4
	[0099.755] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1
	[0099.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36
	[0099.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36
	[0099.755] lstrlenW (lpString=".doc") returned 4
	[0099.755] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1
	[0099.755] lstrlenW (lpString=".docx") returned 5
	[0099.755] lstrcmpiW (lpString1=".docx", lpString2="r.TTF") returned -1
	[0099.755] lstrlenW (lpString=".pdf") returned 4
	[0099.755] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1
	[0099.755] lstrlenW (lpString=".xls") returned 4
	[0099.755] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1
	[0099.755] lstrlenW (lpString=".xlsx") returned 5
	[0099.755] lstrcmpiW (lpString1=".xlsx", lpString2="r.TTF") returned -1
	[0099.755] lstrlenW (lpString=".ppt") returned 4
	[0099.755] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1
	[0099.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36
	[0099.755] lstrlenW (lpString=".zip") returned 4
	[0099.755] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1
	[0099.755] lstrlenW (lpString=".rar") returned 4
	[0099.755] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1
	[0099.755] lstrlenW (lpString=".bz2") returned 4
	[0099.755] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1
	[0099.755] lstrlenW (lpString=".7z") returned 3
	[0099.755] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1
	[0099.756] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36
	[0099.756] lstrlenW (lpString=".dbf") returned 4
	[0099.756] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1
	[0099.756] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36
	[0099.756] lstrlenW (lpString=".1cd") returned 4
	[0099.756] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1
	[0099.756] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36
	[0099.756] lstrlenW (lpString=".jpg") returned 4
	[0099.756] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1
	[0099.756] lstrcmpiW (lpString1=".ax", lpString2=".adobe") returned 1
	[0099.756] lstrlenW (lpString="directshowtap.ax") returned 16
	[0099.756] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0099.761] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=61440) returned 1
	[0099.761] CloseHandle (hObject=0x190) returned 1
	[0099.761] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax")) returned 0x20
	[0099.801] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.805] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.806] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43
	[0099.806] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43
	[0099.806] lstrlenW (lpString=".doc") returned 4
	[0099.806] lstrcmpiW (lpString1=".doc", lpString2="p.ax") returned -1
	[0099.806] lstrlenW (lpString=".docx") returned 5
	[0099.806] lstrcmpiW (lpString1=".docx", lpString2="ap.ax") returned -1
	[0099.806] lstrlenW (lpString=".pdf") returned 4
	[0099.806] lstrcmpiW (lpString1=".pdf", lpString2="p.ax") returned -1
	[0099.806] lstrlenW (lpString=".xls") returned 4
	[0099.806] lstrcmpiW (lpString1=".xls", lpString2="p.ax") returned -1
	[0099.806] lstrlenW (lpString=".xlsx") returned 5
	[0099.806] lstrcmpiW (lpString1=".xlsx", lpString2="ap.ax") returned -1
	[0099.806] lstrlenW (lpString=".ppt") returned 4
	[0099.807] lstrcmpiW (lpString1=".ppt", lpString2="p.ax") returned -1
	[0099.807] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43
	[0099.807] lstrlenW (lpString=".zip") returned 4
	[0099.807] lstrcmpiW (lpString1=".zip", lpString2="p.ax") returned -1
	[0099.807] lstrlenW (lpString=".rar") returned 4
	[0099.807] lstrcmpiW (lpString1=".rar", lpString2="p.ax") returned -1
	[0099.807] lstrlenW (lpString=".bz2") returned 4
	[0099.807] lstrcmpiW (lpString1=".bz2", lpString2="p.ax") returned -1
	[0099.807] lstrlenW (lpString=".7z") returned 3
	[0099.807] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1
	[0099.807] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43
	[0099.807] lstrlenW (lpString=".dbf") returned 4
	[0099.807] lstrcmpiW (lpString1=".dbf", lpString2="p.ax") returned -1
	[0099.807] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43
	[0099.807] lstrlenW (lpString=".1cd") returned 4
	[0099.807] lstrcmpiW (lpString1=".1cd", lpString2="p.ax") returned -1
	[0099.807] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43
	[0099.807] lstrlenW (lpString=".jpg") returned 4
	[0099.807] lstrcmpiW (lpString1=".jpg", lpString2="p.ax") returned -1
	[0099.807] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43
	[0099.807] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43
	[0099.807] lstrlenW (lpString=".doc") returned 4
	[0099.807] lstrcmpiW (lpString1=".doc", lpString2="p.ax") returned -1
	[0099.807] lstrlenW (lpString=".docx") returned 5
	[0099.807] lstrcmpiW (lpString1=".docx", lpString2="ap.ax") returned -1
	[0099.807] lstrlenW (lpString=".pdf") returned 4
	[0099.807] lstrcmpiW (lpString1=".pdf", lpString2="p.ax") returned -1
	[0099.807] lstrlenW (lpString=".xls") returned 4
	[0099.807] lstrcmpiW (lpString1=".xls", lpString2="p.ax") returned -1
	[0099.807] lstrlenW (lpString=".xlsx") returned 5
	[0099.807] lstrcmpiW (lpString1=".xlsx", lpString2="ap.ax") returned -1
	[0099.808] lstrlenW (lpString=".ppt") returned 4
	[0099.808] lstrcmpiW (lpString1=".ppt", lpString2="p.ax") returned -1
	[0099.808] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43
	[0099.808] lstrlenW (lpString=".zip") returned 4
	[0099.808] lstrcmpiW (lpString1=".zip", lpString2="p.ax") returned -1
	[0099.808] lstrlenW (lpString=".rar") returned 4
	[0099.808] lstrcmpiW (lpString1=".rar", lpString2="p.ax") returned -1
	[0099.808] lstrlenW (lpString=".bz2") returned 4
	[0099.808] lstrcmpiW (lpString1=".bz2", lpString2="p.ax") returned -1
	[0099.808] lstrlenW (lpString=".7z") returned 3
	[0099.808] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1
	[0099.808] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43
	[0099.808] lstrlenW (lpString=".dbf") returned 4
	[0099.808] lstrcmpiW (lpString1=".dbf", lpString2="p.ax") returned -1
	[0099.808] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43
	[0099.808] lstrlenW (lpString=".1cd") returned 4
	[0099.808] lstrcmpiW (lpString1=".1cd", lpString2="p.ax") returned -1
	[0099.808] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43
	[0099.808] lstrlenW (lpString=".jpg") returned 4
	[0099.808] lstrcmpiW (lpString1=".jpg", lpString2="p.ax") returned -1
	[0099.808] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0099.808] lstrlenW (lpString="DVDMaker.exe.mui") returned 16
	[0099.808] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.816] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=51712) returned 1
	[0099.816] CloseHandle (hObject=0x1c0) returned 1
	[0099.816] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui")) returned 0x20
	[0099.834] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.834] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.834] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned 49
	[0099.834] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned 49
	[0099.834] lstrlenW (lpString=".doc") returned 4
	[0099.834] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0099.834] lstrlenW (lpString=".docx") returned 5
	[0099.834] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0099.834] lstrlenW (lpString=".pdf") returned 4
	[0099.834] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0099.834] lstrlenW (lpString=".xls") returned 4
	[0099.834] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0099.835] lstrlenW (lpString=".xlsx") returned 5
	[0099.835] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0099.835] lstrlenW (lpString=".ppt") returned 4
	[0099.835] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0099.835] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned 49
	[0099.835] lstrlenW (lpString=".zip") returned 4
	[0099.835] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0099.835] lstrlenW (lpString=".rar") returned 4
	[0099.835] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0099.835] lstrlenW (lpString=".bz2") returned 4
	[0099.835] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0099.835] lstrlenW (lpString=".7z") returned 3
	[0099.835] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0099.835] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned 49
	[0099.835] lstrlenW (lpString=".dbf") returned 4
	[0099.835] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0099.835] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned 49
	[0099.835] lstrlenW (lpString=".1cd") returned 4
	[0099.835] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0099.835] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned 49
	[0099.835] lstrlenW (lpString=".jpg") returned 4
	[0099.835] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0099.835] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned 49
	[0099.835] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned 49
	[0099.835] lstrlenW (lpString=".doc") returned 4
	[0099.835] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0099.836] lstrlenW (lpString=".docx") returned 5
	[0099.836] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0099.836] lstrlenW (lpString=".pdf") returned 4
	[0099.836] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0099.836] lstrlenW (lpString=".xls") returned 4
	[0099.836] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0099.836] lstrlenW (lpString=".xlsx") returned 5
	[0099.836] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0099.836] lstrlenW (lpString=".ppt") returned 4
	[0099.836] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0099.836] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned 49
	[0099.836] lstrlenW (lpString=".zip") returned 4
	[0099.836] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0099.836] lstrlenW (lpString=".rar") returned 4
	[0099.836] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0099.836] lstrlenW (lpString=".bz2") returned 4
	[0099.836] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0099.836] lstrlenW (lpString=".7z") returned 3
	[0099.836] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0099.836] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned 49
	[0099.836] lstrlenW (lpString=".dbf") returned 4
	[0099.836] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0099.836] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned 49
	[0099.836] lstrlenW (lpString=".1cd") returned 4
	[0099.836] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0099.836] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned 49
	[0099.836] lstrlenW (lpString=".jpg") returned 4
	[0099.836] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0099.837] lstrcmpiW (lpString1=".mui", lpString2=".adobe") returned 1
	[0099.837] lstrlenW (lpString="WMM2CLIP.dll.mui") returned 16
	[0099.837] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.857] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=7168) returned 1
	[0099.857] CloseHandle (hObject=0x1c0) returned 1
	[0099.857] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui")) returned 0x20
	[0099.891] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.891] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.894] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49
	[0099.894] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49
	[0099.894] lstrlenW (lpString=".doc") returned 4
	[0099.894] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0099.894] lstrlenW (lpString=".docx") returned 5
	[0099.894] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0099.894] lstrlenW (lpString=".pdf") returned 4
	[0099.894] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0099.894] lstrlenW (lpString=".xls") returned 4
	[0099.894] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0099.894] lstrlenW (lpString=".xlsx") returned 5
	[0099.894] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0099.894] lstrlenW (lpString=".ppt") returned 4
	[0099.894] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0099.894] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49
	[0099.895] lstrlenW (lpString=".zip") returned 4
	[0099.895] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0099.895] lstrlenW (lpString=".rar") returned 4
	[0099.895] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0099.895] lstrlenW (lpString=".bz2") returned 4
	[0099.895] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0099.895] lstrlenW (lpString=".7z") returned 3
	[0099.895] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0099.895] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49
	[0099.895] lstrlenW (lpString=".dbf") returned 4
	[0099.895] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0099.895] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49
	[0099.895] lstrlenW (lpString=".1cd") returned 4
	[0099.895] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0099.895] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49
	[0099.895] lstrlenW (lpString=".jpg") returned 4
	[0099.895] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0099.895] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49
	[0099.895] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49
	[0099.895] lstrlenW (lpString=".doc") returned 4
	[0099.895] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0099.895] lstrlenW (lpString=".docx") returned 5
	[0099.895] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0099.895] lstrlenW (lpString=".pdf") returned 4
	[0099.896] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0099.896] lstrlenW (lpString=".xls") returned 4
	[0099.896] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0099.896] lstrlenW (lpString=".xlsx") returned 5
	[0099.896] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0099.896] lstrlenW (lpString=".ppt") returned 4
	[0099.896] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0099.896] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49
	[0099.896] lstrlenW (lpString=".zip") returned 4
	[0099.896] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0099.896] lstrlenW (lpString=".rar") returned 4
	[0099.896] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0099.896] lstrlenW (lpString=".bz2") returned 4
	[0099.896] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0099.896] lstrlenW (lpString=".7z") returned 3
	[0099.896] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0099.896] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49
	[0099.896] lstrlenW (lpString=".dbf") returned 4
	[0099.896] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0099.896] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49
	[0099.896] lstrlenW (lpString=".1cd") returned 4
	[0099.896] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0099.896] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49
	[0099.896] lstrlenW (lpString=".jpg") returned 4
	[0099.896] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0099.896] lstrcmpiW (lpString1=".ax", lpString2=".adobe") returned 1
	[0099.897] lstrlenW (lpString="offset.ax") returned 9
	[0099.897] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0099.914] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=43008) returned 1
	[0099.914] CloseHandle (hObject=0x160) returned 1
	[0099.914] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax")) returned 0x20
	[0099.920] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\offset.ax.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0099.923] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0099.924] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36
	[0099.924] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36
	[0099.924] lstrlenW (lpString=".doc") returned 4
	[0099.924] lstrcmpiW (lpString1=".doc", lpString2="t.ax") returned -1
	[0099.924] lstrlenW (lpString=".docx") returned 5
	[0099.924] lstrcmpiW (lpString1=".docx", lpString2="et.ax") returned -1
	[0099.924] lstrlenW (lpString=".pdf") returned 4
	[0099.924] lstrcmpiW (lpString1=".pdf", lpString2="t.ax") returned -1
	[0099.924] lstrlenW (lpString=".xls") returned 4
	[0099.924] lstrcmpiW (lpString1=".xls", lpString2="t.ax") returned -1
	[0099.924] lstrlenW (lpString=".xlsx") returned 5
	[0099.924] lstrcmpiW (lpString1=".xlsx", lpString2="et.ax") returned -1
	[0099.924] lstrlenW (lpString=".ppt") returned 4
	[0099.924] lstrcmpiW (lpString1=".ppt", lpString2="t.ax") returned -1
	[0099.925] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36
	[0099.925] lstrlenW (lpString=".zip") returned 4
	[0099.925] lstrcmpiW (lpString1=".zip", lpString2="t.ax") returned -1
	[0099.925] lstrlenW (lpString=".rar") returned 4
	[0099.925] lstrcmpiW (lpString1=".rar", lpString2="t.ax") returned -1
	[0099.925] lstrlenW (lpString=".bz2") returned 4
	[0099.925] lstrcmpiW (lpString1=".bz2", lpString2="t.ax") returned -1
	[0099.925] lstrlenW (lpString=".7z") returned 3
	[0099.925] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1
	[0099.925] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36
	[0099.925] lstrlenW (lpString=".dbf") returned 4
	[0099.925] lstrcmpiW (lpString1=".dbf", lpString2="t.ax") returned -1
	[0099.925] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36
	[0099.925] lstrlenW (lpString=".1cd") returned 4
	[0099.925] lstrcmpiW (lpString1=".1cd", lpString2="t.ax") returned -1
	[0099.925] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36
	[0099.925] lstrlenW (lpString=".jpg") returned 4
	[0099.925] lstrcmpiW (lpString1=".jpg", lpString2="t.ax") returned -1
	[0099.925] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36
	[0099.925] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36
	[0099.925] lstrlenW (lpString=".doc") returned 4
	[0099.925] lstrcmpiW (lpString1=".doc", lpString2="t.ax") returned -1
	[0099.925] lstrlenW (lpString=".docx") returned 5
	[0099.925] lstrcmpiW (lpString1=".docx", lpString2="et.ax") returned -1
	[0099.925] lstrlenW (lpString=".pdf") returned 4
	[0099.925] lstrcmpiW (lpString1=".pdf", lpString2="t.ax") returned -1
	[0099.925] lstrlenW (lpString=".xls") returned 4
	[0099.925] lstrcmpiW (lpString1=".xls", lpString2="t.ax") returned -1
	[0099.925] lstrlenW (lpString=".xlsx") returned 5
	[0099.925] lstrcmpiW (lpString1=".xlsx", lpString2="et.ax") returned -1
	[0099.925] lstrlenW (lpString=".ppt") returned 4
	[0099.926] lstrcmpiW (lpString1=".ppt", lpString2="t.ax") returned -1
	[0099.926] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36
	[0099.926] lstrlenW (lpString=".zip") returned 4
	[0099.926] lstrcmpiW (lpString1=".zip", lpString2="t.ax") returned -1
	[0099.926] lstrlenW (lpString=".rar") returned 4
	[0099.926] lstrcmpiW (lpString1=".rar", lpString2="t.ax") returned -1
	[0099.926] lstrlenW (lpString=".bz2") returned 4
	[0099.926] lstrcmpiW (lpString1=".bz2", lpString2="t.ax") returned -1
	[0099.926] lstrlenW (lpString=".7z") returned 3
	[0099.926] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1
	[0099.926] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36
	[0099.926] lstrlenW (lpString=".dbf") returned 4
	[0099.926] lstrcmpiW (lpString1=".dbf", lpString2="t.ax") returned -1
	[0099.926] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36
	[0099.926] lstrlenW (lpString=".1cd") returned 4
	[0099.926] lstrcmpiW (lpString1=".1cd", lpString2="t.ax") returned -1
	[0099.926] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36
	[0099.926] lstrlenW (lpString=".jpg") returned 4
	[0099.926] lstrcmpiW (lpString1=".jpg", lpString2="t.ax") returned -1
	[0099.926] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0099.926] lstrlenW (lpString="Pipeline.dll") returned 12
	[0099.926] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0099.986] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1852928) returned 1
	[0099.986] CloseHandle (hObject=0x1c0) returned 1
	[0099.986] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll")) returned 0x20
	[0100.039] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.041] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0
	[0100.043] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned 39
	[0100.043] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned 39
	[0100.043] lstrlenW (lpString=".doc") returned 4
	[0100.043] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0100.043] lstrlenW (lpString=".docx") returned 5
	[0100.043] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0100.043] lstrlenW (lpString=".pdf") returned 4
	[0100.043] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0100.043] lstrlenW (lpString=".xls") returned 4
	[0100.043] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0100.043] lstrlenW (lpString=".xlsx") returned 5
	[0100.043] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0100.043] lstrlenW (lpString=".ppt") returned 4
	[0100.043] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0100.043] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned 39
	[0100.044] lstrlenW (lpString=".zip") returned 4
	[0100.044] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0100.044] lstrlenW (lpString=".rar") returned 4
	[0100.044] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0100.044] lstrlenW (lpString=".bz2") returned 4
	[0100.044] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0100.044] lstrlenW (lpString=".7z") returned 3
	[0100.044] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0100.044] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned 39
	[0100.044] lstrlenW (lpString=".dbf") returned 4
	[0100.044] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0100.168] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\secretst.ttf.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.168] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0100.176] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=51712) returned 1
	[0100.176] CloseHandle (hObject=0x188) returned 1
	[0100.176] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax")) returned 0x20
	[0100.185] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0100.186] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.098] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.098] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.098] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0101.100] GetLastError () returned 0x0
	[0101.100] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1cc, lpOverlapped=0x0) returned 1
	[0101.101] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1d0, lpOverlapped=0x0) returned 1
	[0101.103] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.103] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0101.103] SetEndOfFile (hFile=0x190) returned 1
	[0101.103] CloseHandle (hObject=0x190) returned 1
	[0101.103] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.103] SetEndOfFile (hFile=0x19c) returned 1
	[0101.104] CloseHandle (hObject=0x19c) returned 1
	[0101.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.105] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 1
	[0101.106] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0101.106] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0101.106] lstrlenW (lpString=".doc") returned 4
	[0101.106] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1
	[0101.106] lstrlenW (lpString=".docx") returned 5
	[0101.106] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1
	[0101.106] lstrlenW (lpString=".pdf") returned 4
	[0101.106] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1
	[0101.106] lstrlenW (lpString=".xls") returned 4
	[0101.106] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1
	[0101.106] lstrlenW (lpString=".xlsx") returned 5
	[0101.106] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1
	[0101.106] lstrlenW (lpString=".ppt") returned 4
	[0101.106] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1
	[0101.106] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0101.106] lstrlenW (lpString=".zip") returned 4
	[0101.106] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1
	[0101.106] lstrlenW (lpString=".rar") returned 4
	[0101.106] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1
	[0101.106] lstrlenW (lpString=".bz2") returned 4
	[0101.107] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1
	[0101.107] lstrlenW (lpString=".7z") returned 3
	[0101.107] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1
	[0101.107] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0101.107] lstrlenW (lpString=".dbf") returned 4
	[0101.107] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1
	[0101.107] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0101.107] lstrlenW (lpString=".1cd") returned 4
	[0101.107] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1
	[0101.107] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0101.107] lstrlenW (lpString=".jpg") returned 4
	[0101.107] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1
	[0101.107] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0101.107] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0101.107] lstrlenW (lpString=".doc") returned 4
	[0101.107] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1
	[0101.107] lstrlenW (lpString=".docx") returned 5
	[0101.107] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1
	[0101.107] lstrlenW (lpString=".pdf") returned 4
	[0101.107] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1
	[0101.107] lstrlenW (lpString=".xls") returned 4
	[0101.107] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1
	[0101.107] lstrlenW (lpString=".xlsx") returned 5
	[0101.108] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1
	[0101.108] lstrlenW (lpString=".ppt") returned 4
	[0101.108] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1
	[0101.108] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0101.108] lstrlenW (lpString=".zip") returned 4
	[0101.108] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1
	[0101.108] lstrlenW (lpString=".rar") returned 4
	[0101.108] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1
	[0101.108] lstrlenW (lpString=".bz2") returned 4
	[0101.108] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1
	[0101.108] lstrlenW (lpString=".7z") returned 3
	[0101.108] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1
	[0101.108] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0101.108] lstrlenW (lpString=".dbf") returned 4
	[0101.108] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1
	[0101.108] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0101.108] lstrlenW (lpString=".1cd") returned 4
	[0101.108] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1
	[0101.108] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0101.108] lstrlenW (lpString=".jpg") returned 4
	[0101.108] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1
	[0101.109] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0101.109] lstrlenW (lpString="msmgdsrv.dll") returned 12
	[0101.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0101.110] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=12338536) returned 1
	[0101.110] CloseHandle (hObject=0x19c) returned 1
	[0101.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll")) returned 0x20
	[0101.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0101.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0101.112] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0101.112] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.112] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.152] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x3ec1cd, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.152] ReadFile (in: hFile=0x19c, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.199] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.199] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb84568, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.200] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.239] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.239] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0101.260] SetEndOfFile (hFile=0x19c) returned 1
	[0101.260] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f20068
	[0101.264] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.264] WriteFile (in: hFile=0x19c, lpBuffer=0x3f20068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f20068*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.316] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x3ec1cd, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.316] WriteFile (in: hFile=0x19c, lpBuffer=0x3f20068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f20068*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.335] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb84568, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.335] WriteFile (in: hFile=0x19c, lpBuffer=0x3f20068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f20068*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.339] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0101.339] CloseHandle (hObject=0x19c) returned 1
	[0101.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69
	[0101.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69
	[0101.340] lstrlenW (lpString=".doc") returned 4
	[0101.340] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0101.341] lstrlenW (lpString=".docx") returned 5
	[0101.341] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1
	[0101.341] lstrlenW (lpString=".pdf") returned 4
	[0101.341] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0101.341] lstrlenW (lpString=".xls") returned 4
	[0101.341] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0101.341] lstrlenW (lpString=".xlsx") returned 5
	[0101.341] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1
	[0101.341] lstrlenW (lpString=".ppt") returned 4
	[0101.341] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0101.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69
	[0101.341] lstrlenW (lpString=".zip") returned 4
	[0101.341] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0101.341] lstrlenW (lpString=".rar") returned 4
	[0101.341] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0101.341] lstrlenW (lpString=".bz2") returned 4
	[0101.341] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0101.341] lstrlenW (lpString=".7z") returned 3
	[0101.341] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0101.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69
	[0101.341] lstrlenW (lpString=".dbf") returned 4
	[0101.341] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0101.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69
	[0101.341] lstrlenW (lpString=".1cd") returned 4
	[0101.341] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0101.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69
	[0101.342] lstrlenW (lpString=".jpg") returned 4
	[0101.342] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0101.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69
	[0101.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69
	[0101.342] lstrlenW (lpString=".doc") returned 4
	[0101.342] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0101.342] lstrlenW (lpString=".docx") returned 5
	[0101.342] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1
	[0101.342] lstrlenW (lpString=".pdf") returned 4
	[0101.342] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0101.342] lstrlenW (lpString=".xls") returned 4
	[0101.342] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0101.342] lstrlenW (lpString=".xlsx") returned 5
	[0101.342] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1
	[0101.342] lstrlenW (lpString=".ppt") returned 4
	[0101.342] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0101.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69
	[0101.342] lstrlenW (lpString=".zip") returned 4
	[0101.342] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0101.342] lstrlenW (lpString=".rar") returned 4
	[0101.342] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0101.342] lstrlenW (lpString=".bz2") returned 4
	[0101.342] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0101.342] lstrlenW (lpString=".7z") returned 3
	[0101.342] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0101.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69
	[0101.343] lstrlenW (lpString=".dbf") returned 4
	[0101.343] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0101.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69
	[0101.343] lstrlenW (lpString=".1cd") returned 4
	[0101.343] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0101.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69
	[0101.343] lstrlenW (lpString=".jpg") returned 4
	[0101.343] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0101.343] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0101.343] lstrlenW (lpString="msolap100.dll") returned 13
	[0101.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0101.345] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=8154984) returned 1
	[0101.345] CloseHandle (hObject=0x19c) returned 1
	[0101.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll")) returned 0x20
	[0101.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 1
	[0101.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0101.347] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1
	[0101.347] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.347] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.419] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x297a78, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.419] ReadFile (in: hFile=0x19c, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.473] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.473] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x786f68, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.473] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.518] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.518] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0106, lpOverlapped=0x0) returned 1
	[0101.541] SetEndOfFile (hFile=0x19c) returned 1
	[0101.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f20068
	[0101.545] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.549] WriteFile (in: hFile=0x19c, lpBuffer=0x3f20068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f20068*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.551] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x297a78, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.551] WriteFile (in: hFile=0x19c, lpBuffer=0x3f20068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f20068*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.553] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x786f68, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.553] WriteFile (in: hFile=0x19c, lpBuffer=0x3f20068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f20068*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.555] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0101.555] CloseHandle (hObject=0x19c) returned 1
	[0101.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70
	[0101.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70
	[0101.555] lstrlenW (lpString=".doc") returned 4
	[0101.555] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0101.555] lstrlenW (lpString=".docx") returned 5
	[0101.555] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0101.555] lstrlenW (lpString=".pdf") returned 4
	[0101.555] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0101.556] lstrlenW (lpString=".xls") returned 4
	[0101.556] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0101.556] lstrlenW (lpString=".xlsx") returned 5
	[0101.556] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0101.556] lstrlenW (lpString=".ppt") returned 4
	[0101.556] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0101.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70
	[0101.556] lstrlenW (lpString=".zip") returned 4
	[0101.556] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0101.556] lstrlenW (lpString=".rar") returned 4
	[0101.556] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0101.556] lstrlenW (lpString=".bz2") returned 4
	[0101.556] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0101.556] lstrlenW (lpString=".7z") returned 3
	[0101.556] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0101.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70
	[0101.556] lstrlenW (lpString=".dbf") returned 4
	[0101.556] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0101.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70
	[0101.556] lstrlenW (lpString=".1cd") returned 4
	[0101.556] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0101.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70
	[0101.556] lstrlenW (lpString=".jpg") returned 4
	[0101.556] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0101.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70
	[0101.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70
	[0101.556] lstrlenW (lpString=".doc") returned 4
	[0101.556] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0101.556] lstrlenW (lpString=".docx") returned 5
	[0101.556] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0101.556] lstrlenW (lpString=".pdf") returned 4
	[0101.556] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0101.556] lstrlenW (lpString=".xls") returned 4
	[0101.557] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0101.557] lstrlenW (lpString=".xlsx") returned 5
	[0101.557] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0101.557] lstrlenW (lpString=".ppt") returned 4
	[0101.557] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0101.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70
	[0101.557] lstrlenW (lpString=".zip") returned 4
	[0101.557] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0101.557] lstrlenW (lpString=".rar") returned 4
	[0101.557] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0101.557] lstrlenW (lpString=".bz2") returned 4
	[0101.557] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0101.557] lstrlenW (lpString=".7z") returned 3
	[0101.557] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0101.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70
	[0101.557] lstrlenW (lpString=".dbf") returned 4
	[0101.557] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0101.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70
	[0101.557] lstrlenW (lpString=".1cd") returned 4
	[0101.557] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0101.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70
	[0101.557] lstrlenW (lpString=".jpg") returned 4
	[0101.557] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0101.557] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0101.557] lstrlenW (lpString="direct-prospect-severe.exe") returned 26
	[0101.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe" (normalized: "c:\\program files\\microsoft analysis services\\direct-prospect-severe.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0101.558] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=78336) returned 1
	[0101.558] CloseHandle (hObject=0x19c) returned 1
	[0101.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe" (normalized: "c:\\program files\\microsoft analysis services\\direct-prospect-severe.exe")) returned 0x20
	[0101.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\direct-prospect-severe.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe" (normalized: "c:\\program files\\microsoft analysis services\\direct-prospect-severe.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe") returned 71
	[0101.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe") returned 71
	[0101.559] lstrlenW (lpString=".doc") returned 4
	[0101.559] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0101.559] lstrlenW (lpString=".docx") returned 5
	[0101.559] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0101.559] lstrlenW (lpString=".pdf") returned 4
	[0101.559] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0101.559] lstrlenW (lpString=".xls") returned 4
	[0101.559] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0101.559] lstrlenW (lpString=".xlsx") returned 5
	[0101.559] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0101.559] lstrlenW (lpString=".ppt") returned 4
	[0101.559] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0101.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe") returned 71
	[0101.559] lstrlenW (lpString=".zip") returned 4
	[0101.559] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0101.559] lstrlenW (lpString=".rar") returned 4
	[0101.560] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0101.560] lstrlenW (lpString=".bz2") returned 4
	[0101.560] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0101.560] lstrlenW (lpString=".7z") returned 3
	[0101.560] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0101.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe") returned 71
	[0101.560] lstrlenW (lpString=".dbf") returned 4
	[0101.560] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0101.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe") returned 71
	[0101.560] lstrlenW (lpString=".1cd") returned 4
	[0101.560] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0101.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe") returned 71
	[0101.560] lstrlenW (lpString=".jpg") returned 4
	[0101.560] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0101.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe") returned 71
	[0101.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe") returned 71
	[0101.560] lstrlenW (lpString=".doc") returned 4
	[0101.560] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0101.560] lstrlenW (lpString=".docx") returned 5
	[0101.560] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0101.560] lstrlenW (lpString=".pdf") returned 4
	[0101.560] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0101.560] lstrlenW (lpString=".xls") returned 4
	[0101.560] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0101.560] lstrlenW (lpString=".xlsx") returned 5
	[0101.560] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0101.560] lstrlenW (lpString=".ppt") returned 4
	[0101.560] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0101.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe") returned 71
	[0101.561] lstrlenW (lpString=".zip") returned 4
	[0101.561] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0101.561] lstrlenW (lpString=".rar") returned 4
	[0101.561] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0101.561] lstrlenW (lpString=".bz2") returned 4
	[0101.561] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0101.561] lstrlenW (lpString=".7z") returned 3
	[0101.561] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0101.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe") returned 71
	[0101.561] lstrlenW (lpString=".dbf") returned 4
	[0101.561] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0101.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe") returned 71
	[0101.561] lstrlenW (lpString=".1cd") returned 4
	[0101.561] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0101.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\direct-prospect-severe.exe") returned 71
	[0101.561] lstrlenW (lpString=".jpg") returned 4
	[0101.561] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0101.561] lstrcmpiW (lpString1=".exe", lpString2=".adobe") returned 1
	[0101.561] lstrlenW (lpString="logic-globe.exe") returned 15
	[0101.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe" (normalized: "c:\\program files\\microsoft analysis services\\logic-globe.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0101.562] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=78336) returned 1
	[0101.562] CloseHandle (hObject=0x19c) returned 1
	[0101.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe" (normalized: "c:\\program files\\microsoft analysis services\\logic-globe.exe")) returned 0x20
	[0101.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft analysis services\\logic-globe.exe.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe" (normalized: "c:\\program files\\microsoft analysis services\\logic-globe.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe") returned 60
	[0101.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe") returned 60
	[0101.562] lstrlenW (lpString=".doc") returned 4
	[0101.562] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0101.562] lstrlenW (lpString=".docx") returned 5
	[0101.562] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0101.562] lstrlenW (lpString=".pdf") returned 4
	[0101.562] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0101.562] lstrlenW (lpString=".xls") returned 4
	[0101.562] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0101.562] lstrlenW (lpString=".xlsx") returned 5
	[0101.563] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0101.563] lstrlenW (lpString=".ppt") returned 4
	[0101.563] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0101.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe") returned 60
	[0101.563] lstrlenW (lpString=".zip") returned 4
	[0101.563] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0101.563] lstrlenW (lpString=".rar") returned 4
	[0101.563] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0101.563] lstrlenW (lpString=".bz2") returned 4
	[0101.563] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0101.563] lstrlenW (lpString=".7z") returned 3
	[0101.563] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0101.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe") returned 60
	[0101.563] lstrlenW (lpString=".dbf") returned 4
	[0101.563] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0101.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe") returned 60
	[0101.563] lstrlenW (lpString=".1cd") returned 4
	[0101.563] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0101.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe") returned 60
	[0101.563] lstrlenW (lpString=".jpg") returned 4
	[0101.563] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0101.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe") returned 60
	[0101.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe") returned 60
	[0101.563] lstrlenW (lpString=".doc") returned 4
	[0101.563] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0101.563] lstrlenW (lpString=".docx") returned 5
	[0101.563] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0101.563] lstrlenW (lpString=".pdf") returned 4
	[0101.563] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0101.563] lstrlenW (lpString=".xls") returned 4
	[0101.563] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0101.563] lstrlenW (lpString=".xlsx") returned 5
	[0101.564] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0101.564] lstrlenW (lpString=".ppt") returned 4
	[0101.564] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0101.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe") returned 60
	[0101.564] lstrlenW (lpString=".zip") returned 4
	[0101.564] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0101.564] lstrlenW (lpString=".rar") returned 4
	[0101.564] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0101.564] lstrlenW (lpString=".bz2") returned 4
	[0101.564] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0101.564] lstrlenW (lpString=".7z") returned 3
	[0101.564] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0101.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe") returned 60
	[0101.564] lstrlenW (lpString=".dbf") returned 4
	[0101.564] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0101.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe") returned 60
	[0101.564] lstrlenW (lpString=".1cd") returned 4
	[0101.564] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0101.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\logic-globe.exe") returned 60
	[0101.564] lstrlenW (lpString=".jpg") returned 4
	[0101.564] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0101.564] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0101.564] lstrlenW (lpString="BABY_01.MID") returned 11
	[0101.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0101.597] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=7384) returned 1
	[0101.597] CloseHandle (hObject=0x19c) returned 1
	[0101.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 0x20
	[0101.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0101.612] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.612] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0101.641] GetLastError () returned 0x0
	[0101.641] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1cd8, lpOverlapped=0x0) returned 1
	[0101.646] WriteFile (in: hFile=0x170, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1ce0, lpOverlapped=0x0) returned 1
	[0101.647] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.648] WriteFile (in: hFile=0x170, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0101.648] SetEndOfFile (hFile=0x170) returned 1
	[0101.659] CloseHandle (hObject=0x170) returned 1
	[0101.660] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.660] SetEndOfFile (hFile=0x1c0) returned 1
	[0101.664] CloseHandle (hObject=0x1c0) returned 1
	[0101.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 1
	[0101.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0101.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0101.671] lstrlenW (lpString=".doc") returned 4
	[0101.671] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.671] lstrlenW (lpString=".docx") returned 5
	[0101.671] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0101.671] lstrlenW (lpString=".pdf") returned 4
	[0101.671] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.671] lstrlenW (lpString=".xls") returned 4
	[0101.671] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.671] lstrlenW (lpString=".xlsx") returned 5
	[0101.671] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0101.671] lstrlenW (lpString=".ppt") returned 4
	[0101.671] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0101.671] lstrlenW (lpString=".zip") returned 4
	[0101.671] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.671] lstrlenW (lpString=".rar") returned 4
	[0101.671] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.671] lstrlenW (lpString=".bz2") returned 4
	[0101.672] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.672] lstrlenW (lpString=".7z") returned 3
	[0101.672] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0101.672] lstrlenW (lpString=".dbf") returned 4
	[0101.672] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0101.672] lstrlenW (lpString=".1cd") returned 4
	[0101.672] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0101.672] lstrlenW (lpString=".jpg") returned 4
	[0101.672] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0101.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0101.672] lstrlenW (lpString=".doc") returned 4
	[0101.672] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.672] lstrlenW (lpString=".docx") returned 5
	[0101.672] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0101.672] lstrlenW (lpString=".pdf") returned 4
	[0101.672] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.672] lstrlenW (lpString=".xls") returned 4
	[0101.672] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.672] lstrlenW (lpString=".xlsx") returned 5
	[0101.672] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0101.672] lstrlenW (lpString=".ppt") returned 4
	[0101.672] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0101.672] lstrlenW (lpString=".zip") returned 4
	[0101.673] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.673] lstrlenW (lpString=".rar") returned 4
	[0101.673] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.673] lstrlenW (lpString=".bz2") returned 4
	[0101.673] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.673] lstrlenW (lpString=".7z") returned 3
	[0101.673] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0101.673] lstrlenW (lpString=".dbf") returned 4
	[0101.673] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0101.673] lstrlenW (lpString=".1cd") returned 4
	[0101.673] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0101.673] lstrlenW (lpString=".jpg") returned 4
	[0101.673] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.673] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0101.673] lstrlenW (lpString="EAST_01.MID") returned 11
	[0101.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0101.683] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=6165) returned 1
	[0101.683] CloseHandle (hObject=0x160) returned 1
	[0101.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20
	[0101.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0101.711] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.711] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0101.733] GetLastError () returned 0x0
	[0101.733] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1815, lpOverlapped=0x0) returned 1
	[0101.735] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1820, lpOverlapped=0x0) returned 1
	[0101.736] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.737] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0101.737] SetEndOfFile (hFile=0x1b4) returned 1
	[0101.739] CloseHandle (hObject=0x1b4) returned 1
	[0101.740] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.740] SetEndOfFile (hFile=0x1c0) returned 1
	[0101.743] CloseHandle (hObject=0x1c0) returned 1
	[0101.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 1
	[0101.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0101.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0101.749] lstrlenW (lpString=".doc") returned 4
	[0101.749] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.749] lstrlenW (lpString=".docx") returned 5
	[0101.749] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0101.749] lstrlenW (lpString=".pdf") returned 4
	[0101.750] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.750] lstrlenW (lpString=".xls") returned 4
	[0101.750] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.750] lstrlenW (lpString=".xlsx") returned 5
	[0101.750] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0101.750] lstrlenW (lpString=".ppt") returned 4
	[0101.750] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0101.750] lstrlenW (lpString=".zip") returned 4
	[0101.750] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.750] lstrlenW (lpString=".rar") returned 4
	[0101.750] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.750] lstrlenW (lpString=".bz2") returned 4
	[0101.750] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.750] lstrlenW (lpString=".7z") returned 3
	[0101.750] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0101.750] lstrlenW (lpString=".dbf") returned 4
	[0101.750] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0101.750] lstrlenW (lpString=".1cd") returned 4
	[0101.750] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0101.750] lstrlenW (lpString=".jpg") returned 4
	[0101.751] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0101.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0101.751] lstrlenW (lpString=".doc") returned 4
	[0101.751] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.751] lstrlenW (lpString=".docx") returned 5
	[0101.751] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0101.751] lstrlenW (lpString=".pdf") returned 4
	[0101.751] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.751] lstrlenW (lpString=".xls") returned 4
	[0101.751] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.751] lstrlenW (lpString=".xlsx") returned 5
	[0101.751] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0101.751] lstrlenW (lpString=".ppt") returned 4
	[0101.751] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0101.752] lstrlenW (lpString=".zip") returned 4
	[0101.752] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.752] lstrlenW (lpString=".rar") returned 4
	[0101.752] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.752] lstrlenW (lpString=".bz2") returned 4
	[0101.752] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.752] lstrlenW (lpString=".7z") returned 3
	[0101.752] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0101.752] lstrlenW (lpString=".dbf") returned 4
	[0101.752] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0101.752] lstrlenW (lpString=".1cd") returned 4
	[0101.752] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0101.752] lstrlenW (lpString=".jpg") returned 4
	[0101.752] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.752] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0101.752] lstrlenW (lpString="FALL_01.MID") returned 11
	[0101.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0101.762] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=4846) returned 1
	[0101.762] CloseHandle (hObject=0x1c0) returned 1
	[0101.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20
	[0101.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0101.791] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.791] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0101.807] GetLastError () returned 0x0
	[0101.807] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x12ee, lpOverlapped=0x0) returned 1
	[0101.809] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x12f0, lpOverlapped=0x0) returned 1
	[0101.810] ReadFile (in: hFile=0x160, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.810] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0101.810] SetEndOfFile (hFile=0x174) returned 1
	[0101.812] CloseHandle (hObject=0x174) returned 1
	[0101.813] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.813] SetEndOfFile (hFile=0x160) returned 1
	[0101.817] CloseHandle (hObject=0x160) returned 1
	[0101.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 1
	[0101.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0101.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0101.820] lstrlenW (lpString=".doc") returned 4
	[0101.820] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.820] lstrlenW (lpString=".docx") returned 5
	[0101.820] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0101.821] lstrlenW (lpString=".pdf") returned 4
	[0101.821] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.821] lstrlenW (lpString=".xls") returned 4
	[0101.821] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.821] lstrlenW (lpString=".xlsx") returned 5
	[0101.821] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0101.821] lstrlenW (lpString=".ppt") returned 4
	[0101.821] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0101.821] lstrlenW (lpString=".zip") returned 4
	[0101.821] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.821] lstrlenW (lpString=".rar") returned 4
	[0101.821] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.821] lstrlenW (lpString=".bz2") returned 4
	[0101.821] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.821] lstrlenW (lpString=".7z") returned 3
	[0101.821] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0101.821] lstrlenW (lpString=".dbf") returned 4
	[0101.821] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0101.821] lstrlenW (lpString=".1cd") returned 4
	[0101.821] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0101.821] lstrlenW (lpString=".jpg") returned 4
	[0101.821] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0101.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0101.822] lstrlenW (lpString=".doc") returned 4
	[0101.822] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.822] lstrlenW (lpString=".docx") returned 5
	[0101.822] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0101.822] lstrlenW (lpString=".pdf") returned 4
	[0101.822] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.822] lstrlenW (lpString=".xls") returned 4
	[0101.822] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.822] lstrlenW (lpString=".xlsx") returned 5
	[0101.822] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0101.822] lstrlenW (lpString=".ppt") returned 4
	[0101.822] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0101.822] lstrlenW (lpString=".zip") returned 4
	[0101.822] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.822] lstrlenW (lpString=".rar") returned 4
	[0101.822] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.822] lstrlenW (lpString=".bz2") returned 4
	[0101.822] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.822] lstrlenW (lpString=".7z") returned 3
	[0101.822] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0101.822] lstrlenW (lpString=".dbf") returned 4
	[0101.822] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0101.822] lstrlenW (lpString=".1cd") returned 4
	[0101.822] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0101.823] lstrlenW (lpString=".jpg") returned 4
	[0101.823] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.823] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0101.823] lstrlenW (lpString="FINCL_02.MID") returned 12
	[0101.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c
	[0101.834] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=9318) returned 1
	[0101.834] CloseHandle (hObject=0x15c) returned 1
	[0101.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 0x20
	[0101.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0101.868] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.868] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0101.887] GetLastError () returned 0x0
	[0101.887] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x2466, lpOverlapped=0x0) returned 1
	[0101.892] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2470, lpOverlapped=0x0) returned 1
	[0101.893] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.893] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.893] SetEndOfFile (hFile=0x1a8) returned 1
	[0101.896] CloseHandle (hObject=0x1a8) returned 1
	[0101.897] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.897] SetEndOfFile (hFile=0x190) returned 1
	[0101.914] CloseHandle (hObject=0x190) returned 1
	[0101.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0101.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 1
	[0101.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0101.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0101.924] lstrlenW (lpString=".doc") returned 4
	[0101.924] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.924] lstrlenW (lpString=".docx") returned 5
	[0101.924] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0101.924] lstrlenW (lpString=".pdf") returned 4
	[0101.924] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.924] lstrlenW (lpString=".xls") returned 4
	[0101.925] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.925] lstrlenW (lpString=".xlsx") returned 5
	[0101.925] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0101.925] lstrlenW (lpString=".ppt") returned 4
	[0101.925] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0101.925] lstrlenW (lpString=".zip") returned 4
	[0101.925] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.925] lstrlenW (lpString=".rar") returned 4
	[0101.925] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.925] lstrlenW (lpString=".bz2") returned 4
	[0101.925] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.925] lstrlenW (lpString=".7z") returned 3
	[0101.925] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0101.925] lstrlenW (lpString=".dbf") returned 4
	[0101.925] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0101.925] lstrlenW (lpString=".1cd") returned 4
	[0101.925] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0101.925] lstrlenW (lpString=".jpg") returned 4
	[0101.925] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0101.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0101.925] lstrlenW (lpString=".doc") returned 4
	[0101.925] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0101.926] lstrlenW (lpString=".docx") returned 5
	[0101.926] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0101.926] lstrlenW (lpString=".pdf") returned 4
	[0101.926] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0101.926] lstrlenW (lpString=".xls") returned 4
	[0101.926] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0101.926] lstrlenW (lpString=".xlsx") returned 5
	[0101.926] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0101.926] lstrlenW (lpString=".ppt") returned 4
	[0101.926] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0101.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0101.926] lstrlenW (lpString=".zip") returned 4
	[0101.926] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0101.926] lstrlenW (lpString=".rar") returned 4
	[0101.926] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0101.926] lstrlenW (lpString=".bz2") returned 4
	[0101.926] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0101.926] lstrlenW (lpString=".7z") returned 3
	[0101.926] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0101.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0101.926] lstrlenW (lpString=".dbf") returned 4
	[0101.926] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0101.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0101.926] lstrlenW (lpString=".1cd") returned 4
	[0101.926] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0101.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0101.927] lstrlenW (lpString=".jpg") returned 4
	[0101.927] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0101.927] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0101.927] lstrlenW (lpString="GRID_01.MID") returned 11
	[0101.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0101.949] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=6331) returned 1
	[0101.949] CloseHandle (hObject=0x190) returned 1
	[0101.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 0x20
	[0101.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0101.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0101.990] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.990] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.021] GetLastError () returned 0x0
	[0102.021] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x18bb, lpOverlapped=0x0) returned 1
	[0102.026] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x18c0, lpOverlapped=0x0) returned 1
	[0102.027] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.027] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0102.027] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.028] CloseHandle (hObject=0x1d0) returned 1
	[0102.028] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.028] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.031] CloseHandle (hObject=0x1a8) returned 1
	[0102.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 1
	[0102.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0102.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0102.034] lstrlenW (lpString=".doc") returned 4
	[0102.034] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.034] lstrlenW (lpString=".docx") returned 5
	[0102.034] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.034] lstrlenW (lpString=".pdf") returned 4
	[0102.034] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.034] lstrlenW (lpString=".xls") returned 4
	[0102.034] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.034] lstrlenW (lpString=".xlsx") returned 5
	[0102.034] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.034] lstrlenW (lpString=".ppt") returned 4
	[0102.034] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0102.034] lstrlenW (lpString=".zip") returned 4
	[0102.034] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.034] lstrlenW (lpString=".rar") returned 4
	[0102.034] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.034] lstrlenW (lpString=".bz2") returned 4
	[0102.034] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.034] lstrlenW (lpString=".7z") returned 3
	[0102.034] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0102.034] lstrlenW (lpString=".dbf") returned 4
	[0102.034] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0102.034] lstrlenW (lpString=".1cd") returned 4
	[0102.034] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0102.035] lstrlenW (lpString=".jpg") returned 4
	[0102.035] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0102.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0102.035] lstrlenW (lpString=".doc") returned 4
	[0102.035] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.035] lstrlenW (lpString=".docx") returned 5
	[0102.035] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.035] lstrlenW (lpString=".pdf") returned 4
	[0102.035] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.035] lstrlenW (lpString=".xls") returned 4
	[0102.035] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.035] lstrlenW (lpString=".xlsx") returned 5
	[0102.035] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.035] lstrlenW (lpString=".ppt") returned 4
	[0102.035] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0102.035] lstrlenW (lpString=".zip") returned 4
	[0102.035] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.035] lstrlenW (lpString=".rar") returned 4
	[0102.035] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.035] lstrlenW (lpString=".bz2") returned 4
	[0102.035] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.035] lstrlenW (lpString=".7z") returned 3
	[0102.035] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0102.035] lstrlenW (lpString=".dbf") returned 4
	[0102.035] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0102.036] lstrlenW (lpString=".1cd") returned 4
	[0102.036] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0102.036] lstrlenW (lpString=".jpg") returned 4
	[0102.036] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.036] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.036] lstrlenW (lpString="INDST_01.MID") returned 12
	[0102.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.042] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=8568) returned 1
	[0102.042] CloseHandle (hObject=0x1d0) returned 1
	[0102.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 0x20
	[0102.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0102.079] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.079] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.092] GetLastError () returned 0x0
	[0102.092] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x2178, lpOverlapped=0x0) returned 1
	[0102.095] WriteFile (in: hFile=0x1d4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2180, lpOverlapped=0x0) returned 1
	[0102.096] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.096] WriteFile (in: hFile=0x1d4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.096] SetEndOfFile (hFile=0x1d4) returned 1
	[0102.097] CloseHandle (hObject=0x1d4) returned 1
	[0102.097] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.097] SetEndOfFile (hFile=0x1e0) returned 1
	[0102.099] CloseHandle (hObject=0x1e0) returned 1
	[0102.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 1
	[0102.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0102.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0102.102] lstrlenW (lpString=".doc") returned 4
	[0102.102] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.102] lstrlenW (lpString=".docx") returned 5
	[0102.102] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.102] lstrlenW (lpString=".pdf") returned 4
	[0102.103] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.103] lstrlenW (lpString=".xls") returned 4
	[0102.103] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.103] lstrlenW (lpString=".xlsx") returned 5
	[0102.103] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.103] lstrlenW (lpString=".ppt") returned 4
	[0102.103] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0102.103] lstrlenW (lpString=".zip") returned 4
	[0102.103] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.103] lstrlenW (lpString=".rar") returned 4
	[0102.103] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.103] lstrlenW (lpString=".bz2") returned 4
	[0102.103] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.103] lstrlenW (lpString=".7z") returned 3
	[0102.103] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0102.103] lstrlenW (lpString=".dbf") returned 4
	[0102.103] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0102.103] lstrlenW (lpString=".1cd") returned 4
	[0102.103] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0102.103] lstrlenW (lpString=".jpg") returned 4
	[0102.103] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0102.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0102.103] lstrlenW (lpString=".doc") returned 4
	[0102.103] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.103] lstrlenW (lpString=".docx") returned 5
	[0102.104] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.104] lstrlenW (lpString=".pdf") returned 4
	[0102.104] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.104] lstrlenW (lpString=".xls") returned 4
	[0102.104] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.104] lstrlenW (lpString=".xlsx") returned 5
	[0102.104] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.104] lstrlenW (lpString=".ppt") returned 4
	[0102.104] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0102.104] lstrlenW (lpString=".zip") returned 4
	[0102.104] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.104] lstrlenW (lpString=".rar") returned 4
	[0102.104] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.104] lstrlenW (lpString=".bz2") returned 4
	[0102.104] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.104] lstrlenW (lpString=".7z") returned 3
	[0102.104] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0102.104] lstrlenW (lpString=".dbf") returned 4
	[0102.104] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0102.104] lstrlenW (lpString=".1cd") returned 4
	[0102.104] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0102.104] lstrlenW (lpString=".jpg") returned 4
	[0102.104] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.105] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.105] lstrlenW (lpString="JNGLE_01.MID") returned 12
	[0102.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.109] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=5843) returned 1
	[0102.109] CloseHandle (hObject=0x1d4) returned 1
	[0102.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20
	[0102.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.142] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.142] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.156] GetLastError () returned 0x0
	[0102.156] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x16d3, lpOverlapped=0x0) returned 1
	[0102.158] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x16e0, lpOverlapped=0x0) returned 1
	[0102.162] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.162] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.162] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.163] CloseHandle (hObject=0x1d0) returned 1
	[0102.163] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.163] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.166] CloseHandle (hObject=0x1a8) returned 1
	[0102.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 1
	[0102.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0102.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0102.171] lstrlenW (lpString=".doc") returned 4
	[0102.171] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.171] lstrlenW (lpString=".docx") returned 5
	[0102.171] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.171] lstrlenW (lpString=".pdf") returned 4
	[0102.171] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.171] lstrlenW (lpString=".xls") returned 4
	[0102.171] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.171] lstrlenW (lpString=".xlsx") returned 5
	[0102.171] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.171] lstrlenW (lpString=".ppt") returned 4
	[0102.171] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0102.171] lstrlenW (lpString=".zip") returned 4
	[0102.171] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.171] lstrlenW (lpString=".rar") returned 4
	[0102.171] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.171] lstrlenW (lpString=".bz2") returned 4
	[0102.171] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.171] lstrlenW (lpString=".7z") returned 3
	[0102.171] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0102.171] lstrlenW (lpString=".dbf") returned 4
	[0102.171] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0102.171] lstrlenW (lpString=".1cd") returned 4
	[0102.172] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0102.172] lstrlenW (lpString=".jpg") returned 4
	[0102.172] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0102.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0102.172] lstrlenW (lpString=".doc") returned 4
	[0102.172] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.172] lstrlenW (lpString=".docx") returned 5
	[0102.172] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.172] lstrlenW (lpString=".pdf") returned 4
	[0102.172] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.172] lstrlenW (lpString=".xls") returned 4
	[0102.172] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.172] lstrlenW (lpString=".xlsx") returned 5
	[0102.172] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.172] lstrlenW (lpString=".ppt") returned 4
	[0102.172] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0102.172] lstrlenW (lpString=".zip") returned 4
	[0102.172] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.172] lstrlenW (lpString=".rar") returned 4
	[0102.172] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.172] lstrlenW (lpString=".bz2") returned 4
	[0102.172] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.172] lstrlenW (lpString=".7z") returned 3
	[0102.173] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0102.173] lstrlenW (lpString=".dbf") returned 4
	[0102.173] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0102.173] lstrlenW (lpString=".1cd") returned 4
	[0102.173] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0102.173] lstrlenW (lpString=".jpg") returned 4
	[0102.173] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.173] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.173] lstrlenW (lpString="NBOOK_01.MID") returned 12
	[0102.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.179] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=5968) returned 1
	[0102.179] CloseHandle (hObject=0x1d0) returned 1
	[0102.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 0x20
	[0102.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.210] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.210] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.223] GetLastError () returned 0x0
	[0102.223] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1750, lpOverlapped=0x0) returned 1
	[0102.225] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1760, lpOverlapped=0x0) returned 1
	[0102.226] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.226] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.227] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.227] CloseHandle (hObject=0x1d0) returned 1
	[0102.228] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.228] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.231] CloseHandle (hObject=0x1a8) returned 1
	[0102.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 1
	[0102.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0102.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0102.234] lstrlenW (lpString=".doc") returned 4
	[0102.234] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.234] lstrlenW (lpString=".docx") returned 5
	[0102.234] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.234] lstrlenW (lpString=".pdf") returned 4
	[0102.234] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.234] lstrlenW (lpString=".xls") returned 4
	[0102.234] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.234] lstrlenW (lpString=".xlsx") returned 5
	[0102.234] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.234] lstrlenW (lpString=".ppt") returned 4
	[0102.234] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0102.234] lstrlenW (lpString=".zip") returned 4
	[0102.234] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.234] lstrlenW (lpString=".rar") returned 4
	[0102.235] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.235] lstrlenW (lpString=".bz2") returned 4
	[0102.235] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.235] lstrlenW (lpString=".7z") returned 3
	[0102.235] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0102.235] lstrlenW (lpString=".dbf") returned 4
	[0102.235] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0102.235] lstrlenW (lpString=".1cd") returned 4
	[0102.235] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0102.235] lstrlenW (lpString=".jpg") returned 4
	[0102.235] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0102.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0102.235] lstrlenW (lpString=".doc") returned 4
	[0102.235] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.235] lstrlenW (lpString=".docx") returned 5
	[0102.235] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.235] lstrlenW (lpString=".pdf") returned 4
	[0102.235] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.235] lstrlenW (lpString=".xls") returned 4
	[0102.235] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.235] lstrlenW (lpString=".xlsx") returned 5
	[0102.236] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.236] lstrlenW (lpString=".ppt") returned 4
	[0102.236] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0102.236] lstrlenW (lpString=".zip") returned 4
	[0102.236] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.236] lstrlenW (lpString=".rar") returned 4
	[0102.236] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.236] lstrlenW (lpString=".bz2") returned 4
	[0102.236] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.236] lstrlenW (lpString=".7z") returned 3
	[0102.236] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0102.236] lstrlenW (lpString=".dbf") returned 4
	[0102.236] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0102.236] lstrlenW (lpString=".1cd") returned 4
	[0102.236] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0102.236] lstrlenW (lpString=".jpg") returned 4
	[0102.236] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.236] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.237] lstrlenW (lpString="OUTDR_01.MID") returned 12
	[0102.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.242] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=6644) returned 1
	[0102.243] CloseHandle (hObject=0x1d0) returned 1
	[0102.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 0x20
	[0102.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.281] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.281] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.294] GetLastError () returned 0x0
	[0102.294] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x19f4, lpOverlapped=0x0) returned 1
	[0102.296] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1a00, lpOverlapped=0x0) returned 1
	[0102.297] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.297] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.298] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.299] CloseHandle (hObject=0x1d0) returned 1
	[0102.299] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.299] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.303] CloseHandle (hObject=0x1d8) returned 1
	[0102.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 1
	[0102.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0102.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0102.305] lstrlenW (lpString=".doc") returned 4
	[0102.305] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.305] lstrlenW (lpString=".docx") returned 5
	[0102.305] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.305] lstrlenW (lpString=".pdf") returned 4
	[0102.305] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.305] lstrlenW (lpString=".xls") returned 4
	[0102.305] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.305] lstrlenW (lpString=".xlsx") returned 5
	[0102.305] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.306] lstrlenW (lpString=".ppt") returned 4
	[0102.306] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0102.306] lstrlenW (lpString=".zip") returned 4
	[0102.306] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.306] lstrlenW (lpString=".rar") returned 4
	[0102.306] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.306] lstrlenW (lpString=".bz2") returned 4
	[0102.306] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.306] lstrlenW (lpString=".7z") returned 3
	[0102.306] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0102.306] lstrlenW (lpString=".dbf") returned 4
	[0102.306] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0102.306] lstrlenW (lpString=".1cd") returned 4
	[0102.306] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0102.306] lstrlenW (lpString=".jpg") returned 4
	[0102.306] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0102.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0102.306] lstrlenW (lpString=".doc") returned 4
	[0102.306] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.306] lstrlenW (lpString=".docx") returned 5
	[0102.306] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.307] lstrlenW (lpString=".pdf") returned 4
	[0102.307] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.307] lstrlenW (lpString=".xls") returned 4
	[0102.307] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.307] lstrlenW (lpString=".xlsx") returned 5
	[0102.307] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.307] lstrlenW (lpString=".ppt") returned 4
	[0102.307] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0102.307] lstrlenW (lpString=".zip") returned 4
	[0102.307] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.307] lstrlenW (lpString=".rar") returned 4
	[0102.307] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.307] lstrlenW (lpString=".bz2") returned 4
	[0102.307] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.307] lstrlenW (lpString=".7z") returned 3
	[0102.307] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0102.307] lstrlenW (lpString=".dbf") returned 4
	[0102.307] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0102.307] lstrlenW (lpString=".1cd") returned 4
	[0102.307] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0102.307] lstrlenW (lpString=".jpg") returned 4
	[0102.307] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.308] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.308] lstrlenW (lpString="PARNT_01.MID") returned 12
	[0102.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.316] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=6491) returned 1
	[0102.316] CloseHandle (hObject=0x1d0) returned 1
	[0102.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 0x20
	[0102.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.344] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.344] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.356] GetLastError () returned 0x0
	[0102.357] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x195b, lpOverlapped=0x0) returned 1
	[0102.359] WriteFile (in: hFile=0x1d4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1960, lpOverlapped=0x0) returned 1
	[0102.360] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.360] WriteFile (in: hFile=0x1d4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.360] SetEndOfFile (hFile=0x1d4) returned 1
	[0102.361] CloseHandle (hObject=0x1d4) returned 1
	[0102.362] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.362] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.365] CloseHandle (hObject=0x1a8) returned 1
	[0102.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 1
	[0102.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0102.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0102.368] lstrlenW (lpString=".doc") returned 4
	[0102.368] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.368] lstrlenW (lpString=".docx") returned 5
	[0102.368] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.368] lstrlenW (lpString=".pdf") returned 4
	[0102.368] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.368] lstrlenW (lpString=".xls") returned 4
	[0102.368] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.368] lstrlenW (lpString=".xlsx") returned 5
	[0102.368] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.368] lstrlenW (lpString=".ppt") returned 4
	[0102.368] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0102.368] lstrlenW (lpString=".zip") returned 4
	[0102.368] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.368] lstrlenW (lpString=".rar") returned 4
	[0102.368] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.368] lstrlenW (lpString=".bz2") returned 4
	[0102.368] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.368] lstrlenW (lpString=".7z") returned 3
	[0102.368] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0102.368] lstrlenW (lpString=".dbf") returned 4
	[0102.368] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0102.369] lstrlenW (lpString=".1cd") returned 4
	[0102.369] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0102.369] lstrlenW (lpString=".jpg") returned 4
	[0102.369] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0102.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0102.369] lstrlenW (lpString=".doc") returned 4
	[0102.369] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.369] lstrlenW (lpString=".docx") returned 5
	[0102.369] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.369] lstrlenW (lpString=".pdf") returned 4
	[0102.369] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.369] lstrlenW (lpString=".xls") returned 4
	[0102.369] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.369] lstrlenW (lpString=".xlsx") returned 5
	[0102.369] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.369] lstrlenW (lpString=".ppt") returned 4
	[0102.369] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0102.369] lstrlenW (lpString=".zip") returned 4
	[0102.369] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.369] lstrlenW (lpString=".rar") returned 4
	[0102.369] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.369] lstrlenW (lpString=".bz2") returned 4
	[0102.369] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.369] lstrlenW (lpString=".7z") returned 3
	[0102.370] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0102.370] lstrlenW (lpString=".dbf") returned 4
	[0102.370] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0102.370] lstrlenW (lpString=".1cd") returned 4
	[0102.370] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0102.370] lstrlenW (lpString=".jpg") returned 4
	[0102.370] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.370] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.370] lstrlenW (lpString="PARNT_03.MID") returned 12
	[0102.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.375] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=8538) returned 1
	[0102.376] CloseHandle (hObject=0x1d4) returned 1
	[0102.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 0x20
	[0102.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.407] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.407] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.420] GetLastError () returned 0x0
	[0102.420] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x215a, lpOverlapped=0x0) returned 1
	[0102.422] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2160, lpOverlapped=0x0) returned 1
	[0102.423] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.423] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.423] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.425] CloseHandle (hObject=0x1d0) returned 1
	[0102.426] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.426] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.427] CloseHandle (hObject=0x1d8) returned 1
	[0102.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 1
	[0102.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0102.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0102.436] lstrlenW (lpString=".doc") returned 4
	[0102.436] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.436] lstrlenW (lpString=".docx") returned 5
	[0102.436] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1
	[0102.436] lstrlenW (lpString=".pdf") returned 4
	[0102.436] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.436] lstrlenW (lpString=".xls") returned 4
	[0102.436] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.436] lstrlenW (lpString=".xlsx") returned 5
	[0102.436] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1
	[0102.437] lstrlenW (lpString=".ppt") returned 4
	[0102.437] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0102.437] lstrlenW (lpString=".zip") returned 4
	[0102.437] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.437] lstrlenW (lpString=".rar") returned 4
	[0102.437] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.437] lstrlenW (lpString=".bz2") returned 4
	[0102.437] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.437] lstrlenW (lpString=".7z") returned 3
	[0102.437] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0102.437] lstrlenW (lpString=".dbf") returned 4
	[0102.437] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0102.437] lstrlenW (lpString=".1cd") returned 4
	[0102.437] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0102.437] lstrlenW (lpString=".jpg") returned 4
	[0102.437] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0102.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0102.437] lstrlenW (lpString=".doc") returned 4
	[0102.437] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.437] lstrlenW (lpString=".docx") returned 5
	[0102.437] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1
	[0102.437] lstrlenW (lpString=".pdf") returned 4
	[0102.437] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.437] lstrlenW (lpString=".xls") returned 4
	[0102.437] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.437] lstrlenW (lpString=".xlsx") returned 5
	[0102.437] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1
	[0102.438] lstrlenW (lpString=".ppt") returned 4
	[0102.438] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0102.438] lstrlenW (lpString=".zip") returned 4
	[0102.438] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.438] lstrlenW (lpString=".rar") returned 4
	[0102.438] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.438] lstrlenW (lpString=".bz2") returned 4
	[0102.438] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.438] lstrlenW (lpString=".7z") returned 3
	[0102.438] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0102.438] lstrlenW (lpString=".dbf") returned 4
	[0102.438] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0102.438] lstrlenW (lpString=".1cd") returned 4
	[0102.438] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0102.438] lstrlenW (lpString=".jpg") returned 4
	[0102.438] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.438] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.438] lstrlenW (lpString="PARNT_05.MID") returned 12
	[0102.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.448] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=6020) returned 1
	[0102.448] CloseHandle (hObject=0x1d8) returned 1
	[0102.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 0x20
	[0102.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.473] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.473] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.488] GetLastError () returned 0x0
	[0102.488] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1784, lpOverlapped=0x0) returned 1
	[0102.490] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1790, lpOverlapped=0x0) returned 1
	[0102.492] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.492] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.492] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.496] CloseHandle (hObject=0x1d0) returned 1
	[0102.497] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.497] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.500] CloseHandle (hObject=0x1a8) returned 1
	[0102.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 1
	[0102.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0102.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0102.503] lstrlenW (lpString=".doc") returned 4
	[0102.503] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.503] lstrlenW (lpString=".docx") returned 5
	[0102.503] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1
	[0102.503] lstrlenW (lpString=".pdf") returned 4
	[0102.503] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.503] lstrlenW (lpString=".xls") returned 4
	[0102.503] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.504] lstrlenW (lpString=".xlsx") returned 5
	[0102.504] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1
	[0102.504] lstrlenW (lpString=".ppt") returned 4
	[0102.504] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0102.504] lstrlenW (lpString=".zip") returned 4
	[0102.504] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.504] lstrlenW (lpString=".rar") returned 4
	[0102.504] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.504] lstrlenW (lpString=".bz2") returned 4
	[0102.504] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.504] lstrlenW (lpString=".7z") returned 3
	[0102.504] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0102.504] lstrlenW (lpString=".dbf") returned 4
	[0102.504] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0102.504] lstrlenW (lpString=".1cd") returned 4
	[0102.504] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0102.504] lstrlenW (lpString=".jpg") returned 4
	[0102.504] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0102.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0102.504] lstrlenW (lpString=".doc") returned 4
	[0102.505] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.505] lstrlenW (lpString=".docx") returned 5
	[0102.505] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1
	[0102.505] lstrlenW (lpString=".pdf") returned 4
	[0102.505] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.505] lstrlenW (lpString=".xls") returned 4
	[0102.505] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.505] lstrlenW (lpString=".xlsx") returned 5
	[0102.505] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1
	[0102.505] lstrlenW (lpString=".ppt") returned 4
	[0102.505] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0102.505] lstrlenW (lpString=".zip") returned 4
	[0102.505] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.505] lstrlenW (lpString=".rar") returned 4
	[0102.505] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.505] lstrlenW (lpString=".bz2") returned 4
	[0102.505] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.505] lstrlenW (lpString=".7z") returned 3
	[0102.505] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0102.505] lstrlenW (lpString=".dbf") returned 4
	[0102.505] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0102.505] lstrlenW (lpString=".1cd") returned 4
	[0102.505] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0102.506] lstrlenW (lpString=".jpg") returned 4
	[0102.506] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.506] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.506] lstrlenW (lpString="PARNT_07.MID") returned 12
	[0102.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0102.513] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=6564) returned 1
	[0102.513] CloseHandle (hObject=0x1e0) returned 1
	[0102.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 0x20
	[0102.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.540] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.540] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.579] GetLastError () returned 0x0
	[0102.580] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x19a4, lpOverlapped=0x0) returned 1
	[0102.582] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x19b0, lpOverlapped=0x0) returned 1
	[0102.583] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.584] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.584] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.590] CloseHandle (hObject=0x1d0) returned 1
	[0102.591] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.591] SetEndOfFile (hFile=0x184) returned 1
	[0102.593] CloseHandle (hObject=0x184) returned 1
	[0102.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 1
	[0102.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0102.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0102.596] lstrlenW (lpString=".doc") returned 4
	[0102.596] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.596] lstrlenW (lpString=".docx") returned 5
	[0102.597] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1
	[0102.597] lstrlenW (lpString=".pdf") returned 4
	[0102.597] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.597] lstrlenW (lpString=".xls") returned 4
	[0102.597] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.597] lstrlenW (lpString=".xlsx") returned 5
	[0102.597] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1
	[0102.597] lstrlenW (lpString=".ppt") returned 4
	[0102.597] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0102.597] lstrlenW (lpString=".zip") returned 4
	[0102.597] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.597] lstrlenW (lpString=".rar") returned 4
	[0102.597] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.597] lstrlenW (lpString=".bz2") returned 4
	[0102.597] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.597] lstrlenW (lpString=".7z") returned 3
	[0102.597] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0102.598] lstrlenW (lpString=".dbf") returned 4
	[0102.598] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0102.598] lstrlenW (lpString=".1cd") returned 4
	[0102.598] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0102.598] lstrlenW (lpString=".jpg") returned 4
	[0102.598] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0102.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0102.598] lstrlenW (lpString=".doc") returned 4
	[0102.598] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.598] lstrlenW (lpString=".docx") returned 5
	[0102.598] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1
	[0102.598] lstrlenW (lpString=".pdf") returned 4
	[0102.598] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.598] lstrlenW (lpString=".xls") returned 4
	[0102.598] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.599] lstrlenW (lpString=".xlsx") returned 5
	[0102.599] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1
	[0102.599] lstrlenW (lpString=".ppt") returned 4
	[0102.599] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0102.599] lstrlenW (lpString=".zip") returned 4
	[0102.599] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.599] lstrlenW (lpString=".rar") returned 4
	[0102.599] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.599] lstrlenW (lpString=".bz2") returned 4
	[0102.599] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.599] lstrlenW (lpString=".7z") returned 3
	[0102.599] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0102.599] lstrlenW (lpString=".dbf") returned 4
	[0102.599] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0102.599] lstrlenW (lpString=".1cd") returned 4
	[0102.599] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0102.599] lstrlenW (lpString=".jpg") returned 4
	[0102.599] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.599] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.600] lstrlenW (lpString="PARNT_09.MID") returned 12
	[0102.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.606] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=6764) returned 1
	[0102.606] CloseHandle (hObject=0x1d0) returned 1
	[0102.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20
	[0102.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.635] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.635] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0102.650] GetLastError () returned 0x0
	[0102.650] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1a6c, lpOverlapped=0x0) returned 1
	[0102.652] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1a70, lpOverlapped=0x0) returned 1
	[0102.654] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.654] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.654] SetEndOfFile (hFile=0x1bc) returned 1
	[0102.658] CloseHandle (hObject=0x1bc) returned 1
	[0102.659] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.659] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.661] CloseHandle (hObject=0x1a8) returned 1
	[0102.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 1
	[0102.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0102.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0102.665] lstrlenW (lpString=".doc") returned 4
	[0102.665] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.665] lstrlenW (lpString=".docx") returned 5
	[0102.665] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1
	[0102.665] lstrlenW (lpString=".pdf") returned 4
	[0102.665] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.665] lstrlenW (lpString=".xls") returned 4
	[0102.665] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.665] lstrlenW (lpString=".xlsx") returned 5
	[0102.665] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1
	[0102.665] lstrlenW (lpString=".ppt") returned 4
	[0102.665] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0102.665] lstrlenW (lpString=".zip") returned 4
	[0102.665] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.666] lstrlenW (lpString=".rar") returned 4
	[0102.666] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.666] lstrlenW (lpString=".bz2") returned 4
	[0102.666] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.666] lstrlenW (lpString=".7z") returned 3
	[0102.666] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0102.666] lstrlenW (lpString=".dbf") returned 4
	[0102.666] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0102.666] lstrlenW (lpString=".1cd") returned 4
	[0102.666] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0102.666] lstrlenW (lpString=".jpg") returned 4
	[0102.666] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0102.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0102.666] lstrlenW (lpString=".doc") returned 4
	[0102.666] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.666] lstrlenW (lpString=".docx") returned 5
	[0102.666] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1
	[0102.666] lstrlenW (lpString=".pdf") returned 4
	[0102.667] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.667] lstrlenW (lpString=".xls") returned 4
	[0102.667] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.667] lstrlenW (lpString=".xlsx") returned 5
	[0102.667] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1
	[0102.667] lstrlenW (lpString=".ppt") returned 4
	[0102.667] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0102.667] lstrlenW (lpString=".zip") returned 4
	[0102.667] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.667] lstrlenW (lpString=".rar") returned 4
	[0102.667] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.667] lstrlenW (lpString=".bz2") returned 4
	[0102.667] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.667] lstrlenW (lpString=".7z") returned 3
	[0102.667] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0102.667] lstrlenW (lpString=".dbf") returned 4
	[0102.667] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0102.667] lstrlenW (lpString=".1cd") returned 4
	[0102.667] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0102.667] lstrlenW (lpString=".jpg") returned 4
	[0102.667] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.669] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.669] lstrlenW (lpString="ROAD_01.MID") returned 11
	[0102.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0102.674] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=5983) returned 1
	[0102.674] CloseHandle (hObject=0x1bc) returned 1
	[0102.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 0x20
	[0102.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.699] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.700] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0102.707] GetLastError () returned 0x0
	[0102.707] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x175f, lpOverlapped=0x0) returned 1
	[0102.710] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1760, lpOverlapped=0x0) returned 1
	[0102.711] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.711] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0102.711] SetEndOfFile (hFile=0x1bc) returned 1
	[0102.718] CloseHandle (hObject=0x1bc) returned 1
	[0102.719] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.719] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.721] CloseHandle (hObject=0x1d8) returned 1
	[0102.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 1
	[0102.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0102.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0102.725] lstrlenW (lpString=".doc") returned 4
	[0102.725] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.725] lstrlenW (lpString=".docx") returned 5
	[0102.725] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.725] lstrlenW (lpString=".pdf") returned 4
	[0102.725] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.725] lstrlenW (lpString=".xls") returned 4
	[0102.725] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.725] lstrlenW (lpString=".xlsx") returned 5
	[0102.726] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.726] lstrlenW (lpString=".ppt") returned 4
	[0102.726] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0102.726] lstrlenW (lpString=".zip") returned 4
	[0102.726] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.726] lstrlenW (lpString=".rar") returned 4
	[0102.726] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.726] lstrlenW (lpString=".bz2") returned 4
	[0102.726] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.726] lstrlenW (lpString=".7z") returned 3
	[0102.726] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0102.726] lstrlenW (lpString=".dbf") returned 4
	[0102.726] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0102.726] lstrlenW (lpString=".1cd") returned 4
	[0102.726] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0102.726] lstrlenW (lpString=".jpg") returned 4
	[0102.726] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0102.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0102.726] lstrlenW (lpString=".doc") returned 4
	[0102.726] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.727] lstrlenW (lpString=".docx") returned 5
	[0102.727] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.727] lstrlenW (lpString=".pdf") returned 4
	[0102.727] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.727] lstrlenW (lpString=".xls") returned 4
	[0102.727] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.727] lstrlenW (lpString=".xlsx") returned 5
	[0102.727] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.727] lstrlenW (lpString=".ppt") returned 4
	[0102.727] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0102.727] lstrlenW (lpString=".zip") returned 4
	[0102.727] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.727] lstrlenW (lpString=".rar") returned 4
	[0102.727] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.727] lstrlenW (lpString=".bz2") returned 4
	[0102.727] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.727] lstrlenW (lpString=".7z") returned 3
	[0102.727] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0102.727] lstrlenW (lpString=".dbf") returned 4
	[0102.727] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0102.727] lstrlenW (lpString=".1cd") returned 4
	[0102.727] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0102.727] lstrlenW (lpString=".jpg") returned 4
	[0102.728] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.728] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.728] lstrlenW (lpString="SCHOL_02.MID") returned 12
	[0102.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0102.735] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=5058) returned 1
	[0102.735] CloseHandle (hObject=0x1bc) returned 1
	[0102.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 0x20
	[0102.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.761] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.761] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0102.776] GetLastError () returned 0x0
	[0102.776] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x13c2, lpOverlapped=0x0) returned 1
	[0102.779] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x13d0, lpOverlapped=0x0) returned 1
	[0102.780] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.780] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.780] SetEndOfFile (hFile=0x1bc) returned 1
	[0102.783] CloseHandle (hObject=0x1bc) returned 1
	[0102.784] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.784] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.785] CloseHandle (hObject=0x1d8) returned 1
	[0102.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 1
	[0102.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0102.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0102.788] lstrlenW (lpString=".doc") returned 4
	[0102.788] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.788] lstrlenW (lpString=".docx") returned 5
	[0102.788] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0102.789] lstrlenW (lpString=".pdf") returned 4
	[0102.789] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.789] lstrlenW (lpString=".xls") returned 4
	[0102.789] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.789] lstrlenW (lpString=".xlsx") returned 5
	[0102.789] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0102.789] lstrlenW (lpString=".ppt") returned 4
	[0102.789] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0102.789] lstrlenW (lpString=".zip") returned 4
	[0102.789] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.789] lstrlenW (lpString=".rar") returned 4
	[0102.789] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.789] lstrlenW (lpString=".bz2") returned 4
	[0102.789] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.789] lstrlenW (lpString=".7z") returned 3
	[0102.789] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0102.789] lstrlenW (lpString=".dbf") returned 4
	[0102.789] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0102.789] lstrlenW (lpString=".1cd") returned 4
	[0102.789] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0102.789] lstrlenW (lpString=".jpg") returned 4
	[0102.790] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0102.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0102.790] lstrlenW (lpString=".doc") returned 4
	[0102.790] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.790] lstrlenW (lpString=".docx") returned 5
	[0102.790] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0102.790] lstrlenW (lpString=".pdf") returned 4
	[0102.790] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.790] lstrlenW (lpString=".xls") returned 4
	[0102.790] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.790] lstrlenW (lpString=".xlsx") returned 5
	[0102.790] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0102.790] lstrlenW (lpString=".ppt") returned 4
	[0102.790] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0102.790] lstrlenW (lpString=".zip") returned 4
	[0102.790] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.790] lstrlenW (lpString=".rar") returned 4
	[0102.790] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.790] lstrlenW (lpString=".bz2") returned 4
	[0102.790] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.790] lstrlenW (lpString=".7z") returned 3
	[0102.790] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0102.790] lstrlenW (lpString=".dbf") returned 4
	[0102.790] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0102.791] lstrlenW (lpString=".1cd") returned 4
	[0102.791] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0102.791] lstrlenW (lpString=".jpg") returned 4
	[0102.791] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.791] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.791] lstrlenW (lpString="SPACE_01.MID") returned 12
	[0102.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0102.799] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=4219) returned 1
	[0102.799] CloseHandle (hObject=0x190) returned 1
	[0102.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 0x20
	[0102.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.826] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.826] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.838] GetLastError () returned 0x0
	[0102.838] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x107b, lpOverlapped=0x0) returned 1
	[0102.840] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1080, lpOverlapped=0x0) returned 1
	[0102.841] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.841] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.841] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.844] CloseHandle (hObject=0x1a8) returned 1
	[0102.845] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.845] SetEndOfFile (hFile=0x184) returned 1
	[0102.847] CloseHandle (hObject=0x184) returned 1
	[0102.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 1
	[0102.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0102.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0102.849] lstrlenW (lpString=".doc") returned 4
	[0102.849] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.849] lstrlenW (lpString=".docx") returned 5
	[0102.849] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.849] lstrlenW (lpString=".pdf") returned 4
	[0102.849] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.849] lstrlenW (lpString=".xls") returned 4
	[0102.849] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.849] lstrlenW (lpString=".xlsx") returned 5
	[0102.849] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.849] lstrlenW (lpString=".ppt") returned 4
	[0102.849] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0102.849] lstrlenW (lpString=".zip") returned 4
	[0102.849] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.849] lstrlenW (lpString=".rar") returned 4
	[0102.849] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.849] lstrlenW (lpString=".bz2") returned 4
	[0102.849] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.850] lstrlenW (lpString=".7z") returned 3
	[0102.850] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0102.850] lstrlenW (lpString=".dbf") returned 4
	[0102.850] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0102.850] lstrlenW (lpString=".1cd") returned 4
	[0102.850] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0102.850] lstrlenW (lpString=".jpg") returned 4
	[0102.850] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0102.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0102.850] lstrlenW (lpString=".doc") returned 4
	[0102.850] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.850] lstrlenW (lpString=".docx") returned 5
	[0102.850] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.850] lstrlenW (lpString=".pdf") returned 4
	[0102.850] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.850] lstrlenW (lpString=".xls") returned 4
	[0102.850] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.850] lstrlenW (lpString=".xlsx") returned 5
	[0102.850] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.850] lstrlenW (lpString=".ppt") returned 4
	[0102.850] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0102.850] lstrlenW (lpString=".zip") returned 4
	[0102.850] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.850] lstrlenW (lpString=".rar") returned 4
	[0102.850] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.851] lstrlenW (lpString=".bz2") returned 4
	[0102.851] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.851] lstrlenW (lpString=".7z") returned 3
	[0102.851] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0102.851] lstrlenW (lpString=".dbf") returned 4
	[0102.851] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0102.851] lstrlenW (lpString=".1cd") returned 4
	[0102.851] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0102.851] lstrlenW (lpString=".jpg") returned 4
	[0102.851] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.851] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.851] lstrlenW (lpString="SUMER_01.MID") returned 12
	[0102.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.855] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=14044) returned 1
	[0102.855] CloseHandle (hObject=0x1a8) returned 1
	[0102.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 0x20
	[0102.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.880] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.880] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.892] GetLastError () returned 0x0
	[0102.892] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x36dc, lpOverlapped=0x0) returned 1
	[0102.894] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x36e0, lpOverlapped=0x0) returned 1
	[0102.895] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.896] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.896] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.897] CloseHandle (hObject=0x1a8) returned 1
	[0102.912] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.912] SetEndOfFile (hFile=0x184) returned 1
	[0102.915] CloseHandle (hObject=0x184) returned 1
	[0102.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 1
	[0102.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0102.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0102.918] lstrlenW (lpString=".doc") returned 4
	[0102.918] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.918] lstrlenW (lpString=".docx") returned 5
	[0102.918] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.918] lstrlenW (lpString=".pdf") returned 4
	[0102.918] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.918] lstrlenW (lpString=".xls") returned 4
	[0102.918] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.918] lstrlenW (lpString=".xlsx") returned 5
	[0102.918] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.919] lstrlenW (lpString=".ppt") returned 4
	[0102.919] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0102.919] lstrlenW (lpString=".zip") returned 4
	[0102.919] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.919] lstrlenW (lpString=".rar") returned 4
	[0102.919] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.919] lstrlenW (lpString=".bz2") returned 4
	[0102.919] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.919] lstrlenW (lpString=".7z") returned 3
	[0102.919] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0102.919] lstrlenW (lpString=".dbf") returned 4
	[0102.919] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0102.919] lstrlenW (lpString=".1cd") returned 4
	[0102.919] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0102.919] lstrlenW (lpString=".jpg") returned 4
	[0102.919] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0102.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0102.920] lstrlenW (lpString=".doc") returned 4
	[0102.920] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.920] lstrlenW (lpString=".docx") returned 5
	[0102.920] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.920] lstrlenW (lpString=".pdf") returned 4
	[0102.920] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.920] lstrlenW (lpString=".xls") returned 4
	[0102.920] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.920] lstrlenW (lpString=".xlsx") returned 5
	[0102.920] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.920] lstrlenW (lpString=".ppt") returned 4
	[0102.920] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0102.920] lstrlenW (lpString=".zip") returned 4
	[0102.920] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.920] lstrlenW (lpString=".rar") returned 4
	[0102.920] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.920] lstrlenW (lpString=".bz2") returned 4
	[0102.920] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.920] lstrlenW (lpString=".7z") returned 3
	[0102.920] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0102.920] lstrlenW (lpString=".dbf") returned 4
	[0102.920] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0102.921] lstrlenW (lpString=".1cd") returned 4
	[0102.921] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0102.921] lstrlenW (lpString=".jpg") returned 4
	[0102.921] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.921] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.921] lstrlenW (lpString="URBAN_01.MID") returned 12
	[0102.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0102.928] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=13358) returned 1
	[0102.928] CloseHandle (hObject=0x184) returned 1
	[0102.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 0x20
	[0102.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0102.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.947] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.947] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0102.966] GetLastError () returned 0x0
	[0102.966] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x342e, lpOverlapped=0x0) returned 1
	[0102.971] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x3430, lpOverlapped=0x0) returned 1
	[0102.973] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.973] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.973] SetEndOfFile (hFile=0x1a8) returned 1
	[0102.975] CloseHandle (hObject=0x1a8) returned 1
	[0102.975] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.975] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.979] CloseHandle (hObject=0x1d8) returned 1
	[0102.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0102.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 1
	[0102.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0102.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0102.984] lstrlenW (lpString=".doc") returned 4
	[0102.984] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.984] lstrlenW (lpString=".docx") returned 5
	[0102.984] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.984] lstrlenW (lpString=".pdf") returned 4
	[0102.984] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.984] lstrlenW (lpString=".xls") returned 4
	[0102.984] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.984] lstrlenW (lpString=".xlsx") returned 5
	[0102.984] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.984] lstrlenW (lpString=".ppt") returned 4
	[0102.984] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0102.984] lstrlenW (lpString=".zip") returned 4
	[0102.984] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.984] lstrlenW (lpString=".rar") returned 4
	[0102.985] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.985] lstrlenW (lpString=".bz2") returned 4
	[0102.985] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.985] lstrlenW (lpString=".7z") returned 3
	[0102.985] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0102.985] lstrlenW (lpString=".dbf") returned 4
	[0102.985] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0102.985] lstrlenW (lpString=".1cd") returned 4
	[0102.985] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0102.985] lstrlenW (lpString=".jpg") returned 4
	[0102.985] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0102.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0102.985] lstrlenW (lpString=".doc") returned 4
	[0102.985] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0102.985] lstrlenW (lpString=".docx") returned 5
	[0102.985] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0102.985] lstrlenW (lpString=".pdf") returned 4
	[0102.985] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0102.985] lstrlenW (lpString=".xls") returned 4
	[0102.985] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0102.985] lstrlenW (lpString=".xlsx") returned 5
	[0102.985] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0102.986] lstrlenW (lpString=".ppt") returned 4
	[0102.986] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0102.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0102.986] lstrlenW (lpString=".zip") returned 4
	[0102.986] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0102.986] lstrlenW (lpString=".rar") returned 4
	[0102.986] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0102.986] lstrlenW (lpString=".bz2") returned 4
	[0102.986] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0102.986] lstrlenW (lpString=".7z") returned 3
	[0102.986] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0102.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0102.986] lstrlenW (lpString=".dbf") returned 4
	[0102.986] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0102.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0102.986] lstrlenW (lpString=".1cd") returned 4
	[0102.986] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0102.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0102.986] lstrlenW (lpString=".jpg") returned 4
	[0102.986] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0102.986] lstrcmpiW (lpString1=".MID", lpString2=".adobe") returned 1
	[0102.986] lstrlenW (lpString="WNTER_01.MID") returned 12
	[0102.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0102.993] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=6915) returned 1
	[0102.993] CloseHandle (hObject=0x1d4) returned 1
	[0102.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 0x20
	[0103.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.016] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.016] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.093] GetLastError () returned 0x0
	[0103.093] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1b03, lpOverlapped=0x0) returned 1
	[0103.105] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1b10, lpOverlapped=0x0) returned 1
	[0103.106] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.106] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.106] SetEndOfFile (hFile=0x184) returned 1
	[0103.136] CloseHandle (hObject=0x184) returned 1
	[0103.185] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.185] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.212] CloseHandle (hObject=0x1d8) returned 1
	[0103.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 1
	[0103.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0103.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0103.279] lstrlenW (lpString=".doc") returned 4
	[0103.279] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0103.279] lstrlenW (lpString=".docx") returned 5
	[0103.279] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0103.279] lstrlenW (lpString=".pdf") returned 4
	[0103.279] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0103.279] lstrlenW (lpString=".xls") returned 4
	[0103.279] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0103.280] lstrlenW (lpString=".xlsx") returned 5
	[0103.280] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0103.280] lstrlenW (lpString=".ppt") returned 4
	[0103.280] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0103.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0103.280] lstrlenW (lpString=".zip") returned 4
	[0103.280] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0103.280] lstrlenW (lpString=".rar") returned 4
	[0103.280] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0103.280] lstrlenW (lpString=".bz2") returned 4
	[0103.280] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0103.280] lstrlenW (lpString=".7z") returned 3
	[0103.280] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0103.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0103.280] lstrlenW (lpString=".dbf") returned 4
	[0103.280] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0103.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0103.280] lstrlenW (lpString=".1cd") returned 4
	[0103.280] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0103.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0103.280] lstrlenW (lpString=".jpg") returned 4
	[0103.280] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0103.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0103.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0103.280] lstrlenW (lpString=".doc") returned 4
	[0103.280] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0103.280] lstrlenW (lpString=".docx") returned 5
	[0103.280] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0103.280] lstrlenW (lpString=".pdf") returned 4
	[0103.280] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0103.281] lstrlenW (lpString=".xls") returned 4
	[0103.281] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0103.281] lstrlenW (lpString=".xlsx") returned 5
	[0103.281] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0103.281] lstrlenW (lpString=".ppt") returned 4
	[0103.281] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0103.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0103.281] lstrlenW (lpString=".zip") returned 4
	[0103.281] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0103.281] lstrlenW (lpString=".rar") returned 4
	[0103.281] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0103.281] lstrlenW (lpString=".bz2") returned 4
	[0103.281] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0103.281] lstrlenW (lpString=".7z") returned 3
	[0103.281] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0103.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0103.281] lstrlenW (lpString=".dbf") returned 4
	[0103.281] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0103.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0103.281] lstrlenW (lpString=".1cd") returned 4
	[0103.281] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0103.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0103.281] lstrlenW (lpString=".jpg") returned 4
	[0103.281] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0103.282] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.282] lstrlenW (lpString="Elemental.eftx") returned 14
	[0103.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.286] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=314017) returned 1
	[0103.286] CloseHandle (hObject=0x1d8) returned 1
	[0103.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 0x20
	[0103.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.287] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.287] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.287] GetLastError () returned 0x0
	[0103.287] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x4caa1, lpOverlapped=0x0) returned 1
	[0103.295] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4cab0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x4cab0, lpOverlapped=0x0) returned 1
	[0103.311] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.311] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0103.311] SetEndOfFile (hFile=0x184) returned 1
	[0103.312] CloseHandle (hObject=0x184) returned 1
	[0103.312] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.312] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.316] CloseHandle (hObject=0x1d8) returned 1
	[0103.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 1
	[0103.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0103.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0103.317] lstrlenW (lpString=".doc") returned 4
	[0103.317] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.317] lstrlenW (lpString=".docx") returned 5
	[0103.317] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.317] lstrlenW (lpString=".pdf") returned 4
	[0103.317] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.317] lstrlenW (lpString=".xls") returned 4
	[0103.317] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.317] lstrlenW (lpString=".xlsx") returned 5
	[0103.317] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.317] lstrlenW (lpString=".ppt") returned 4
	[0103.317] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0103.317] lstrlenW (lpString=".zip") returned 4
	[0103.317] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.317] lstrlenW (lpString=".rar") returned 4
	[0103.317] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.317] lstrlenW (lpString=".bz2") returned 4
	[0103.317] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.317] lstrlenW (lpString=".7z") returned 3
	[0103.317] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0103.317] lstrlenW (lpString=".dbf") returned 4
	[0103.317] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0103.318] lstrlenW (lpString=".1cd") returned 4
	[0103.318] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0103.318] lstrlenW (lpString=".jpg") returned 4
	[0103.318] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0103.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0103.318] lstrlenW (lpString=".doc") returned 4
	[0103.318] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.318] lstrlenW (lpString=".docx") returned 5
	[0103.318] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.318] lstrlenW (lpString=".pdf") returned 4
	[0103.318] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.318] lstrlenW (lpString=".xls") returned 4
	[0103.318] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.318] lstrlenW (lpString=".xlsx") returned 5
	[0103.318] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.318] lstrlenW (lpString=".ppt") returned 4
	[0103.318] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0103.318] lstrlenW (lpString=".zip") returned 4
	[0103.318] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.318] lstrlenW (lpString=".rar") returned 4
	[0103.318] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.318] lstrlenW (lpString=".bz2") returned 4
	[0103.318] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.318] lstrlenW (lpString=".7z") returned 3
	[0103.318] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0103.319] lstrlenW (lpString=".dbf") returned 4
	[0103.319] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0103.319] lstrlenW (lpString=".1cd") returned 4
	[0103.319] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0103.319] lstrlenW (lpString=".jpg") returned 4
	[0103.319] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.319] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.319] lstrlenW (lpString="Equity.eftx") returned 11
	[0103.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.325] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=24611) returned 1
	[0103.325] CloseHandle (hObject=0x1d8) returned 1
	[0103.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 0x20
	[0103.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.326] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.326] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.327] GetLastError () returned 0x0
	[0103.327] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x6023, lpOverlapped=0x0) returned 1
	[0103.333] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x6030, lpOverlapped=0x0) returned 1
	[0103.335] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.335] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0103.335] SetEndOfFile (hFile=0x184) returned 1
	[0103.336] CloseHandle (hObject=0x184) returned 1
	[0103.336] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.336] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.337] CloseHandle (hObject=0x1d8) returned 1
	[0103.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 1
	[0103.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0103.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0103.338] lstrlenW (lpString=".doc") returned 4
	[0103.338] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.338] lstrlenW (lpString=".docx") returned 5
	[0103.338] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.338] lstrlenW (lpString=".pdf") returned 4
	[0103.338] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.338] lstrlenW (lpString=".xls") returned 4
	[0103.338] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.338] lstrlenW (lpString=".xlsx") returned 5
	[0103.338] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.338] lstrlenW (lpString=".ppt") returned 4
	[0103.338] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0103.338] lstrlenW (lpString=".zip") returned 4
	[0103.338] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.338] lstrlenW (lpString=".rar") returned 4
	[0103.338] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.338] lstrlenW (lpString=".bz2") returned 4
	[0103.338] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.338] lstrlenW (lpString=".7z") returned 3
	[0103.338] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0103.338] lstrlenW (lpString=".dbf") returned 4
	[0103.339] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0103.339] lstrlenW (lpString=".1cd") returned 4
	[0103.339] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0103.339] lstrlenW (lpString=".jpg") returned 4
	[0103.339] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0103.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0103.339] lstrlenW (lpString=".doc") returned 4
	[0103.339] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.339] lstrlenW (lpString=".docx") returned 5
	[0103.339] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.339] lstrlenW (lpString=".pdf") returned 4
	[0103.339] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.339] lstrlenW (lpString=".xls") returned 4
	[0103.339] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.339] lstrlenW (lpString=".xlsx") returned 5
	[0103.339] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.339] lstrlenW (lpString=".ppt") returned 4
	[0103.339] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0103.339] lstrlenW (lpString=".zip") returned 4
	[0103.340] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.340] lstrlenW (lpString=".rar") returned 4
	[0103.340] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.340] lstrlenW (lpString=".bz2") returned 4
	[0103.340] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.340] lstrlenW (lpString=".7z") returned 3
	[0103.340] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0103.340] lstrlenW (lpString=".dbf") returned 4
	[0103.340] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0103.340] lstrlenW (lpString=".1cd") returned 4
	[0103.340] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0103.340] lstrlenW (lpString=".jpg") returned 4
	[0103.340] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.340] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.340] lstrlenW (lpString="Essential.eftx") returned 14
	[0103.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.356] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=16350) returned 1
	[0103.356] CloseHandle (hObject=0x1e4) returned 1
	[0103.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 0x20
	[0103.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.356] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.356] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.357] GetLastError () returned 0x0
	[0103.357] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x3fde, lpOverlapped=0x0) returned 1
	[0103.370] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x3fe0, lpOverlapped=0x0) returned 1
	[0103.371] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.371] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0103.372] SetEndOfFile (hFile=0x1e8) returned 1
	[0103.372] CloseHandle (hObject=0x1e8) returned 1
	[0103.372] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.372] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.373] CloseHandle (hObject=0x1e4) returned 1
	[0103.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 1
	[0103.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0103.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0103.374] lstrlenW (lpString=".doc") returned 4
	[0103.374] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.374] lstrlenW (lpString=".docx") returned 5
	[0103.374] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.374] lstrlenW (lpString=".pdf") returned 4
	[0103.374] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.374] lstrlenW (lpString=".xls") returned 4
	[0103.374] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.374] lstrlenW (lpString=".xlsx") returned 5
	[0103.374] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.374] lstrlenW (lpString=".ppt") returned 4
	[0103.374] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0103.374] lstrlenW (lpString=".zip") returned 4
	[0103.374] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.374] lstrlenW (lpString=".rar") returned 4
	[0103.374] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.374] lstrlenW (lpString=".bz2") returned 4
	[0103.374] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.374] lstrlenW (lpString=".7z") returned 3
	[0103.374] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0103.374] lstrlenW (lpString=".dbf") returned 4
	[0103.374] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0103.374] lstrlenW (lpString=".1cd") returned 4
	[0103.375] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0103.375] lstrlenW (lpString=".jpg") returned 4
	[0103.375] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0103.375] lstrlenW (lpString=".doc") returned 4
	[0103.375] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.375] lstrlenW (lpString=".docx") returned 5
	[0103.375] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.375] lstrlenW (lpString=".pdf") returned 4
	[0103.375] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.375] lstrlenW (lpString=".xls") returned 4
	[0103.375] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.375] lstrlenW (lpString=".xlsx") returned 5
	[0103.375] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.375] lstrlenW (lpString=".ppt") returned 4
	[0103.375] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0103.375] lstrlenW (lpString=".zip") returned 4
	[0103.375] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.375] lstrlenW (lpString=".rar") returned 4
	[0103.375] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.375] lstrlenW (lpString=".bz2") returned 4
	[0103.375] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.376] lstrlenW (lpString=".7z") returned 3
	[0103.376] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0103.376] lstrlenW (lpString=".dbf") returned 4
	[0103.376] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0103.376] lstrlenW (lpString=".1cd") returned 4
	[0103.376] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0103.376] lstrlenW (lpString=".jpg") returned 4
	[0103.376] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.376] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.376] lstrlenW (lpString="Executive.eftx") returned 14
	[0103.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.420] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=21156) returned 1
	[0103.420] CloseHandle (hObject=0x1e4) returned 1
	[0103.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 0x20
	[0103.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.421] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.421] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.421] GetLastError () returned 0x0
	[0103.421] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x52a4, lpOverlapped=0x0) returned 1
	[0103.444] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x52b0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x52b0, lpOverlapped=0x0) returned 1
	[0103.448] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.448] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0103.448] SetEndOfFile (hFile=0x1e8) returned 1
	[0103.448] CloseHandle (hObject=0x1e8) returned 1
	[0103.448] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.448] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.449] CloseHandle (hObject=0x1e4) returned 1
	[0103.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 1
	[0103.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0103.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0103.451] lstrlenW (lpString=".doc") returned 4
	[0103.451] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.451] lstrlenW (lpString=".docx") returned 5
	[0103.451] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.451] lstrlenW (lpString=".pdf") returned 4
	[0103.451] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.451] lstrlenW (lpString=".xls") returned 4
	[0103.451] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.451] lstrlenW (lpString=".xlsx") returned 5
	[0103.451] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.451] lstrlenW (lpString=".ppt") returned 4
	[0103.451] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0103.452] lstrlenW (lpString=".zip") returned 4
	[0103.452] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.452] lstrlenW (lpString=".rar") returned 4
	[0103.452] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.452] lstrlenW (lpString=".bz2") returned 4
	[0103.452] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.452] lstrlenW (lpString=".7z") returned 3
	[0103.452] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0103.452] lstrlenW (lpString=".dbf") returned 4
	[0103.452] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0103.452] lstrlenW (lpString=".1cd") returned 4
	[0103.452] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0103.452] lstrlenW (lpString=".jpg") returned 4
	[0103.452] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0103.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0103.452] lstrlenW (lpString=".doc") returned 4
	[0103.452] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.452] lstrlenW (lpString=".docx") returned 5
	[0103.452] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.452] lstrlenW (lpString=".pdf") returned 4
	[0103.452] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.452] lstrlenW (lpString=".xls") returned 4
	[0103.452] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.453] lstrlenW (lpString=".xlsx") returned 5
	[0103.453] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.453] lstrlenW (lpString=".ppt") returned 4
	[0103.453] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0103.453] lstrlenW (lpString=".zip") returned 4
	[0103.453] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.453] lstrlenW (lpString=".rar") returned 4
	[0103.453] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.453] lstrlenW (lpString=".bz2") returned 4
	[0103.453] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.453] lstrlenW (lpString=".7z") returned 3
	[0103.453] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0103.453] lstrlenW (lpString=".dbf") returned 4
	[0103.453] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0103.453] lstrlenW (lpString=".1cd") returned 4
	[0103.453] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0103.453] lstrlenW (lpString=".jpg") returned 4
	[0103.453] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.453] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.454] lstrlenW (lpString="Foundry.eftx") returned 12
	[0103.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.459] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=18226) returned 1
	[0103.459] CloseHandle (hObject=0x1e4) returned 1
	[0103.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 0x20
	[0103.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.466] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.466] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.498] GetLastError () returned 0x0
	[0103.498] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x4732, lpOverlapped=0x0) returned 1
	[0103.506] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x4740, lpOverlapped=0x0) returned 1
	[0103.508] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.508] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.508] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.508] CloseHandle (hObject=0x1e4) returned 1
	[0103.508] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.508] SetEndOfFile (hFile=0x1e8) returned 1
	[0103.509] CloseHandle (hObject=0x1e8) returned 1
	[0103.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 1
	[0103.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0103.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0103.510] lstrlenW (lpString=".doc") returned 4
	[0103.510] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.510] lstrlenW (lpString=".docx") returned 5
	[0103.510] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.510] lstrlenW (lpString=".pdf") returned 4
	[0103.510] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.510] lstrlenW (lpString=".xls") returned 4
	[0103.510] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.510] lstrlenW (lpString=".xlsx") returned 5
	[0103.510] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.510] lstrlenW (lpString=".ppt") returned 4
	[0103.510] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0103.510] lstrlenW (lpString=".zip") returned 4
	[0103.510] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.510] lstrlenW (lpString=".rar") returned 4
	[0103.510] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.510] lstrlenW (lpString=".bz2") returned 4
	[0103.510] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.510] lstrlenW (lpString=".7z") returned 3
	[0103.510] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0103.511] lstrlenW (lpString=".dbf") returned 4
	[0103.511] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0103.511] lstrlenW (lpString=".1cd") returned 4
	[0103.511] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0103.511] lstrlenW (lpString=".jpg") returned 4
	[0103.511] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0103.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0103.511] lstrlenW (lpString=".doc") returned 4
	[0103.511] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.511] lstrlenW (lpString=".docx") returned 5
	[0103.511] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.511] lstrlenW (lpString=".pdf") returned 4
	[0103.511] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.511] lstrlenW (lpString=".xls") returned 4
	[0103.511] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.511] lstrlenW (lpString=".xlsx") returned 5
	[0103.511] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.511] lstrlenW (lpString=".ppt") returned 4
	[0103.511] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0103.511] lstrlenW (lpString=".zip") returned 4
	[0103.511] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.512] lstrlenW (lpString=".rar") returned 4
	[0103.512] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.512] lstrlenW (lpString=".bz2") returned 4
	[0103.512] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.512] lstrlenW (lpString=".7z") returned 3
	[0103.512] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0103.512] lstrlenW (lpString=".dbf") returned 4
	[0103.512] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0103.512] lstrlenW (lpString=".1cd") returned 4
	[0103.512] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0103.512] lstrlenW (lpString=".jpg") returned 4
	[0103.512] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.512] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.512] lstrlenW (lpString="Grid.eftx") returned 9
	[0103.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.527] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=18639) returned 1
	[0103.527] CloseHandle (hObject=0x1a8) returned 1
	[0103.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 0x20
	[0103.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.533] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.533] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.564] GetLastError () returned 0x0
	[0103.564] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x48cf, lpOverlapped=0x0) returned 1
	[0103.575] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x48d0, lpOverlapped=0x0) returned 1
	[0103.576] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.577] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0103.577] SetEndOfFile (hFile=0x184) returned 1
	[0103.577] CloseHandle (hObject=0x184) returned 1
	[0103.577] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.577] SetEndOfFile (hFile=0x1e8) returned 1
	[0103.578] CloseHandle (hObject=0x1e8) returned 1
	[0103.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 1
	[0103.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0103.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0103.580] lstrlenW (lpString=".doc") returned 4
	[0103.580] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.580] lstrlenW (lpString=".docx") returned 5
	[0103.580] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.580] lstrlenW (lpString=".pdf") returned 4
	[0103.580] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.580] lstrlenW (lpString=".xls") returned 4
	[0103.580] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.580] lstrlenW (lpString=".xlsx") returned 5
	[0103.580] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.580] lstrlenW (lpString=".ppt") returned 4
	[0103.580] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0103.580] lstrlenW (lpString=".zip") returned 4
	[0103.580] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.580] lstrlenW (lpString=".rar") returned 4
	[0103.580] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.580] lstrlenW (lpString=".bz2") returned 4
	[0103.580] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.580] lstrlenW (lpString=".7z") returned 3
	[0103.580] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0103.580] lstrlenW (lpString=".dbf") returned 4
	[0103.580] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0103.581] lstrlenW (lpString=".1cd") returned 4
	[0103.581] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0103.581] lstrlenW (lpString=".jpg") returned 4
	[0103.581] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0103.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0103.581] lstrlenW (lpString=".doc") returned 4
	[0103.581] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.581] lstrlenW (lpString=".docx") returned 5
	[0103.581] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.581] lstrlenW (lpString=".pdf") returned 4
	[0103.581] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.581] lstrlenW (lpString=".xls") returned 4
	[0103.581] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.581] lstrlenW (lpString=".xlsx") returned 5
	[0103.581] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.581] lstrlenW (lpString=".ppt") returned 4
	[0103.581] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0103.581] lstrlenW (lpString=".zip") returned 4
	[0103.581] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.581] lstrlenW (lpString=".rar") returned 4
	[0103.581] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.581] lstrlenW (lpString=".bz2") returned 4
	[0103.581] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.581] lstrlenW (lpString=".7z") returned 3
	[0103.582] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0103.582] lstrlenW (lpString=".dbf") returned 4
	[0103.582] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0103.582] lstrlenW (lpString=".1cd") returned 4
	[0103.582] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0103.582] lstrlenW (lpString=".jpg") returned 4
	[0103.582] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.582] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.582] lstrlenW (lpString="Median.eftx") returned 11
	[0103.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.609] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=39546) returned 1
	[0103.609] CloseHandle (hObject=0x1a8) returned 1
	[0103.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 0x20
	[0103.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.614] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.614] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.617] GetLastError () returned 0x0
	[0103.617] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x9a7a, lpOverlapped=0x0) returned 1
	[0103.624] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x9a80, lpOverlapped=0x0) returned 1
	[0103.625] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.625] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0103.625] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.626] CloseHandle (hObject=0x1d8) returned 1
	[0103.626] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.626] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.627] CloseHandle (hObject=0x1a8) returned 1
	[0103.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 1
	[0103.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0103.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0103.627] lstrlenW (lpString=".doc") returned 4
	[0103.627] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.627] lstrlenW (lpString=".docx") returned 5
	[0103.628] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.628] lstrlenW (lpString=".pdf") returned 4
	[0103.628] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.628] lstrlenW (lpString=".xls") returned 4
	[0103.628] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.628] lstrlenW (lpString=".xlsx") returned 5
	[0103.628] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.628] lstrlenW (lpString=".ppt") returned 4
	[0103.628] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0103.628] lstrlenW (lpString=".zip") returned 4
	[0103.628] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.628] lstrlenW (lpString=".rar") returned 4
	[0103.628] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.628] lstrlenW (lpString=".bz2") returned 4
	[0103.628] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.628] lstrlenW (lpString=".7z") returned 3
	[0103.628] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0103.628] lstrlenW (lpString=".dbf") returned 4
	[0103.628] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0103.628] lstrlenW (lpString=".1cd") returned 4
	[0103.628] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0103.628] lstrlenW (lpString=".jpg") returned 4
	[0103.629] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0103.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0103.629] lstrlenW (lpString=".doc") returned 4
	[0103.629] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.629] lstrlenW (lpString=".docx") returned 5
	[0103.629] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.629] lstrlenW (lpString=".pdf") returned 4
	[0103.629] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.629] lstrlenW (lpString=".xls") returned 4
	[0103.629] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.629] lstrlenW (lpString=".xlsx") returned 5
	[0103.629] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.629] lstrlenW (lpString=".ppt") returned 4
	[0103.629] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0103.629] lstrlenW (lpString=".zip") returned 4
	[0103.629] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.629] lstrlenW (lpString=".rar") returned 4
	[0103.629] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.629] lstrlenW (lpString=".bz2") returned 4
	[0103.629] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.629] lstrlenW (lpString=".7z") returned 3
	[0103.630] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0103.630] lstrlenW (lpString=".dbf") returned 4
	[0103.630] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0103.630] lstrlenW (lpString=".1cd") returned 4
	[0103.630] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0103.630] lstrlenW (lpString=".jpg") returned 4
	[0103.630] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.630] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.630] lstrlenW (lpString="Metro.eftx") returned 10
	[0103.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0103.694] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=24117) returned 1
	[0103.694] CloseHandle (hObject=0x1e8) returned 1
	[0103.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 0x20
	[0103.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.706] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.706] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.712] GetLastError () returned 0x0
	[0103.712] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x5e35, lpOverlapped=0x0) returned 1
	[0103.725] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x5e40, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x5e40, lpOverlapped=0x0) returned 1
	[0103.727] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.727] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0103.727] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.727] CloseHandle (hObject=0x1d8) returned 1
	[0103.728] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.728] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.729] CloseHandle (hObject=0x1a8) returned 1
	[0103.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 1
	[0103.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0103.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0103.731] lstrlenW (lpString=".doc") returned 4
	[0103.731] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.731] lstrlenW (lpString=".docx") returned 5
	[0103.731] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.731] lstrlenW (lpString=".pdf") returned 4
	[0103.731] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.731] lstrlenW (lpString=".xls") returned 4
	[0103.731] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.731] lstrlenW (lpString=".xlsx") returned 5
	[0103.731] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.731] lstrlenW (lpString=".ppt") returned 4
	[0103.731] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0103.731] lstrlenW (lpString=".zip") returned 4
	[0103.731] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.731] lstrlenW (lpString=".rar") returned 4
	[0103.732] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.732] lstrlenW (lpString=".bz2") returned 4
	[0103.732] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.732] lstrlenW (lpString=".7z") returned 3
	[0103.732] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0103.732] lstrlenW (lpString=".dbf") returned 4
	[0103.732] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0103.732] lstrlenW (lpString=".1cd") returned 4
	[0103.732] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0103.732] lstrlenW (lpString=".jpg") returned 4
	[0103.732] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0103.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0103.732] lstrlenW (lpString=".doc") returned 4
	[0103.732] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.732] lstrlenW (lpString=".docx") returned 5
	[0103.732] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.733] lstrlenW (lpString=".pdf") returned 4
	[0103.733] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.733] lstrlenW (lpString=".xls") returned 4
	[0103.733] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.733] lstrlenW (lpString=".xlsx") returned 5
	[0103.733] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.733] lstrlenW (lpString=".ppt") returned 4
	[0103.733] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0103.733] lstrlenW (lpString=".zip") returned 4
	[0103.733] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.733] lstrlenW (lpString=".rar") returned 4
	[0103.733] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.733] lstrlenW (lpString=".bz2") returned 4
	[0103.733] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.733] lstrlenW (lpString=".7z") returned 3
	[0103.733] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0103.733] lstrlenW (lpString=".dbf") returned 4
	[0103.733] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0103.733] lstrlenW (lpString=".1cd") returned 4
	[0103.733] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0103.734] lstrlenW (lpString=".jpg") returned 4
	[0103.734] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.734] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.734] lstrlenW (lpString="Opulent.eftx") returned 12
	[0103.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.795] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=32857) returned 1
	[0103.795] CloseHandle (hObject=0x1e4) returned 1
	[0103.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 0x20
	[0103.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.801] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.802] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0103.805] GetLastError () returned 0x0
	[0103.805] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x8059, lpOverlapped=0x0) returned 1
	[0103.812] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x8060, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x8060, lpOverlapped=0x0) returned 1
	[0103.813] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.813] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.814] SetEndOfFile (hFile=0x1a8) returned 1
	[0103.814] CloseHandle (hObject=0x1a8) returned 1
	[0103.814] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.814] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.817] CloseHandle (hObject=0x1e4) returned 1
	[0103.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 1
	[0103.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0103.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0103.818] lstrlenW (lpString=".doc") returned 4
	[0103.818] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.818] lstrlenW (lpString=".docx") returned 5
	[0103.818] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.818] lstrlenW (lpString=".pdf") returned 4
	[0103.818] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.818] lstrlenW (lpString=".xls") returned 4
	[0103.818] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.818] lstrlenW (lpString=".xlsx") returned 5
	[0103.818] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.818] lstrlenW (lpString=".ppt") returned 4
	[0103.818] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0103.818] lstrlenW (lpString=".zip") returned 4
	[0103.818] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.818] lstrlenW (lpString=".rar") returned 4
	[0103.818] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.819] lstrlenW (lpString=".bz2") returned 4
	[0103.819] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.819] lstrlenW (lpString=".7z") returned 3
	[0103.819] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0103.819] lstrlenW (lpString=".dbf") returned 4
	[0103.819] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0103.819] lstrlenW (lpString=".1cd") returned 4
	[0103.819] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0103.819] lstrlenW (lpString=".jpg") returned 4
	[0103.819] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0103.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0103.819] lstrlenW (lpString=".doc") returned 4
	[0103.819] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.819] lstrlenW (lpString=".docx") returned 5
	[0103.819] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.819] lstrlenW (lpString=".pdf") returned 4
	[0103.819] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.819] lstrlenW (lpString=".xls") returned 4
	[0103.819] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.819] lstrlenW (lpString=".xlsx") returned 5
	[0103.819] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.819] lstrlenW (lpString=".ppt") returned 4
	[0103.820] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0103.820] lstrlenW (lpString=".zip") returned 4
	[0103.820] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.820] lstrlenW (lpString=".rar") returned 4
	[0103.820] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.820] lstrlenW (lpString=".bz2") returned 4
	[0103.820] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.820] lstrlenW (lpString=".7z") returned 3
	[0103.820] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0103.820] lstrlenW (lpString=".dbf") returned 4
	[0103.820] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0103.820] lstrlenW (lpString=".1cd") returned 4
	[0103.820] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0103.820] lstrlenW (lpString=".jpg") returned 4
	[0103.820] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.821] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.821] lstrlenW (lpString="Oriel.eftx") returned 10
	[0103.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.862] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=43193) returned 1
	[0103.862] CloseHandle (hObject=0x184) returned 1
	[0103.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 0x20
	[0103.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.863] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.864] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.865] GetLastError () returned 0x0
	[0103.865] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xa8b9, lpOverlapped=0x0) returned 1
	[0103.877] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xa8c0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xa8c0, lpOverlapped=0x0) returned 1
	[0103.879] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.879] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0103.880] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.880] CloseHandle (hObject=0x1e4) returned 1
	[0103.880] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.880] SetEndOfFile (hFile=0x184) returned 1
	[0103.882] CloseHandle (hObject=0x184) returned 1
	[0103.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 1
	[0103.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0103.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0103.883] lstrlenW (lpString=".doc") returned 4
	[0103.883] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.883] lstrlenW (lpString=".docx") returned 5
	[0103.883] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.883] lstrlenW (lpString=".pdf") returned 4
	[0103.883] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.883] lstrlenW (lpString=".xls") returned 4
	[0103.883] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.883] lstrlenW (lpString=".xlsx") returned 5
	[0103.883] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.884] lstrlenW (lpString=".ppt") returned 4
	[0103.884] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0103.884] lstrlenW (lpString=".zip") returned 4
	[0103.884] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.884] lstrlenW (lpString=".rar") returned 4
	[0103.884] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.884] lstrlenW (lpString=".bz2") returned 4
	[0103.884] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.884] lstrlenW (lpString=".7z") returned 3
	[0103.884] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0103.884] lstrlenW (lpString=".dbf") returned 4
	[0103.884] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0103.884] lstrlenW (lpString=".1cd") returned 4
	[0103.884] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0103.884] lstrlenW (lpString=".jpg") returned 4
	[0103.884] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0103.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0103.884] lstrlenW (lpString=".doc") returned 4
	[0103.884] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.885] lstrlenW (lpString=".docx") returned 5
	[0103.885] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.885] lstrlenW (lpString=".pdf") returned 4
	[0103.885] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.885] lstrlenW (lpString=".xls") returned 4
	[0103.885] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.885] lstrlenW (lpString=".xlsx") returned 5
	[0103.885] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.885] lstrlenW (lpString=".ppt") returned 4
	[0103.885] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0103.885] lstrlenW (lpString=".zip") returned 4
	[0103.885] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.885] lstrlenW (lpString=".rar") returned 4
	[0103.885] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.885] lstrlenW (lpString=".bz2") returned 4
	[0103.885] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.885] lstrlenW (lpString=".7z") returned 3
	[0103.885] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0103.885] lstrlenW (lpString=".dbf") returned 4
	[0103.885] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0103.885] lstrlenW (lpString=".1cd") returned 4
	[0103.886] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0103.886] lstrlenW (lpString=".jpg") returned 4
	[0103.886] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.886] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0103.886] lstrlenW (lpString="Paper.eftx") returned 10
	[0103.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.958] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=228746) returned 1
	[0103.958] CloseHandle (hObject=0x184) returned 1
	[0103.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 0x20
	[0103.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0103.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0103.969] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.970] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.976] GetLastError () returned 0x0
	[0103.976] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x37d8a, lpOverlapped=0x0) returned 1
	[0103.987] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x37d90, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x37d90, lpOverlapped=0x0) returned 1
	[0103.993] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.993] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0103.993] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.994] CloseHandle (hObject=0x1e4) returned 1
	[0103.994] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.994] SetEndOfFile (hFile=0x184) returned 1
	[0103.996] CloseHandle (hObject=0x184) returned 1
	[0103.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0103.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 1
	[0103.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0103.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0103.997] lstrlenW (lpString=".doc") returned 4
	[0103.997] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.997] lstrlenW (lpString=".docx") returned 5
	[0103.997] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.997] lstrlenW (lpString=".pdf") returned 4
	[0103.997] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.997] lstrlenW (lpString=".xls") returned 4
	[0103.997] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.997] lstrlenW (lpString=".xlsx") returned 5
	[0103.998] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.998] lstrlenW (lpString=".ppt") returned 4
	[0103.998] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0103.998] lstrlenW (lpString=".zip") returned 4
	[0103.998] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.998] lstrlenW (lpString=".rar") returned 4
	[0103.998] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.998] lstrlenW (lpString=".bz2") returned 4
	[0103.998] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.998] lstrlenW (lpString=".7z") returned 3
	[0103.998] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0103.998] lstrlenW (lpString=".dbf") returned 4
	[0103.998] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0103.998] lstrlenW (lpString=".1cd") returned 4
	[0103.998] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0103.998] lstrlenW (lpString=".jpg") returned 4
	[0103.998] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0103.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0103.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0103.998] lstrlenW (lpString=".doc") returned 4
	[0103.998] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0103.999] lstrlenW (lpString=".docx") returned 5
	[0103.999] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0103.999] lstrlenW (lpString=".pdf") returned 4
	[0103.999] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0103.999] lstrlenW (lpString=".xls") returned 4
	[0103.999] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0103.999] lstrlenW (lpString=".xlsx") returned 5
	[0103.999] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0103.999] lstrlenW (lpString=".ppt") returned 4
	[0103.999] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0103.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0103.999] lstrlenW (lpString=".zip") returned 4
	[0103.999] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0103.999] lstrlenW (lpString=".rar") returned 4
	[0103.999] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0103.999] lstrlenW (lpString=".bz2") returned 4
	[0103.999] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0103.999] lstrlenW (lpString=".7z") returned 3
	[0103.999] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0103.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0103.999] lstrlenW (lpString=".dbf") returned 4
	[0103.999] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0103.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0103.999] lstrlenW (lpString=".1cd") returned 4
	[0103.999] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0103.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0104.000] lstrlenW (lpString=".jpg") returned 4
	[0104.000] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.000] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0104.000] lstrlenW (lpString="Perspective.eftx") returned 16
	[0104.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.101] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=21423) returned 1
	[0104.101] CloseHandle (hObject=0x1d8) returned 1
	[0104.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 0x20
	[0104.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.133] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.133] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0104.180] GetLastError () returned 0x0
	[0104.181] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x53af, lpOverlapped=0x0) returned 1
	[0104.194] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x53b0, lpOverlapped=0x0) returned 1
	[0104.195] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.195] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0104.195] SetEndOfFile (hFile=0x1e4) returned 1
	[0104.196] CloseHandle (hObject=0x1e4) returned 1
	[0104.196] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.196] SetEndOfFile (hFile=0x1a8) returned 1
	[0104.197] CloseHandle (hObject=0x1a8) returned 1
	[0104.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.197] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 1
	[0104.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0104.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0104.199] lstrlenW (lpString=".doc") returned 4
	[0104.199] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.199] lstrlenW (lpString=".docx") returned 5
	[0104.199] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.199] lstrlenW (lpString=".pdf") returned 4
	[0104.199] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.199] lstrlenW (lpString=".xls") returned 4
	[0104.199] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.199] lstrlenW (lpString=".xlsx") returned 5
	[0104.199] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.199] lstrlenW (lpString=".ppt") returned 4
	[0104.199] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0104.199] lstrlenW (lpString=".zip") returned 4
	[0104.199] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.199] lstrlenW (lpString=".rar") returned 4
	[0104.199] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.199] lstrlenW (lpString=".bz2") returned 4
	[0104.199] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.199] lstrlenW (lpString=".7z") returned 3
	[0104.199] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0104.199] lstrlenW (lpString=".dbf") returned 4
	[0104.199] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0104.199] lstrlenW (lpString=".1cd") returned 4
	[0104.199] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0104.200] lstrlenW (lpString=".jpg") returned 4
	[0104.200] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0104.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0104.200] lstrlenW (lpString=".doc") returned 4
	[0104.200] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.200] lstrlenW (lpString=".docx") returned 5
	[0104.200] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.200] lstrlenW (lpString=".pdf") returned 4
	[0104.200] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.200] lstrlenW (lpString=".xls") returned 4
	[0104.200] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.200] lstrlenW (lpString=".xlsx") returned 5
	[0104.200] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.200] lstrlenW (lpString=".ppt") returned 4
	[0104.200] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0104.200] lstrlenW (lpString=".zip") returned 4
	[0104.200] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.200] lstrlenW (lpString=".rar") returned 4
	[0104.200] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.200] lstrlenW (lpString=".bz2") returned 4
	[0104.200] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.200] lstrlenW (lpString=".7z") returned 3
	[0104.200] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0104.200] lstrlenW (lpString=".dbf") returned 4
	[0104.200] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0104.200] lstrlenW (lpString=".1cd") returned 4
	[0104.200] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0104.200] lstrlenW (lpString=".jpg") returned 4
	[0104.200] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.201] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0104.201] lstrlenW (lpString="Solstice.eftx") returned 13
	[0104.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.267] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=27781) returned 1
	[0104.267] CloseHandle (hObject=0x1a8) returned 1
	[0104.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 0x20
	[0104.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.277] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.278] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0104.287] GetLastError () returned 0x0
	[0104.287] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x6c85, lpOverlapped=0x0) returned 1
	[0104.292] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x6c90, lpOverlapped=0x0) returned 1
	[0104.294] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.294] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xee, lpOverlapped=0x0) returned 1
	[0104.294] SetEndOfFile (hFile=0x184) returned 1
	[0104.294] CloseHandle (hObject=0x184) returned 1
	[0104.294] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.294] SetEndOfFile (hFile=0x1a8) returned 1
	[0104.296] CloseHandle (hObject=0x1a8) returned 1
	[0104.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 1
	[0104.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0104.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0104.297] lstrlenW (lpString=".doc") returned 4
	[0104.297] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.297] lstrlenW (lpString=".docx") returned 5
	[0104.297] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.297] lstrlenW (lpString=".pdf") returned 4
	[0104.297] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.297] lstrlenW (lpString=".xls") returned 4
	[0104.297] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.297] lstrlenW (lpString=".xlsx") returned 5
	[0104.297] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.297] lstrlenW (lpString=".ppt") returned 4
	[0104.297] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0104.297] lstrlenW (lpString=".zip") returned 4
	[0104.297] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.297] lstrlenW (lpString=".rar") returned 4
	[0104.297] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.297] lstrlenW (lpString=".bz2") returned 4
	[0104.297] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.297] lstrlenW (lpString=".7z") returned 3
	[0104.297] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0104.297] lstrlenW (lpString=".dbf") returned 4
	[0104.297] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0104.298] lstrlenW (lpString=".1cd") returned 4
	[0104.298] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0104.298] lstrlenW (lpString=".jpg") returned 4
	[0104.298] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0104.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0104.298] lstrlenW (lpString=".doc") returned 4
	[0104.298] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.298] lstrlenW (lpString=".docx") returned 5
	[0104.298] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.298] lstrlenW (lpString=".pdf") returned 4
	[0104.298] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.298] lstrlenW (lpString=".xls") returned 4
	[0104.298] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.298] lstrlenW (lpString=".xlsx") returned 5
	[0104.298] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.298] lstrlenW (lpString=".ppt") returned 4
	[0104.298] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0104.298] lstrlenW (lpString=".zip") returned 4
	[0104.298] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.298] lstrlenW (lpString=".rar") returned 4
	[0104.298] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.298] lstrlenW (lpString=".bz2") returned 4
	[0104.298] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.298] lstrlenW (lpString=".7z") returned 3
	[0104.298] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0104.298] lstrlenW (lpString=".dbf") returned 4
	[0104.298] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0104.299] lstrlenW (lpString=".1cd") returned 4
	[0104.299] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0104.299] lstrlenW (lpString=".jpg") returned 4
	[0104.299] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.299] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0104.299] lstrlenW (lpString="Technic.eftx") returned 12
	[0104.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0104.313] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=23692) returned 1
	[0104.313] CloseHandle (hObject=0x1e4) returned 1
	[0104.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 0x20
	[0104.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0104.353] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.353] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0104.366] GetLastError () returned 0x0
	[0104.366] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x5c8c, lpOverlapped=0x0) returned 1
	[0104.377] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x5c90, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x5c90, lpOverlapped=0x0) returned 1
	[0104.379] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.379] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.379] SetEndOfFile (hFile=0x1bc) returned 1
	[0104.379] CloseHandle (hObject=0x1bc) returned 1
	[0104.379] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.379] SetEndOfFile (hFile=0x1a8) returned 1
	[0104.380] CloseHandle (hObject=0x1a8) returned 1
	[0104.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 1
	[0104.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0104.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0104.382] lstrlenW (lpString=".doc") returned 4
	[0104.382] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.382] lstrlenW (lpString=".docx") returned 5
	[0104.382] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.382] lstrlenW (lpString=".pdf") returned 4
	[0104.382] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.382] lstrlenW (lpString=".xls") returned 4
	[0104.382] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.382] lstrlenW (lpString=".xlsx") returned 5
	[0104.382] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.382] lstrlenW (lpString=".ppt") returned 4
	[0104.382] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0104.382] lstrlenW (lpString=".zip") returned 4
	[0104.382] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.382] lstrlenW (lpString=".rar") returned 4
	[0104.382] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.382] lstrlenW (lpString=".bz2") returned 4
	[0104.382] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.382] lstrlenW (lpString=".7z") returned 3
	[0104.382] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0104.382] lstrlenW (lpString=".dbf") returned 4
	[0104.382] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0104.383] lstrlenW (lpString=".1cd") returned 4
	[0104.383] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0104.383] lstrlenW (lpString=".jpg") returned 4
	[0104.383] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0104.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0104.383] lstrlenW (lpString=".doc") returned 4
	[0104.383] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.383] lstrlenW (lpString=".docx") returned 5
	[0104.383] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.383] lstrlenW (lpString=".pdf") returned 4
	[0104.383] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.383] lstrlenW (lpString=".xls") returned 4
	[0104.383] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.383] lstrlenW (lpString=".xlsx") returned 5
	[0104.383] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.383] lstrlenW (lpString=".ppt") returned 4
	[0104.383] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0104.383] lstrlenW (lpString=".zip") returned 4
	[0104.383] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.383] lstrlenW (lpString=".rar") returned 4
	[0104.383] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.383] lstrlenW (lpString=".bz2") returned 4
	[0104.383] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.383] lstrlenW (lpString=".7z") returned 3
	[0104.383] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0104.383] lstrlenW (lpString=".dbf") returned 4
	[0104.384] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0104.384] lstrlenW (lpString=".1cd") returned 4
	[0104.384] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0104.384] lstrlenW (lpString=".jpg") returned 4
	[0104.384] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.384] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0104.384] lstrlenW (lpString="Urban.eftx") returned 10
	[0104.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8
	[0104.396] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=19611) returned 1
	[0104.396] CloseHandle (hObject=0x1b8) returned 1
	[0104.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 0x20
	[0104.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0104.449] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.449] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.458] GetLastError () returned 0x0
	[0104.458] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x4c9b, lpOverlapped=0x0) returned 1
	[0104.463] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x4ca0, lpOverlapped=0x0) returned 1
	[0104.464] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.465] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0104.465] SetEndOfFile (hFile=0x1d8) returned 1
	[0104.465] CloseHandle (hObject=0x1d8) returned 1
	[0104.465] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.465] SetEndOfFile (hFile=0x1e0) returned 1
	[0104.466] CloseHandle (hObject=0x1e0) returned 1
	[0104.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 1
	[0104.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0104.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0104.467] lstrlenW (lpString=".doc") returned 4
	[0104.467] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.467] lstrlenW (lpString=".docx") returned 5
	[0104.467] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.467] lstrlenW (lpString=".pdf") returned 4
	[0104.467] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.467] lstrlenW (lpString=".xls") returned 4
	[0104.467] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.467] lstrlenW (lpString=".xlsx") returned 5
	[0104.468] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.468] lstrlenW (lpString=".ppt") returned 4
	[0104.468] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0104.468] lstrlenW (lpString=".zip") returned 4
	[0104.468] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.468] lstrlenW (lpString=".rar") returned 4
	[0104.468] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.468] lstrlenW (lpString=".bz2") returned 4
	[0104.468] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.468] lstrlenW (lpString=".7z") returned 3
	[0104.468] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0104.468] lstrlenW (lpString=".dbf") returned 4
	[0104.468] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0104.468] lstrlenW (lpString=".1cd") returned 4
	[0104.468] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0104.468] lstrlenW (lpString=".jpg") returned 4
	[0104.468] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0104.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0104.468] lstrlenW (lpString=".doc") returned 4
	[0104.468] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.468] lstrlenW (lpString=".docx") returned 5
	[0104.469] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.469] lstrlenW (lpString=".pdf") returned 4
	[0104.469] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.469] lstrlenW (lpString=".xls") returned 4
	[0104.469] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.469] lstrlenW (lpString=".xlsx") returned 5
	[0104.469] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.469] lstrlenW (lpString=".ppt") returned 4
	[0104.469] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0104.469] lstrlenW (lpString=".zip") returned 4
	[0104.469] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.469] lstrlenW (lpString=".rar") returned 4
	[0104.469] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.469] lstrlenW (lpString=".bz2") returned 4
	[0104.469] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.469] lstrlenW (lpString=".7z") returned 3
	[0104.469] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0104.469] lstrlenW (lpString=".dbf") returned 4
	[0104.469] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0104.469] lstrlenW (lpString=".1cd") returned 4
	[0104.469] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0104.469] lstrlenW (lpString=".jpg") returned 4
	[0104.469] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.470] lstrcmpiW (lpString1=".eftx", lpString2=".adobe") returned 1
	[0104.470] lstrlenW (lpString="Verve.eftx") returned 10
	[0104.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.488] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=31224) returned 1
	[0104.488] CloseHandle (hObject=0x1c4) returned 1
	[0104.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 0x20
	[0104.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.528] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.528] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0104.535] GetLastError () returned 0x0
	[0104.535] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x79f8, lpOverlapped=0x0) returned 1
	[0104.564] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x7a00, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x7a00, lpOverlapped=0x0) returned 1
	[0104.566] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.566] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0104.566] SetEndOfFile (hFile=0x1e0) returned 1
	[0104.567] CloseHandle (hObject=0x1e0) returned 1
	[0104.567] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.567] SetEndOfFile (hFile=0x1dc) returned 1
	[0104.568] CloseHandle (hObject=0x1dc) returned 1
	[0104.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 1
	[0104.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0104.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0104.569] lstrlenW (lpString=".doc") returned 4
	[0104.569] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.569] lstrlenW (lpString=".docx") returned 5
	[0104.569] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.569] lstrlenW (lpString=".pdf") returned 4
	[0104.569] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.569] lstrlenW (lpString=".xls") returned 4
	[0104.569] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.569] lstrlenW (lpString=".xlsx") returned 5
	[0104.569] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.569] lstrlenW (lpString=".ppt") returned 4
	[0104.569] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0104.569] lstrlenW (lpString=".zip") returned 4
	[0104.569] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.569] lstrlenW (lpString=".rar") returned 4
	[0104.569] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.569] lstrlenW (lpString=".bz2") returned 4
	[0104.569] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.570] lstrlenW (lpString=".7z") returned 3
	[0104.570] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0104.570] lstrlenW (lpString=".dbf") returned 4
	[0104.570] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0104.570] lstrlenW (lpString=".1cd") returned 4
	[0104.570] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0104.570] lstrlenW (lpString=".jpg") returned 4
	[0104.570] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0104.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0104.570] lstrlenW (lpString=".doc") returned 4
	[0104.570] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0104.570] lstrlenW (lpString=".docx") returned 5
	[0104.570] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0104.570] lstrlenW (lpString=".pdf") returned 4
	[0104.570] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0104.570] lstrlenW (lpString=".xls") returned 4
	[0104.570] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0104.570] lstrlenW (lpString=".xlsx") returned 5
	[0104.570] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0104.570] lstrlenW (lpString=".ppt") returned 4
	[0104.570] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0104.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0104.571] lstrlenW (lpString=".zip") returned 4
	[0104.571] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0104.571] lstrlenW (lpString=".rar") returned 4
	[0104.571] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0104.571] lstrlenW (lpString=".bz2") returned 4
	[0104.571] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0104.571] lstrlenW (lpString=".7z") returned 3
	[0104.571] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0104.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0104.571] lstrlenW (lpString=".dbf") returned 4
	[0104.571] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0104.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0104.571] lstrlenW (lpString=".1cd") returned 4
	[0104.571] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0104.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0104.571] lstrlenW (lpString=".jpg") returned 4
	[0104.571] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0104.571] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0104.571] lstrlenW (lpString="CAGCAT10.DLL") returned 12
	[0104.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.572] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=15776) returned 1
	[0104.572] CloseHandle (hObject=0x1dc) returned 1
	[0104.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll")) returned 0x20
	[0104.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.573] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.573] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0104.574] GetLastError () returned 0x0
	[0104.574] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x3da0, lpOverlapped=0x0) returned 1
	[0104.623] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x3db0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x3db0, lpOverlapped=0x0) returned 1
	[0104.625] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.625] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.625] SetEndOfFile (hFile=0x1e0) returned 1
	[0104.625] CloseHandle (hObject=0x1e0) returned 1
	[0104.625] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.626] SetEndOfFile (hFile=0x1dc) returned 1
	[0104.627] CloseHandle (hObject=0x1dc) returned 1
	[0104.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll")) returned 1
	[0104.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0104.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0104.628] lstrlenW (lpString=".doc") returned 4
	[0104.628] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0104.628] lstrlenW (lpString=".docx") returned 5
	[0104.628] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0104.628] lstrlenW (lpString=".pdf") returned 4
	[0104.628] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0104.628] lstrlenW (lpString=".xls") returned 4
	[0104.628] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0104.628] lstrlenW (lpString=".xlsx") returned 5
	[0104.628] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0104.628] lstrlenW (lpString=".ppt") returned 4
	[0104.628] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0104.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0104.628] lstrlenW (lpString=".zip") returned 4
	[0104.628] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0104.628] lstrlenW (lpString=".rar") returned 4
	[0104.628] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0104.628] lstrlenW (lpString=".bz2") returned 4
	[0104.628] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0104.628] lstrlenW (lpString=".7z") returned 3
	[0104.628] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0104.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0104.628] lstrlenW (lpString=".dbf") returned 4
	[0104.629] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0104.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0104.629] lstrlenW (lpString=".1cd") returned 4
	[0104.629] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0104.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0104.629] lstrlenW (lpString=".jpg") returned 4
	[0104.629] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0104.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0104.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0104.629] lstrlenW (lpString=".doc") returned 4
	[0104.629] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0104.629] lstrlenW (lpString=".docx") returned 5
	[0104.629] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0104.629] lstrlenW (lpString=".pdf") returned 4
	[0104.629] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0104.629] lstrlenW (lpString=".xls") returned 4
	[0104.629] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0104.629] lstrlenW (lpString=".xlsx") returned 5
	[0104.629] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0104.629] lstrlenW (lpString=".ppt") returned 4
	[0104.629] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0104.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0104.630] lstrlenW (lpString=".zip") returned 4
	[0104.630] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0104.630] lstrlenW (lpString=".rar") returned 4
	[0104.630] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0104.630] lstrlenW (lpString=".bz2") returned 4
	[0104.630] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0104.630] lstrlenW (lpString=".7z") returned 3
	[0104.630] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0104.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0104.630] lstrlenW (lpString=".dbf") returned 4
	[0104.630] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0104.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0104.630] lstrlenW (lpString=".1cd") returned 4
	[0104.630] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0104.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0104.630] lstrlenW (lpString=".jpg") returned 4
	[0104.630] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0104.630] lstrcmpiW (lpString1=".MML", lpString2=".adobe") returned 1
	[0104.630] lstrlenW (lpString="OFFICE10.MML") returned 12
	[0104.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.631] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=312376) returned 1
	[0104.632] CloseHandle (hObject=0x1dc) returned 1
	[0104.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 0x20
	[0104.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.632] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.632] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0104.637] GetLastError () returned 0x0
	[0104.637] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x4c438, lpOverlapped=0x0) returned 1
	[0104.669] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4c440, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x4c440, lpOverlapped=0x0) returned 1
	[0104.678] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.678] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.678] SetEndOfFile (hFile=0x1e0) returned 1
	[0104.678] CloseHandle (hObject=0x1e0) returned 1
	[0104.679] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.679] SetEndOfFile (hFile=0x1dc) returned 1
	[0104.683] CloseHandle (hObject=0x1dc) returned 1
	[0104.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 1
	[0104.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0104.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0104.683] lstrlenW (lpString=".doc") returned 4
	[0104.684] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1
	[0104.684] lstrlenW (lpString=".docx") returned 5
	[0104.684] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1
	[0104.684] lstrlenW (lpString=".pdf") returned 4
	[0104.684] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1
	[0104.684] lstrlenW (lpString=".xls") returned 4
	[0104.684] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1
	[0104.684] lstrlenW (lpString=".xlsx") returned 5
	[0104.684] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1
	[0104.684] lstrlenW (lpString=".ppt") returned 4
	[0104.684] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1
	[0104.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0104.684] lstrlenW (lpString=".zip") returned 4
	[0104.684] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1
	[0104.684] lstrlenW (lpString=".rar") returned 4
	[0104.684] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1
	[0104.684] lstrlenW (lpString=".bz2") returned 4
	[0104.684] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1
	[0104.684] lstrlenW (lpString=".7z") returned 3
	[0104.685] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1
	[0104.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0104.685] lstrlenW (lpString=".dbf") returned 4
	[0104.685] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1
	[0104.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0104.685] lstrlenW (lpString=".1cd") returned 4
	[0104.685] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1
	[0104.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0104.685] lstrlenW (lpString=".jpg") returned 4
	[0104.685] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1
	[0104.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0104.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0104.685] lstrlenW (lpString=".doc") returned 4
	[0104.685] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1
	[0104.686] lstrlenW (lpString=".docx") returned 5
	[0104.686] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1
	[0104.686] lstrlenW (lpString=".pdf") returned 4
	[0104.686] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1
	[0104.686] lstrlenW (lpString=".xls") returned 4
	[0104.686] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1
	[0104.686] lstrlenW (lpString=".xlsx") returned 5
	[0104.686] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1
	[0104.686] lstrlenW (lpString=".ppt") returned 4
	[0104.686] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1
	[0104.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0104.686] lstrlenW (lpString=".zip") returned 4
	[0104.686] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1
	[0104.686] lstrlenW (lpString=".rar") returned 4
	[0104.686] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1
	[0104.686] lstrlenW (lpString=".bz2") returned 4
	[0104.686] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1
	[0104.686] lstrlenW (lpString=".7z") returned 3
	[0104.686] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1
	[0104.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0104.687] lstrlenW (lpString=".dbf") returned 4
	[0104.687] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1
	[0104.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0104.687] lstrlenW (lpString=".1cd") returned 4
	[0104.687] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1
	[0104.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0104.687] lstrlenW (lpString=".jpg") returned 4
	[0104.687] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1
	[0104.687] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0104.687] lstrlenW (lpString="BULLETS.DLL") returned 11
	[0104.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.701] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=15264) returned 1
	[0104.701] CloseHandle (hObject=0x1e8) returned 1
	[0104.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll")) returned 0x20
	[0104.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.705] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.705] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0104.715] GetLastError () returned 0x0
	[0104.716] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x3ba0, lpOverlapped=0x0) returned 1
	[0104.732] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x3bb0, lpOverlapped=0x0) returned 1
	[0104.734] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.734] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0104.734] SetEndOfFile (hFile=0x1e0) returned 1
	[0104.734] CloseHandle (hObject=0x1e0) returned 1
	[0104.734] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.734] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.735] CloseHandle (hObject=0x1e8) returned 1
	[0104.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll")) returned 1
	[0104.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0104.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0104.736] lstrlenW (lpString=".doc") returned 4
	[0104.736] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0104.736] lstrlenW (lpString=".docx") returned 5
	[0104.736] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0104.736] lstrlenW (lpString=".pdf") returned 4
	[0104.737] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0104.737] lstrlenW (lpString=".xls") returned 4
	[0104.737] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0104.737] lstrlenW (lpString=".xlsx") returned 5
	[0104.737] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0104.737] lstrlenW (lpString=".ppt") returned 4
	[0104.737] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0104.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0104.737] lstrlenW (lpString=".zip") returned 4
	[0104.737] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0104.737] lstrlenW (lpString=".rar") returned 4
	[0104.737] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0104.737] lstrlenW (lpString=".bz2") returned 4
	[0104.737] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0104.737] lstrlenW (lpString=".7z") returned 3
	[0104.737] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0104.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0104.737] lstrlenW (lpString=".dbf") returned 4
	[0104.737] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0104.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0104.738] lstrlenW (lpString=".1cd") returned 4
	[0104.738] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0104.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0104.738] lstrlenW (lpString=".jpg") returned 4
	[0104.738] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0104.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0104.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0104.738] lstrlenW (lpString=".doc") returned 4
	[0104.738] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0104.738] lstrlenW (lpString=".docx") returned 5
	[0104.738] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0104.738] lstrlenW (lpString=".pdf") returned 4
	[0104.738] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0104.738] lstrlenW (lpString=".xls") returned 4
	[0104.738] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0104.738] lstrlenW (lpString=".xlsx") returned 5
	[0104.739] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0104.739] lstrlenW (lpString=".ppt") returned 4
	[0104.739] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0104.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0104.739] lstrlenW (lpString=".zip") returned 4
	[0104.739] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0104.739] lstrlenW (lpString=".rar") returned 4
	[0104.739] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0104.739] lstrlenW (lpString=".bz2") returned 4
	[0104.739] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0104.739] lstrlenW (lpString=".7z") returned 3
	[0104.739] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0104.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0104.739] lstrlenW (lpString=".dbf") returned 4
	[0104.739] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0104.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0104.739] lstrlenW (lpString=".1cd") returned 4
	[0104.739] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0104.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0104.740] lstrlenW (lpString=".jpg") returned 4
	[0104.740] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0104.740] lstrcmpiW (lpString1=".MMW", lpString2=".adobe") returned 1
	[0104.740] lstrlenW (lpString="OFFICE10.MMW") returned 12
	[0104.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.746] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=492624) returned 1
	[0104.746] CloseHandle (hObject=0x1d8) returned 1
	[0104.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 0x20
	[0104.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0104.747] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.747] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0104.748] GetLastError () returned 0x0
	[0104.748] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x78450, lpOverlapped=0x0) returned 1
	[0104.772] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x78460, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x78460, lpOverlapped=0x0) returned 1
	[0104.783] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.783] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.784] SetEndOfFile (hFile=0x1ec) returned 1
	[0104.784] CloseHandle (hObject=0x1ec) returned 1
	[0104.784] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.784] SetEndOfFile (hFile=0x1d8) returned 1
	[0104.790] CloseHandle (hObject=0x1d8) returned 1
	[0104.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 1
	[0104.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0104.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0104.843] lstrlenW (lpString=".doc") returned 4
	[0104.843] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1
	[0104.843] lstrlenW (lpString=".docx") returned 5
	[0104.843] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1
	[0104.843] lstrlenW (lpString=".pdf") returned 4
	[0104.843] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1
	[0104.843] lstrlenW (lpString=".xls") returned 4
	[0104.843] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1
	[0104.843] lstrlenW (lpString=".xlsx") returned 5
	[0104.843] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1
	[0104.843] lstrlenW (lpString=".ppt") returned 4
	[0104.843] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1
	[0104.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0104.843] lstrlenW (lpString=".zip") returned 4
	[0104.843] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1
	[0104.843] lstrlenW (lpString=".rar") returned 4
	[0104.843] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1
	[0104.843] lstrlenW (lpString=".bz2") returned 4
	[0104.843] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1
	[0104.843] lstrlenW (lpString=".7z") returned 3
	[0104.843] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1
	[0104.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0104.843] lstrlenW (lpString=".dbf") returned 4
	[0104.843] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1
	[0104.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0104.844] lstrlenW (lpString=".1cd") returned 4
	[0104.844] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1
	[0104.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0104.844] lstrlenW (lpString=".jpg") returned 4
	[0104.844] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1
	[0104.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0104.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0104.844] lstrlenW (lpString=".doc") returned 4
	[0104.844] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1
	[0104.844] lstrlenW (lpString=".docx") returned 5
	[0104.844] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1
	[0104.844] lstrlenW (lpString=".pdf") returned 4
	[0104.844] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1
	[0104.844] lstrlenW (lpString=".xls") returned 4
	[0104.844] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1
	[0104.844] lstrlenW (lpString=".xlsx") returned 5
	[0104.844] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1
	[0104.844] lstrlenW (lpString=".ppt") returned 4
	[0104.844] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1
	[0104.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0104.844] lstrlenW (lpString=".zip") returned 4
	[0104.844] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1
	[0104.844] lstrlenW (lpString=".rar") returned 4
	[0104.844] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1
	[0104.844] lstrlenW (lpString=".bz2") returned 4
	[0104.844] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1
	[0104.844] lstrlenW (lpString=".7z") returned 3
	[0104.844] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1
	[0104.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0104.844] lstrlenW (lpString=".dbf") returned 4
	[0104.844] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1
	[0104.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0104.845] lstrlenW (lpString=".1cd") returned 4
	[0104.845] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1
	[0104.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0104.845] lstrlenW (lpString=".jpg") returned 4
	[0104.845] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1
	[0104.845] lstrcmpiW (lpString1=".ACC", lpString2=".adobe") returned -1
	[0104.845] lstrlenW (lpString="ACCESS12.ACC") returned 12
	[0104.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0104.846] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=495616) returned 1
	[0104.846] CloseHandle (hObject=0x1ec) returned 1
	[0104.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 0x20
	[0104.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0104.847] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.847] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0104.848] GetLastError () returned 0x0
	[0104.848] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x79000, lpOverlapped=0x0) returned 1
	[0104.861] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x79010, lpOverlapped=0x0) returned 1
	[0104.875] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.875] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.875] SetEndOfFile (hFile=0x1f4) returned 1
	[0104.876] CloseHandle (hObject=0x1f4) returned 1
	[0104.876] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.876] SetEndOfFile (hFile=0x1ec) returned 1
	[0104.880] CloseHandle (hObject=0x1ec) returned 1
	[0104.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0104.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 1
	[0104.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0104.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0104.881] lstrlenW (lpString=".doc") returned 4
	[0104.881] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1
	[0104.881] lstrlenW (lpString=".docx") returned 5
	[0104.881] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1
	[0104.881] lstrlenW (lpString=".pdf") returned 4
	[0104.881] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1
	[0104.881] lstrlenW (lpString=".xls") returned 4
	[0104.881] lstrcmpiW (lpString1=".xls", lpString2=".ACC") returned 1
	[0104.881] lstrlenW (lpString=".xlsx") returned 5
	[0104.881] lstrcmpiW (lpString1=".xlsx", lpString2="2.ACC") returned -1
	[0104.881] lstrlenW (lpString=".ppt") returned 4
	[0104.881] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1
	[0104.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0104.882] lstrlenW (lpString=".zip") returned 4
	[0104.882] lstrcmpiW (lpString1=".zip", lpString2=".ACC") returned 1
	[0104.882] lstrlenW (lpString=".rar") returned 4
	[0104.882] lstrcmpiW (lpString1=".rar", lpString2=".ACC") returned 1
	[0104.882] lstrlenW (lpString=".bz2") returned 4
	[0104.882] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1
	[0104.882] lstrlenW (lpString=".7z") returned 3
	[0104.882] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1
	[0104.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0104.882] lstrlenW (lpString=".dbf") returned 4
	[0104.882] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1
	[0104.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0104.882] lstrlenW (lpString=".1cd") returned 4
	[0104.882] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1
	[0104.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0104.882] lstrlenW (lpString=".jpg") returned 4
	[0104.882] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1
	[0104.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0104.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0104.882] lstrlenW (lpString=".doc") returned 4
	[0104.882] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1
	[0104.882] lstrlenW (lpString=".docx") returned 5
	[0104.882] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1
	[0104.882] lstrlenW (lpString=".pdf") returned 4
	[0104.882] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1
	[0104.882] lstrlenW (lpString=".xls") returned 4
	[0104.882] lstrcmpiW (lpString1=".xls", lpString2=".ACC") returned 1
	[0104.883] lstrlenW (lpString=".xlsx") returned 5
	[0104.883] lstrcmpiW (lpString1=".xlsx", lpString2="2.ACC") returned -1
	[0104.883] lstrlenW (lpString=".ppt") returned 4
	[0104.883] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1
	[0104.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0104.883] lstrlenW (lpString=".zip") returned 4
	[0104.883] lstrcmpiW (lpString1=".zip", lpString2=".ACC") returned 1
	[0104.883] lstrlenW (lpString=".rar") returned 4
	[0104.883] lstrcmpiW (lpString1=".rar", lpString2=".ACC") returned 1
	[0104.883] lstrlenW (lpString=".bz2") returned 4
	[0104.883] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1
	[0104.883] lstrlenW (lpString=".7z") returned 3
	[0104.883] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1
	[0104.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0104.883] lstrlenW (lpString=".dbf") returned 4
	[0104.883] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1
	[0104.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0104.883] lstrlenW (lpString=".1cd") returned 4
	[0104.883] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1
	[0104.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0104.883] lstrlenW (lpString=".jpg") returned 4
	[0104.883] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1
	[0104.883] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0104.883] lstrlenW (lpString="ACCOLKI.DLL") returned 11
	[0104.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0104.928] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=13240) returned 1
	[0104.928] CloseHandle (hObject=0x1c4) returned 1
	[0104.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll")) returned 0x20
	[0104.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0104.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0104.940] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.940] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0104.944] GetLastError () returned 0x0
	[0104.944] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x33b8, lpOverlapped=0x0) returned 1
	[0105.007] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x33c0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x33c0, lpOverlapped=0x0) returned 1
	[0105.008] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.009] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.009] SetEndOfFile (hFile=0x1e0) returned 1
	[0105.010] CloseHandle (hObject=0x1e0) returned 1
	[0105.010] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.010] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.012] CloseHandle (hObject=0x1dc) returned 1
	[0105.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll")) returned 1
	[0105.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0105.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0105.012] lstrlenW (lpString=".doc") returned 4
	[0105.012] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0105.012] lstrlenW (lpString=".docx") returned 5
	[0105.012] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0105.013] lstrlenW (lpString=".pdf") returned 4
	[0105.013] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0105.013] lstrlenW (lpString=".xls") returned 4
	[0105.013] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0105.013] lstrlenW (lpString=".xlsx") returned 5
	[0105.013] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0105.013] lstrlenW (lpString=".ppt") returned 4
	[0105.013] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0105.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0105.013] lstrlenW (lpString=".zip") returned 4
	[0105.013] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0105.013] lstrlenW (lpString=".rar") returned 4
	[0105.013] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0105.013] lstrlenW (lpString=".bz2") returned 4
	[0105.013] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0105.013] lstrlenW (lpString=".7z") returned 3
	[0105.013] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0105.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0105.013] lstrlenW (lpString=".dbf") returned 4
	[0105.013] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0105.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0105.013] lstrlenW (lpString=".1cd") returned 4
	[0105.013] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0105.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0105.013] lstrlenW (lpString=".jpg") returned 4
	[0105.014] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0105.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0105.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0105.014] lstrlenW (lpString=".doc") returned 4
	[0105.014] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0105.014] lstrlenW (lpString=".docx") returned 5
	[0105.014] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0105.014] lstrlenW (lpString=".pdf") returned 4
	[0105.014] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0105.014] lstrlenW (lpString=".xls") returned 4
	[0105.014] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0105.014] lstrlenW (lpString=".xlsx") returned 5
	[0105.014] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0105.014] lstrlenW (lpString=".ppt") returned 4
	[0105.014] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0105.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0105.014] lstrlenW (lpString=".zip") returned 4
	[0105.014] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0105.014] lstrlenW (lpString=".rar") returned 4
	[0105.014] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0105.014] lstrlenW (lpString=".bz2") returned 4
	[0105.014] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0105.014] lstrlenW (lpString=".7z") returned 3
	[0105.015] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0105.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0105.015] lstrlenW (lpString=".dbf") returned 4
	[0105.015] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0105.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0105.015] lstrlenW (lpString=".1cd") returned 4
	[0105.015] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0105.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0105.015] lstrlenW (lpString=".jpg") returned 4
	[0105.015] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0105.015] lstrcmpiW (lpString1=".HLP", lpString2=".adobe") returned 1
	[0105.015] lstrlenW (lpString="ACTIP10.HLP") returned 11
	[0105.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.016] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=343520) returned 1
	[0105.016] CloseHandle (hObject=0x1dc) returned 1
	[0105.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp")) returned 0x20
	[0105.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.017] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.018] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0105.019] GetLastError () returned 0x0
	[0105.019] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x53de0, lpOverlapped=0x0) returned 1
	[0105.031] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x53df0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x53df0, lpOverlapped=0x0) returned 1
	[0105.039] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.039] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.039] SetEndOfFile (hFile=0x1e0) returned 1
	[0105.039] CloseHandle (hObject=0x1e0) returned 1
	[0105.039] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.040] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.046] CloseHandle (hObject=0x1dc) returned 1
	[0105.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp")) returned 1
	[0105.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0105.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0105.047] lstrlenW (lpString=".doc") returned 4
	[0105.047] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1
	[0105.047] lstrlenW (lpString=".docx") returned 5
	[0105.047] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1
	[0105.047] lstrlenW (lpString=".pdf") returned 4
	[0105.047] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1
	[0105.047] lstrlenW (lpString=".xls") returned 4
	[0105.047] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1
	[0105.047] lstrlenW (lpString=".xlsx") returned 5
	[0105.047] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1
	[0105.047] lstrlenW (lpString=".ppt") returned 4
	[0105.047] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1
	[0105.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0105.048] lstrlenW (lpString=".zip") returned 4
	[0105.048] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1
	[0105.048] lstrlenW (lpString=".rar") returned 4
	[0105.048] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1
	[0105.048] lstrlenW (lpString=".bz2") returned 4
	[0105.048] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1
	[0105.048] lstrlenW (lpString=".7z") returned 3
	[0105.048] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1
	[0105.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0105.048] lstrlenW (lpString=".dbf") returned 4
	[0105.048] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1
	[0105.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0105.048] lstrlenW (lpString=".1cd") returned 4
	[0105.048] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1
	[0105.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0105.048] lstrlenW (lpString=".jpg") returned 4
	[0105.048] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1
	[0105.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0105.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0105.048] lstrlenW (lpString=".doc") returned 4
	[0105.048] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1
	[0105.048] lstrlenW (lpString=".docx") returned 5
	[0105.048] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1
	[0105.048] lstrlenW (lpString=".pdf") returned 4
	[0105.049] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1
	[0105.049] lstrlenW (lpString=".xls") returned 4
	[0105.049] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1
	[0105.049] lstrlenW (lpString=".xlsx") returned 5
	[0105.049] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1
	[0105.049] lstrlenW (lpString=".ppt") returned 4
	[0105.049] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1
	[0105.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0105.049] lstrlenW (lpString=".zip") returned 4
	[0105.049] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1
	[0105.049] lstrlenW (lpString=".rar") returned 4
	[0105.049] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1
	[0105.049] lstrlenW (lpString=".bz2") returned 4
	[0105.049] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1
	[0105.049] lstrlenW (lpString=".7z") returned 3
	[0105.049] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1
	[0105.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0105.049] lstrlenW (lpString=".dbf") returned 4
	[0105.049] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1
	[0105.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0105.049] lstrlenW (lpString=".1cd") returned 4
	[0105.049] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1
	[0105.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0105.049] lstrlenW (lpString=".jpg") returned 4
	[0105.049] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1
	[0105.050] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0105.050] lstrlenW (lpString="ACWIZRC.DLL") returned 11
	[0105.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.051] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=275856) returned 1
	[0105.051] CloseHandle (hObject=0x1dc) returned 1
	[0105.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll")) returned 0x20
	[0105.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.052] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.052] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0105.053] GetLastError () returned 0x0
	[0105.053] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x43590, lpOverlapped=0x0) returned 1
	[0105.138] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x435a0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x435a0, lpOverlapped=0x0) returned 1
	[0105.147] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.147] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.147] SetEndOfFile (hFile=0x1e0) returned 1
	[0105.147] CloseHandle (hObject=0x1e0) returned 1
	[0105.147] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.147] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.151] CloseHandle (hObject=0x1dc) returned 1
	[0105.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll")) returned 1
	[0105.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0105.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0105.153] lstrlenW (lpString=".doc") returned 4
	[0105.153] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0105.153] lstrlenW (lpString=".docx") returned 5
	[0105.153] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1
	[0105.153] lstrlenW (lpString=".pdf") returned 4
	[0105.153] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0105.153] lstrlenW (lpString=".xls") returned 4
	[0105.153] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0105.153] lstrlenW (lpString=".xlsx") returned 5
	[0105.153] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1
	[0105.153] lstrlenW (lpString=".ppt") returned 4
	[0105.153] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0105.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0105.154] lstrlenW (lpString=".zip") returned 4
	[0105.154] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0105.154] lstrlenW (lpString=".rar") returned 4
	[0105.154] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0105.154] lstrlenW (lpString=".bz2") returned 4
	[0105.154] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0105.154] lstrlenW (lpString=".7z") returned 3
	[0105.154] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0105.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0105.154] lstrlenW (lpString=".dbf") returned 4
	[0105.154] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0105.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0105.154] lstrlenW (lpString=".1cd") returned 4
	[0105.154] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0105.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0105.154] lstrlenW (lpString=".jpg") returned 4
	[0105.154] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0105.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0105.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0105.154] lstrlenW (lpString=".doc") returned 4
	[0105.154] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0105.154] lstrlenW (lpString=".docx") returned 5
	[0105.154] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1
	[0105.154] lstrlenW (lpString=".pdf") returned 4
	[0105.154] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0105.154] lstrlenW (lpString=".xls") returned 4
	[0105.154] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0105.154] lstrlenW (lpString=".xlsx") returned 5
	[0105.154] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1
	[0105.155] lstrlenW (lpString=".ppt") returned 4
	[0105.155] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0105.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0105.155] lstrlenW (lpString=".zip") returned 4
	[0105.155] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0105.155] lstrlenW (lpString=".rar") returned 4
	[0105.155] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0105.155] lstrlenW (lpString=".bz2") returned 4
	[0105.155] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0105.155] lstrlenW (lpString=".7z") returned 3
	[0105.155] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0105.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0105.155] lstrlenW (lpString=".dbf") returned 4
	[0105.155] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0105.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0105.155] lstrlenW (lpString=".1cd") returned 4
	[0105.155] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0105.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0105.155] lstrlenW (lpString=".jpg") returned 4
	[0105.155] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0105.155] lstrcmpiW (lpString1=".VRD", lpString2=".adobe") returned 1
	[0105.155] lstrlenW (lpString="ASSET.VRD") returned 9
	[0105.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.161] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1694) returned 1
	[0105.161] CloseHandle (hObject=0x1dc) returned 1
	[0105.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 0x20
	[0105.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0105.179] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.179] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0105.219] GetLastError () returned 0x0
	[0105.219] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x69e, lpOverlapped=0x0) returned 1
	[0105.272] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x6a0, lpOverlapped=0x0) returned 1
	[0105.273] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.273] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0105.273] SetEndOfFile (hFile=0x1f0) returned 1
	[0105.273] CloseHandle (hObject=0x1f0) returned 1
	[0105.273] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.273] SetEndOfFile (hFile=0x1ec) returned 1
	[0105.275] CloseHandle (hObject=0x1ec) returned 1
	[0105.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 1
	[0105.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0105.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0105.275] lstrlenW (lpString=".doc") returned 4
	[0105.275] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0105.275] lstrlenW (lpString=".docx") returned 5
	[0105.275] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1
	[0105.275] lstrlenW (lpString=".pdf") returned 4
	[0105.275] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0105.275] lstrlenW (lpString=".xls") returned 4
	[0105.276] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0105.276] lstrlenW (lpString=".xlsx") returned 5
	[0105.276] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1
	[0105.276] lstrlenW (lpString=".ppt") returned 4
	[0105.276] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0105.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0105.276] lstrlenW (lpString=".zip") returned 4
	[0105.276] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0105.276] lstrlenW (lpString=".rar") returned 4
	[0105.276] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0105.276] lstrlenW (lpString=".bz2") returned 4
	[0105.276] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0105.276] lstrlenW (lpString=".7z") returned 3
	[0105.276] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0105.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0105.276] lstrlenW (lpString=".dbf") returned 4
	[0105.276] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0105.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0105.276] lstrlenW (lpString=".1cd") returned 4
	[0105.276] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0105.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0105.276] lstrlenW (lpString=".jpg") returned 4
	[0105.276] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0105.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0105.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0105.277] lstrlenW (lpString=".doc") returned 4
	[0105.277] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0105.277] lstrlenW (lpString=".docx") returned 5
	[0105.277] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1
	[0105.277] lstrlenW (lpString=".pdf") returned 4
	[0105.277] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0105.277] lstrlenW (lpString=".xls") returned 4
	[0105.277] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0105.277] lstrlenW (lpString=".xlsx") returned 5
	[0105.277] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1
	[0105.277] lstrlenW (lpString=".ppt") returned 4
	[0105.277] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0105.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0105.277] lstrlenW (lpString=".zip") returned 4
	[0105.277] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0105.277] lstrlenW (lpString=".rar") returned 4
	[0105.277] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0105.277] lstrlenW (lpString=".bz2") returned 4
	[0105.277] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0105.277] lstrlenW (lpString=".7z") returned 3
	[0105.277] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0105.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0105.277] lstrlenW (lpString=".dbf") returned 4
	[0105.277] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0105.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0105.277] lstrlenW (lpString=".1cd") returned 4
	[0105.277] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0105.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0105.278] lstrlenW (lpString=".jpg") returned 4
	[0105.278] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0105.278] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0105.278] lstrlenW (lpString="BHOINTL.DLL") returned 11
	[0105.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0105.279] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=10104) returned 1
	[0105.279] CloseHandle (hObject=0x1ec) returned 1
	[0105.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll")) returned 0x20
	[0105.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0105.280] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.280] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0105.281] GetLastError () returned 0x0
	[0105.281] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x2778, lpOverlapped=0x0) returned 1
	[0105.317] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2780, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2780, lpOverlapped=0x0) returned 1
	[0105.318] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.318] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.318] SetEndOfFile (hFile=0x1f0) returned 1
	[0105.318] CloseHandle (hObject=0x1f0) returned 1
	[0105.319] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.319] SetEndOfFile (hFile=0x1ec) returned 1
	[0105.320] CloseHandle (hObject=0x1ec) returned 1
	[0105.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll")) returned 1
	[0105.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0105.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0105.320] lstrlenW (lpString=".doc") returned 4
	[0105.320] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0105.320] lstrlenW (lpString=".docx") returned 5
	[0105.320] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0105.320] lstrlenW (lpString=".pdf") returned 4
	[0105.320] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0105.320] lstrlenW (lpString=".xls") returned 4
	[0105.320] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0105.320] lstrlenW (lpString=".xlsx") returned 5
	[0105.320] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0105.321] lstrlenW (lpString=".ppt") returned 4
	[0105.321] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0105.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0105.321] lstrlenW (lpString=".zip") returned 4
	[0105.321] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0105.321] lstrlenW (lpString=".rar") returned 4
	[0105.321] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0105.321] lstrlenW (lpString=".bz2") returned 4
	[0105.321] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0105.321] lstrlenW (lpString=".7z") returned 3
	[0105.321] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0105.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0105.321] lstrlenW (lpString=".dbf") returned 4
	[0105.321] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0105.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0105.321] lstrlenW (lpString=".1cd") returned 4
	[0105.321] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0105.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0105.321] lstrlenW (lpString=".jpg") returned 4
	[0105.321] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0105.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0105.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0105.321] lstrlenW (lpString=".doc") returned 4
	[0105.321] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0105.321] lstrlenW (lpString=".docx") returned 5
	[0105.321] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0105.322] lstrlenW (lpString=".pdf") returned 4
	[0105.322] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0105.322] lstrlenW (lpString=".xls") returned 4
	[0105.322] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0105.322] lstrlenW (lpString=".xlsx") returned 5
	[0105.322] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0105.322] lstrlenW (lpString=".ppt") returned 4
	[0105.322] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0105.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0105.322] lstrlenW (lpString=".zip") returned 4
	[0105.322] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0105.322] lstrlenW (lpString=".rar") returned 4
	[0105.322] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0105.322] lstrlenW (lpString=".bz2") returned 4
	[0105.322] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0105.322] lstrlenW (lpString=".7z") returned 3
	[0105.322] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0105.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0105.322] lstrlenW (lpString=".dbf") returned 4
	[0105.322] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0105.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0105.322] lstrlenW (lpString=".1cd") returned 4
	[0105.322] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0105.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0105.322] lstrlenW (lpString=".jpg") returned 4
	[0105.322] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0105.323] lstrcmpiW (lpString1=".VRD", lpString2=".adobe") returned 1
	[0105.323] lstrlenW (lpString="CALEVENT.VRD") returned 12
	[0105.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.358] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2144) returned 1
	[0105.359] CloseHandle (hObject=0x1dc) returned 1
	[0105.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 0x20
	[0105.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.367] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.367] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.371] GetLastError () returned 0x0
	[0105.371] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x860, lpOverlapped=0x0) returned 1
	[0105.377] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x870, lpOverlapped=0x0) returned 1
	[0105.378] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.378] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.379] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.379] CloseHandle (hObject=0x1d8) returned 1
	[0105.379] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.379] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.380] CloseHandle (hObject=0x1dc) returned 1
	[0105.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 1
	[0105.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0105.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0105.380] lstrlenW (lpString=".doc") returned 4
	[0105.381] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0105.381] lstrlenW (lpString=".docx") returned 5
	[0105.381] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1
	[0105.381] lstrlenW (lpString=".pdf") returned 4
	[0105.381] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0105.381] lstrlenW (lpString=".xls") returned 4
	[0105.381] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0105.381] lstrlenW (lpString=".xlsx") returned 5
	[0105.381] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1
	[0105.381] lstrlenW (lpString=".ppt") returned 4
	[0105.381] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0105.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0105.381] lstrlenW (lpString=".zip") returned 4
	[0105.381] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0105.381] lstrlenW (lpString=".rar") returned 4
	[0105.381] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0105.381] lstrlenW (lpString=".bz2") returned 4
	[0105.381] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0105.381] lstrlenW (lpString=".7z") returned 3
	[0105.381] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0105.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0105.381] lstrlenW (lpString=".dbf") returned 4
	[0105.381] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0105.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0105.381] lstrlenW (lpString=".1cd") returned 4
	[0105.381] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0105.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0105.381] lstrlenW (lpString=".jpg") returned 4
	[0105.382] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0105.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0105.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0105.382] lstrlenW (lpString=".doc") returned 4
	[0105.382] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0105.382] lstrlenW (lpString=".docx") returned 5
	[0105.382] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1
	[0105.382] lstrlenW (lpString=".pdf") returned 4
	[0105.382] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0105.382] lstrlenW (lpString=".xls") returned 4
	[0105.382] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0105.382] lstrlenW (lpString=".xlsx") returned 5
	[0105.382] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1
	[0105.382] lstrlenW (lpString=".ppt") returned 4
	[0105.382] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0105.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0105.382] lstrlenW (lpString=".zip") returned 4
	[0105.382] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0105.382] lstrlenW (lpString=".rar") returned 4
	[0105.382] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0105.382] lstrlenW (lpString=".bz2") returned 4
	[0105.382] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0105.382] lstrlenW (lpString=".7z") returned 3
	[0105.382] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0105.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0105.383] lstrlenW (lpString=".dbf") returned 4
	[0105.383] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0105.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0105.383] lstrlenW (lpString=".1cd") returned 4
	[0105.383] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0105.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0105.383] lstrlenW (lpString=".jpg") returned 4
	[0105.383] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0105.383] lstrcmpiW (lpString1=".DLL", lpString2=".adobe") returned 1
	[0105.383] lstrlenW (lpString="CLVWINTL.DLL") returned 12
	[0105.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.384] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=19880) returned 1
	[0105.384] CloseHandle (hObject=0x1dc) returned 1
	[0105.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll")) returned 0x20
	[0105.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.385] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.385] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.386] GetLastError () returned 0x0
	[0105.386] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x4da8, lpOverlapped=0x0) returned 1
	[0105.409] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4db0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x4db0, lpOverlapped=0x0) returned 1
	[0105.410] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.411] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.411] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.411] CloseHandle (hObject=0x1d8) returned 1
	[0105.414] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.414] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.415] CloseHandle (hObject=0x1dc) returned 1
	[0105.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll")) returned 1
	[0105.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0105.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0105.431] lstrlenW (lpString=".doc") returned 4
	[0105.432] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0105.432] lstrlenW (lpString=".docx") returned 5
	[0105.432] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0105.432] lstrlenW (lpString=".pdf") returned 4
	[0105.432] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0105.432] lstrlenW (lpString=".xls") returned 4
	[0105.432] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0105.432] lstrlenW (lpString=".xlsx") returned 5
	[0105.432] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0105.432] lstrlenW (lpString=".ppt") returned 4
	[0105.432] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0105.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0105.432] lstrlenW (lpString=".zip") returned 4
	[0105.432] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0105.432] lstrlenW (lpString=".rar") returned 4
	[0105.432] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0105.432] lstrlenW (lpString=".bz2") returned 4
	[0105.432] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0105.432] lstrlenW (lpString=".7z") returned 3
	[0105.432] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0105.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0105.432] lstrlenW (lpString=".dbf") returned 4
	[0105.432] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0105.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0105.432] lstrlenW (lpString=".1cd") returned 4
	[0105.432] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0105.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0105.432] lstrlenW (lpString=".jpg") returned 4
	[0105.433] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0105.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0105.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0105.433] lstrlenW (lpString=".doc") returned 4
	[0105.433] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0105.433] lstrlenW (lpString=".docx") returned 5
	[0105.433] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0105.433] lstrlenW (lpString=".pdf") returned 4
	[0105.433] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0105.433] lstrlenW (lpString=".xls") returned 4
	[0105.433] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0105.433] lstrlenW (lpString=".xlsx") returned 5
	[0105.433] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0105.433] lstrlenW (lpString=".ppt") returned 4
	[0105.433] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0105.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0105.433] lstrlenW (lpString=".zip") returned 4
	[0105.433] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0105.433] lstrlenW (lpString=".rar") returned 4
	[0105.433] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0105.433] lstrlenW (lpString=".bz2") returned 4
	[0105.433] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0105.433] lstrlenW (lpString=".7z") returned 3
	[0105.433] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0105.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0105.433] lstrlenW (lpString=".dbf") returned 4
	[0105.434] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0105.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0105.434] lstrlenW (lpString=".1cd") returned 4
	[0105.434] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0105.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0105.434] lstrlenW (lpString=".jpg") returned 4
	[0105.434] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0105.434] lstrcmpiW (lpString1=".dll", lpString2=".adobe") returned 1
	[0105.434] lstrlenW (lpString="ContactPickerIntl.dll") returned 21
	[0105.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.441] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=16256) returned 1
	[0105.441] CloseHandle (hObject=0x1f4) returned 1
	[0105.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll")) returned 0x20
	[0105.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.447] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.447] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0105.451] GetLastError () returned 0x0
	[0105.451] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x3f80, lpOverlapped=0x0) returned 1
	[0105.456] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x3f90, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x3f90, lpOverlapped=0x0) returned 1
	[0105.457] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.457] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xfe, lpOverlapped=0x0) returned 1
	[0105.458] SetEndOfFile (hFile=0x1f0) returned 1
	[0105.458] CloseHandle (hObject=0x1f0) returned 1
	[0105.458] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.458] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.459] CloseHandle (hObject=0x1f4) returned 1
	[0105.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll")) returned 1
	[0105.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0105.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0105.459] lstrlenW (lpString=".doc") returned 4
	[0105.459] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0105.459] lstrlenW (lpString=".docx") returned 5
	[0105.459] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1
	[0105.459] lstrlenW (lpString=".pdf") returned 4
	[0105.459] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0105.459] lstrlenW (lpString=".xls") returned 4
	[0105.459] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0105.459] lstrlenW (lpString=".xlsx") returned 5
	[0105.459] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1
	[0105.459] lstrlenW (lpString=".ppt") returned 4
	[0105.460] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0105.460] lstrlenW (lpString=".zip") returned 4
	[0105.460] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0105.460] lstrlenW (lpString=".rar") returned 4
	[0105.460] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0105.460] lstrlenW (lpString=".bz2") returned 4
	[0105.460] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0105.460] lstrlenW (lpString=".7z") returned 3
	[0105.460] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0105.460] lstrlenW (lpString=".dbf") returned 4
	[0105.460] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0105.460] lstrlenW (lpString=".1cd") returned 4
	[0105.460] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0105.460] lstrlenW (lpString=".jpg") returned 4
	[0105.460] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0105.460] lstrlenW (lpString=".doc") returned 4
	[0105.460] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0105.460] lstrlenW (lpString=".docx") returned 5
	[0105.460] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1
	[0105.460] lstrlenW (lpString=".pdf") returned 4
	[0105.460] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0105.460] lstrlenW (lpString=".xls") returned 4
	[0105.460] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0105.460] lstrlenW (lpString=".xlsx") returned 5
	[0105.460] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1
	[0105.460] lstrlenW (lpString=".ppt") returned 4
	[0105.460] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0105.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0105.461] lstrlenW (lpString=".zip") returned 4
	[0105.461] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0105.461] lstrlenW (lpString=".rar") returned 4
	[0105.461] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0105.461] lstrlenW (lpString=".bz2") returned 4
	[0105.461] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0105.461] lstrlenW (lpString=".7z") returned 3
	[0105.461] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0105.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0105.461] lstrlenW (lpString=".dbf") returned 4
	[0105.461] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0105.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0105.461] lstrlenW (lpString=".1cd") returned 4
	[0105.461] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0105.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0105.461] lstrlenW (lpString=".jpg") returned 4
	[0105.461] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0105.461] lstrcmpiW (lpString1=".ICO", lpString2=".adobe") returned 1
	[0105.461] lstrlenW (lpString="FOLDER.ICO") returned 10
	[0105.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.463] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=4710) returned 1
	[0105.463] CloseHandle (hObject=0x1f4) returned 1
	[0105.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 0x20
	[0105.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.466] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.466] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0105.467] GetLastError () returned 0x0
	[0105.467] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x1266, lpOverlapped=0x0) returned 1
	[0105.470] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1270, lpOverlapped=0x0) returned 1
	[0105.471] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.471] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0105.471] SetEndOfFile (hFile=0x1f0) returned 1
	[0105.472] CloseHandle (hObject=0x1f0) returned 1
	[0105.472] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.472] SetEndOfFile (hFile=0x1f4) returned 1
	[0105.473] CloseHandle (hObject=0x1f4) returned 1
	[0105.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 1
	[0105.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0105.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0105.473] lstrlenW (lpString=".doc") returned 4
	[0105.473] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0105.473] lstrlenW (lpString=".docx") returned 5
	[0105.473] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1
	[0105.473] lstrlenW (lpString=".pdf") returned 4
	[0105.473] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0105.473] lstrlenW (lpString=".xls") returned 4
	[0105.473] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0105.473] lstrlenW (lpString=".xlsx") returned 5
	[0105.473] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1
	[0105.473] lstrlenW (lpString=".ppt") returned 4
	[0105.473] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0105.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0105.474] lstrlenW (lpString=".zip") returned 4
	[0105.474] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0105.474] lstrlenW (lpString=".rar") returned 4
	[0105.474] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0105.474] lstrlenW (lpString=".bz2") returned 4
	[0105.474] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0105.474] lstrlenW (lpString=".7z") returned 3
	[0105.474] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0105.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0105.474] lstrlenW (lpString=".dbf") returned 4
	[0105.474] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0105.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0105.474] lstrlenW (lpString=".1cd") returned 4
	[0105.474] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0105.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0105.474] lstrlenW (lpString=".jpg") returned 4
	[0105.474] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0105.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0105.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0105.474] lstrlenW (lpString=".doc") returned 4
	[0105.474] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0105.474] lstrlenW (lpString=".docx") returned 5
	[0105.474] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1
	[0105.474] lstrlenW (lpString=".pdf") returned 4
	[0105.474] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0105.474] lstrlenW (lpString=".xls") returned 4
	[0105.474] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0105.474] lstrlenW (lpString=".xlsx") returned 5
	[0105.474] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1
	[0105.474] lstrlenW (lpString=".ppt") returned 4
	[0105.474] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0105.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0105.475] lstrlenW (lpString=".zip") returned 4
	[0105.475] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0105.475] lstrlenW (lpString=".rar") returned 4
	[0105.475] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0105.475] lstrlenW (lpString=".bz2") returned 4
	[0105.475] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0105.475] lstrlenW (lpString=".7z") returned 3
	[0105.475] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0105.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0105.475] lstrlenW (lpString=".dbf") returned 4
	[0105.475] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0105.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0105.475] lstrlenW (lpString=".1cd") returned 4
	[0105.475] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0105.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0105.475] lstrlenW (lpString=".jpg") returned 4
	[0105.475] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0105.475] lstrcmpiW (lpString1=".VSL", lpString2=".adobe") returned 1
	[0105.475] lstrlenW (lpString="DBENGR.VSL") returned 10
	[0105.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.522] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=53144) returned 1
	[0105.522] CloseHandle (hObject=0x1dc) returned 1
	[0105.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 0x20
	[0105.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0105.529] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.529] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0105.533] GetLastError () returned 0x0
	[0105.533] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xcf98, lpOverlapped=0x0) returned 1
	[0105.539] WriteFile (in: hFile=0x1c4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xcfa0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xcfa0, lpOverlapped=0x0) returned 1
	[0105.541] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.541] WriteFile (in: hFile=0x1c4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0105.541] SetEndOfFile (hFile=0x1c4) returned 1
	[0105.541] CloseHandle (hObject=0x1c4) returned 1
	[0105.542] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.542] SetEndOfFile (hFile=0x1dc) returned 1
	[0105.543] CloseHandle (hObject=0x1dc) returned 1
	[0105.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 1
	[0105.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0105.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0105.543] lstrlenW (lpString=".doc") returned 4
	[0105.543] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0105.543] lstrlenW (lpString=".docx") returned 5
	[0105.543] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1
	[0105.543] lstrlenW (lpString=".pdf") returned 4
	[0105.543] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0105.544] lstrlenW (lpString=".xls") returned 4
	[0105.544] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0105.544] lstrlenW (lpString=".xlsx") returned 5
	[0105.544] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1
	[0105.544] lstrlenW (lpString=".ppt") returned 4
	[0105.544] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0105.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0105.544] lstrlenW (lpString=".zip") returned 4
	[0105.544] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0105.544] lstrlenW (lpString=".rar") returned 4
	[0105.544] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0105.544] lstrlenW (lpString=".bz2") returned 4
	[0105.544] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0105.544] lstrlenW (lpString=".7z") returned 3
	[0105.544] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0105.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0105.544] lstrlenW (lpString=".dbf") returned 4
	[0105.544] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0105.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0105.544] lstrlenW (lpString=".1cd") returned 4
	[0105.544] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0105.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0105.544] lstrlenW (lpString=".jpg") returned 4
	[0105.544] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0105.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0105.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0105.544] lstrlenW (lpString=".doc") returned 4
	[0105.544] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0105.544] lstrlenW (lpString=".docx") returned 5
	[0105.544] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1
	[0105.544] lstrlenW (lpString=".pdf") returned 4
	[0105.545] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0105.545] lstrlenW (lpString=".xls") returned 4
	[0105.545] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0105.545] lstrlenW (lpString=".xlsx") returned 5
	[0105.545] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1
	[0105.545] lstrlenW (lpString=".ppt") returned 4
	[0105.545] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0105.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0105.545] lstrlenW (lpString=".zip") returned 4
	[0105.545] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0105.545] lstrlenW (lpString=".rar") returned 4
	[0105.545] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0105.545] lstrlenW (lpString=".bz2") returned 4
	[0105.545] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0105.545] lstrlenW (lpString=".7z") returned 3
	[0105.545] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0105.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0105.545] lstrlenW (lpString=".dbf") returned 4
	[0105.545] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0105.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0105.545] lstrlenW (lpString=".1cd") returned 4
	[0105.545] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0105.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0105.545] lstrlenW (lpString=".jpg") returned 4
	[0105.545] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0105.546] lstrcmpiW (lpString1=".gta", lpString2=".adobe") returned 1
	[0105.546] lstrlenW (lpString="Discussion.gta") returned 14
	[0105.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0105.610] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=104836) returned 1
	[0105.610] CloseHandle (hObject=0x1f4) returned 1
	[0105.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 0x20
	[0105.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[fire_show@tuta.io].adobe")) returned 0xffffffff
	[0105.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.619] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.619] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[fire_show@tuta.io].adobe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[fire_show@tuta.io].adobe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.625] GetLastError () returned 0x0
	[0105.625] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x19984, lpOverlapped=0x0) returned 1
	[0105.653] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x19990, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x19990, lpOverlapped=0x0) returned 1
	[0105.656] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.656] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0105.656] SetEndOfFile (hFile=0x1e8) returned 1
	[0105.656] CloseHandle (hObject=0x1e8) returned 1
	[0105.656] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.657] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.658] CloseHandle (hObject=0x1d8) returned 1
	[0105.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[fire_show@tuta.io].adobe", dwFileAttributes=0x20) returned 1
	[0105.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 1
	[0105.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0105.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0105.660] lstrlenW (lpString=".doc") returned 4
	[0105.660] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1
	[0105.660] lstrlenW (lpString=".docx") returned 5
	[0105.660] lstrcmpiW (lpString1=".docx", lpString2="n.gta") returned -1
	[0105.660] lstrlenW (lpString=".pdf") returned 4
	[0105.660] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1
	[0105.660] lstrlenW (lpString=".xls") returned 4
	[0105.660] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1
	[0105.661] lstrlenW (lpString=".xlsx") returned 5
	[0105.661] lstrcmpiW (lpString1=".xlsx", lpString2="n.gta") returned -1
	[0105.661] lstrlenW (lpString=".ppt") returned 4
	[0105.661] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1
	[0105.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0105.661] lstrlenW (lpString=".zip") returned 4
	[0105.661] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1
	[0105.661] lstrlenW (lpString=".rar") returned 4
	[0105.661] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1
	[0105.661] lstrlenW (lpString=".bz2") returned 4
	[0105.661] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1
	[0105.661] lstrlenW (lpString=".7z") returned 3
	[0105.661] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1
	[0105.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0105.661] lstrlenW (lpString=".dbf") returned 4
	[0105.661] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1
	[0105.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0105.661] lstrlenW (lpString=".1cd") returned 4
	[0105.661] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1
	[0105.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0105.661] lstrlenW (lpString=".jpg") returned 4
	[0105.661] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1
	[0105.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0105.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0105.661] lstrlenW (lpString=".doc") returned 4
	[0105.661] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1
	[0105.662] lstrlenW (lpString=".docx") returned 5
	[0105.662] lstrcmpiW (lpString1=".docx", lpString2="n.gta") returned -1
	[0105.662] lstrlenW (lpString=".pdf") returned 4
	[0105.662] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1
	[0105.662] lstrlenW (lpString=".xls") returned 4
	[0105.662] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1
	[0105.662] lstrlenW (lpString=".xlsx") returned 5
	[0105.662] lstrcmpiW (lpString1=".xlsx", lpString2="n.gta") returned -1
	[0105.662] lstrlenW (lpString=".ppt") returned 4
	[0105.662] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1
	[0105.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0105.662] lstrlenW (lpString=".zip") returned 4
	[0105.662] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1
	[0105.662] lstrlenW (lpString=".rar") returned 4
	[0105.662] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1
	[0105.662] lstrlenW (lpString=".bz2") returned 4
	[0105.662] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1
	[0105.662] lstrlenW (lpString=".7z") returned 3
	[0105.662] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1
	[0105.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0105.662] lstrlenW (lpString=".dbf") returned 4
	[0105.662] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1
	[0105.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0105.662] lstrlenW (lpString=".1cd") returned 4
	[0105.662] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1
	[0105.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0105.662] lstrlenW (lpString=".jpg") returned 4
	[0105.662] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1
	[0105.663] lstrcmpiW (lpString1=".VRD", lpString2=".adobe") returned 1
	[0105.663] lstrlenW (lpString="DOORSCHD.VRD") returned 12
	[0105.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 62
	os_tid = 0xbb8

	[0074.092] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x37e06c0
	[0074.093] lstrlenW (lpString="C:") returned 2
	[0074.093] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x341fd00 | out: lpFindFileData=0x341fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x631698
	[0074.093] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0074.094] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1
	[0074.094] lstrlenW (lpString="$Recycle.Bin") returned 12
	[0074.094] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1
	[0074.094] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x37f06c8
	[0074.094] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0074.094] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1070
	[0074.095] FindNextFileW (in: hFindFile=0x6d1070, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.095] FindNextFileW (in: hFindFile=0x6d1070, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0074.095] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0074.095] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1
	[0074.095] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46
	[0074.095] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1
	[0074.095] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x38006d0
	[0074.096] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0074.096] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d20b8
	[0074.096] FindNextFileW (in: hFindFile=0x6d20b8, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.096] FindNextFileW (in: hFindFile=0x6d20b8, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0074.096] lstrlenW (lpString="desktop.ini") returned 11
	[0074.096] lstrlenW (lpString=".1cd") returned 4
	[0074.096] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0074.096] lstrlenW (lpString=".3ds") returned 4
	[0074.096] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0074.096] lstrlenW (lpString=".3fr") returned 4
	[0074.096] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0074.097] lstrlenW (lpString=".3g2") returned 4
	[0074.097] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0074.097] lstrlenW (lpString=".3gp") returned 4
	[0074.097] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0074.097] lstrlenW (lpString=".7z") returned 3
	[0074.097] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0074.097] lstrlenW (lpString=".accda") returned 6
	[0074.097] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1
	[0074.097] lstrlenW (lpString=".accdb") returned 6
	[0074.097] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1
	[0074.097] lstrlenW (lpString=".accdc") returned 6
	[0074.097] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1
	[0074.097] lstrlenW (lpString=".accde") returned 6
	[0074.097] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1
	[0074.097] lstrlenW (lpString=".accdt") returned 6
	[0074.097] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1
	[0074.097] lstrlenW (lpString=".accdw") returned 6
	[0074.097] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1
	[0074.097] lstrlenW (lpString=".adb") returned 4
	[0074.097] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0074.097] lstrlenW (lpString=".adp") returned 4
	[0074.097] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0074.097] lstrlenW (lpString=".ai") returned 3
	[0074.097] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0074.097] lstrlenW (lpString=".ai3") returned 4
	[0074.097] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0074.097] lstrlenW (lpString=".ai4") returned 4
	[0074.097] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0074.098] lstrlenW (lpString=".ai5") returned 4
	[0074.098] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0074.098] lstrlenW (lpString=".ai6") returned 4
	[0074.098] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0074.098] lstrlenW (lpString=".ai7") returned 4
	[0074.098] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0074.098] lstrlenW (lpString=".ai8") returned 4
	[0074.098] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0074.098] lstrlenW (lpString=".anim") returned 5
	[0074.098] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1
	[0074.098] lstrlenW (lpString=".arw") returned 4
	[0074.098] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0074.098] lstrlenW (lpString=".as") returned 3
	[0074.098] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0074.098] lstrlenW (lpString=".asa") returned 4
	[0074.098] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0074.098] lstrlenW (lpString=".asc") returned 4
	[0074.098] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0074.098] lstrlenW (lpString=".ascx") returned 5
	[0074.098] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1
	[0074.098] lstrlenW (lpString=".asm") returned 4
	[0074.098] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0074.098] lstrlenW (lpString=".asmx") returned 5
	[0074.098] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1
	[0074.098] lstrlenW (lpString=".asp") returned 4
	[0074.098] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0074.098] lstrlenW (lpString=".aspx") returned 5
	[0074.099] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1
	[0074.099] lstrlenW (lpString=".asr") returned 4
	[0074.099] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0074.099] lstrlenW (lpString=".asx") returned 4
	[0074.099] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0074.099] lstrlenW (lpString=".avi") returned 4
	[0074.099] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0074.099] lstrlenW (lpString=".avs") returned 4
	[0074.099] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0074.099] lstrlenW (lpString=".backup") returned 7
	[0074.099] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1
	[0074.099] lstrlenW (lpString=".bak") returned 4
	[0074.099] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0074.099] lstrlenW (lpString=".bay") returned 4
	[0074.099] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0074.099] lstrlenW (lpString=".bd") returned 3
	[0074.099] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0074.099] lstrlenW (lpString=".bin") returned 4
	[0074.099] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0074.099] lstrlenW (lpString=".bmp") returned 4
	[0074.099] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0074.099] lstrlenW (lpString=".bz2") returned 4
	[0074.099] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0074.099] lstrlenW (lpString=".c") returned 2
	[0074.099] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0074.099] lstrlenW (lpString=".cdr") returned 4
	[0074.099] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0074.099] lstrlenW (lpString=".cer") returned 4
	[0074.100] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0074.100] lstrlenW (lpString=".cf") returned 3
	[0074.100] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0074.100] lstrlenW (lpString=".cfc") returned 4
	[0074.100] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0074.100] lstrlenW (lpString=".cfm") returned 4
	[0074.100] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0074.100] lstrlenW (lpString=".cfml") returned 5
	[0074.100] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1
	[0074.100] lstrlenW (lpString=".cfu") returned 4
	[0074.100] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0074.100] lstrlenW (lpString=".chm") returned 4
	[0074.100] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0074.100] lstrlenW (lpString=".cin") returned 4
	[0074.100] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0074.100] lstrlenW (lpString=".class") returned 6
	[0074.100] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1
	[0074.100] lstrlenW (lpString=".clx") returned 4
	[0074.100] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0074.100] lstrlenW (lpString=".config") returned 7
	[0074.100] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1
	[0074.100] lstrlenW (lpString=".cpp") returned 4
	[0074.100] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0074.100] lstrlenW (lpString=".cr2") returned 4
	[0074.100] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0074.100] lstrlenW (lpString=".crt") returned 4
	[0074.100] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0074.100] lstrlenW (lpString=".crw") returned 4
	[0074.101] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0074.101] lstrlenW (lpString=".cs") returned 3
	[0074.101] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0074.101] lstrlenW (lpString=".css") returned 4
	[0074.101] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0074.101] lstrlenW (lpString=".csv") returned 4
	[0074.101] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0074.101] lstrlenW (lpString=".cub") returned 4
	[0074.101] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0074.101] lstrlenW (lpString=".dae") returned 4
	[0074.101] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0074.101] lstrlenW (lpString=".dat") returned 4
	[0074.101] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0074.101] lstrlenW (lpString=".db") returned 3
	[0074.101] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0074.101] lstrlenW (lpString=".dbf") returned 4
	[0074.101] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0074.101] lstrlenW (lpString=".dbx") returned 4
	[0074.101] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0074.101] lstrlenW (lpString=".dc3") returned 4
	[0074.101] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0074.101] lstrlenW (lpString=".dcm") returned 4
	[0074.101] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0074.101] lstrlenW (lpString=".dcr") returned 4
	[0074.101] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0074.101] lstrlenW (lpString=".der") returned 4
	[0074.101] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0074.101] lstrlenW (lpString=".dib") returned 4
	[0074.102] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0074.102] lstrlenW (lpString=".dic") returned 4
	[0074.102] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0074.102] lstrlenW (lpString=".dif") returned 4
	[0074.102] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0074.102] lstrlenW (lpString=".divx") returned 5
	[0074.102] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1
	[0074.102] lstrlenW (lpString=".djvu") returned 5
	[0074.102] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1
	[0074.102] lstrlenW (lpString=".dng") returned 4
	[0074.102] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0074.102] lstrlenW (lpString=".doc") returned 4
	[0074.102] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0074.102] lstrlenW (lpString=".docm") returned 5
	[0074.102] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1
	[0074.102] lstrlenW (lpString=".docx") returned 5
	[0074.102] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0074.102] lstrlenW (lpString=".dot") returned 4
	[0074.102] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0074.102] lstrlenW (lpString=".dotm") returned 5
	[0074.102] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1
	[0074.102] lstrlenW (lpString=".dotx") returned 5
	[0074.102] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1
	[0074.102] lstrlenW (lpString=".dpx") returned 4
	[0074.102] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0074.102] lstrlenW (lpString=".dqy") returned 4
	[0074.102] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0074.102] lstrlenW (lpString=".dsn") returned 4
	[0074.103] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0074.103] lstrlenW (lpString=".dt") returned 3
	[0074.103] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0074.103] lstrlenW (lpString=".dtd") returned 4
	[0074.103] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0074.103] lstrlenW (lpString=".dwg") returned 4
	[0074.103] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0074.103] lstrlenW (lpString=".dwt") returned 4
	[0074.103] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0074.103] lstrlenW (lpString=".dx") returned 3
	[0074.103] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0074.103] lstrlenW (lpString=".dxf") returned 4
	[0074.103] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0074.103] lstrlenW (lpString=".edml") returned 5
	[0074.103] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1
	[0074.103] lstrlenW (lpString=".efd") returned 4
	[0074.103] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0074.103] lstrlenW (lpString=".elf") returned 4
	[0074.103] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0074.103] lstrlenW (lpString=".emf") returned 4
	[0074.103] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0074.103] lstrlenW (lpString=".emz") returned 4
	[0074.103] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0074.103] lstrlenW (lpString=".epf") returned 4
	[0074.103] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0074.103] lstrlenW (lpString=".eps") returned 4
	[0074.103] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0074.103] lstrlenW (lpString=".epsf") returned 5
	[0074.103] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1
	[0074.104] lstrlenW (lpString=".epsp") returned 5
	[0074.104] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1
	[0074.104] lstrlenW (lpString=".erf") returned 4
	[0074.104] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0074.104] lstrlenW (lpString=".exr") returned 4
	[0074.104] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0074.104] lstrlenW (lpString=".f4v") returned 4
	[0074.104] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0074.104] lstrlenW (lpString=".fido") returned 5
	[0074.104] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1
	[0074.104] lstrlenW (lpString=".flm") returned 4
	[0074.104] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0074.104] lstrlenW (lpString=".flv") returned 4
	[0074.104] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0074.104] lstrlenW (lpString=".frm") returned 4
	[0074.104] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0074.104] lstrlenW (lpString=".fxg") returned 4
	[0074.104] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1
	[0074.104] lstrlenW (lpString=".geo") returned 4
	[0074.104] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1
	[0074.104] lstrlenW (lpString=".gif") returned 4
	[0074.104] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1
	[0074.104] lstrlenW (lpString=".grs") returned 4
	[0074.104] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1
	[0074.104] lstrlenW (lpString=".gz") returned 3
	[0074.104] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1
	[0074.104] lstrlenW (lpString=".h") returned 2
	[0074.104] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1
	[0074.104] lstrlenW (lpString=".hdr") returned 4
	[0074.105] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1
	[0074.105] lstrlenW (lpString=".hpp") returned 4
	[0074.105] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1
	[0074.105] lstrlenW (lpString=".hta") returned 4
	[0074.105] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1
	[0074.105] lstrlenW (lpString=".htc") returned 4
	[0074.105] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1
	[0074.105] lstrlenW (lpString=".htm") returned 4
	[0074.105] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1
	[0074.105] lstrlenW (lpString=".html") returned 5
	[0074.105] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1
	[0074.105] lstrlenW (lpString=".icb") returned 4
	[0074.105] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1
	[0074.105] lstrlenW (lpString=".ics") returned 4
	[0074.105] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1
	[0074.105] lstrlenW (lpString=".iff") returned 4
	[0074.106] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1
	[0074.106] lstrlenW (lpString=".inc") returned 4
	[0074.106] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1
	[0074.106] lstrlenW (lpString=".indd") returned 5
	[0074.106] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1
	[0074.106] lstrlenW (lpString=".ini") returned 4
	[0074.106] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0
	[0074.106] FindNextFileW (in: hFindFile=0x6d20b8, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0074.106] FindClose (in: hFindFile=0x6d20b8 | out: hFindFile=0x6d20b8) returned 1
	[0074.106] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x5e0000) returned 1
	[0074.106] FindNextFileW (in: hFindFile=0x6d1070, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0074.106] FindClose (in: hFindFile=0x6d1070 | out: hFindFile=0x6d1070) returned 1
	[0074.107] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x37f06c8 | out: hHeap=0x5e0000) returned 1
	[0074.107] FindNextFileW (in: hFindFile=0x631698, lpFindFileData=0x341fd00 | out: lpFindFileData=0x341fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0074.107] lstrlenW (lpString="C:\\Boot") returned 7
	[0074.107] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1
	[0074.107] lstrlenW (lpString="Boot") returned 4
	[0074.107] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1
	[0074.107] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x37f06c8
	[0074.107] lstrlenW (lpString="C:\\Boot") returned 7
	[0074.107] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d2078
	[0074.107] FindNextFileW (in: hFindFile=0x6d2078, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.107] FindNextFileW (in: hFindFile=0x6d2078, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0074.107] lstrlenW (lpString="BCD") returned 3
	[0074.107] lstrlenW (lpString=".1cd") returned 4
	[0074.108] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1
	[0074.108] lstrlenW (lpString=".3ds") returned 4
	[0074.108] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1
	[0074.108] lstrlenW (lpString=".3fr") returned 4
	[0074.108] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1
	[0074.108] lstrlenW (lpString=".3g2") returned 4
	[0074.108] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1
	[0074.108] lstrlenW (lpString=".3gp") returned 4
	[0074.108] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1
	[0074.108] lstrlenW (lpString=".7z") returned 3
	[0074.108] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0074.108] lstrlenW (lpString=".accda") returned 6
	[0074.108] lstrcmpiW (lpString1=".accda", lpString2="") returned 1
	[0074.108] lstrlenW (lpString=".accdb") returned 6
	[0074.108] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1
	[0074.108] lstrlenW (lpString=".accdc") returned 6
	[0074.108] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1
	[0074.108] lstrlenW (lpString=".accde") returned 6
	[0074.108] lstrcmpiW (lpString1=".accde", lpString2="") returned 1
	[0074.108] lstrlenW (lpString=".accdt") returned 6
	[0074.108] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1
	[0074.108] lstrlenW (lpString=".accdw") returned 6
	[0074.108] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1
	[0074.108] lstrlenW (lpString=".adb") returned 4
	[0074.108] lstrcmpiW (lpString1=".adb", lpString2="") returned 1
	[0074.108] lstrlenW (lpString=".adp") returned 4
	[0074.108] lstrcmpiW (lpString1=".adp", lpString2="") returned 1
	[0074.108] lstrlenW (lpString=".ai") returned 3
	[0074.108] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1
	[0074.109] lstrlenW (lpString=".ai3") returned 4
	[0074.109] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1
	[0074.109] lstrlenW (lpString=".ai4") returned 4
	[0074.109] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1
	[0074.109] lstrlenW (lpString=".ai5") returned 4
	[0074.109] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1
	[0074.109] lstrlenW (lpString=".ai6") returned 4
	[0074.109] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1
	[0074.109] lstrlenW (lpString=".ai7") returned 4
	[0074.109] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1
	[0074.109] lstrlenW (lpString=".ai8") returned 4
	[0074.109] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1
	[0074.109] lstrlenW (lpString=".anim") returned 5
	[0074.109] lstrcmpiW (lpString1=".anim", lpString2="") returned 1
	[0074.109] lstrlenW (lpString=".arw") returned 4
	[0074.109] lstrcmpiW (lpString1=".arw", lpString2="") returned 1
	[0074.109] lstrlenW (lpString=".as") returned 3
	[0074.109] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1
	[0074.109] lstrlenW (lpString=".asa") returned 4
	[0074.109] lstrcmpiW (lpString1=".asa", lpString2="") returned 1
	[0074.109] lstrlenW (lpString=".asc") returned 4
	[0074.109] lstrcmpiW (lpString1=".asc", lpString2="") returned 1
	[0074.109] lstrlenW (lpString=".ascx") returned 5
	[0074.109] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1
	[0074.109] lstrlenW (lpString=".asm") returned 4
	[0074.109] lstrcmpiW (lpString1=".asm", lpString2="") returned 1
	[0074.109] lstrlenW (lpString=".asmx") returned 5
	[0074.109] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1
	[0074.110] lstrlenW (lpString=".asp") returned 4
	[0074.110] lstrcmpiW (lpString1=".asp", lpString2="") returned 1
	[0074.110] lstrlenW (lpString=".aspx") returned 5
	[0074.110] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1
	[0074.110] lstrlenW (lpString=".asr") returned 4
	[0074.110] lstrcmpiW (lpString1=".asr", lpString2="") returned 1
	[0074.110] lstrlenW (lpString=".asx") returned 4
	[0074.110] lstrcmpiW (lpString1=".asx", lpString2="") returned 1
	[0074.110] lstrlenW (lpString=".avi") returned 4
	[0074.110] lstrcmpiW (lpString1=".avi", lpString2="") returned 1
	[0074.110] lstrlenW (lpString=".avs") returned 4
	[0074.110] lstrcmpiW (lpString1=".avs", lpString2="") returned 1
	[0074.110] lstrlenW (lpString=".backup") returned 7
	[0074.110] lstrcmpiW (lpString1=".backup", lpString2="") returned 1
	[0074.110] lstrlenW (lpString=".bak") returned 4
	[0074.110] lstrcmpiW (lpString1=".bak", lpString2="") returned 1
	[0074.110] lstrlenW (lpString=".bay") returned 4
	[0074.110] lstrcmpiW (lpString1=".bay", lpString2="") returned 1
	[0074.110] lstrlenW (lpString=".bd") returned 3
	[0074.110] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1
	[0074.110] lstrlenW (lpString=".bin") returned 4
	[0074.110] lstrcmpiW (lpString1=".bin", lpString2="") returned 1
	[0074.110] lstrlenW (lpString=".bmp") returned 4
	[0074.110] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1
	[0074.110] lstrlenW (lpString=".bz2") returned 4
	[0074.110] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1
	[0074.110] lstrlenW (lpString=".c") returned 2
	[0074.110] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1
	[0074.111] lstrlenW (lpString=".cdr") returned 4
	[0074.111] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1
	[0074.111] lstrlenW (lpString=".cer") returned 4
	[0074.111] lstrcmpiW (lpString1=".cer", lpString2="") returned 1
	[0074.111] lstrlenW (lpString=".cf") returned 3
	[0074.111] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1
	[0074.111] lstrlenW (lpString=".cfc") returned 4
	[0074.111] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1
	[0074.111] lstrlenW (lpString=".cfm") returned 4
	[0074.111] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1
	[0074.111] lstrlenW (lpString=".cfml") returned 5
	[0074.111] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1
	[0074.111] lstrlenW (lpString=".cfu") returned 4
	[0074.111] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1
	[0074.111] lstrlenW (lpString=".chm") returned 4
	[0074.111] lstrcmpiW (lpString1=".chm", lpString2="") returned 1
	[0074.111] lstrlenW (lpString=".cin") returned 4
	[0074.111] lstrcmpiW (lpString1=".cin", lpString2="") returned 1
	[0074.111] lstrlenW (lpString=".class") returned 6
	[0074.111] lstrcmpiW (lpString1=".class", lpString2="") returned 1
	[0074.111] lstrlenW (lpString=".clx") returned 4
	[0074.111] lstrcmpiW (lpString1=".clx", lpString2="") returned 1
	[0074.111] lstrlenW (lpString=".config") returned 7
	[0074.111] lstrcmpiW (lpString1=".config", lpString2="") returned 1
	[0074.111] lstrlenW (lpString=".cpp") returned 4
	[0074.111] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1
	[0074.111] lstrlenW (lpString=".cr2") returned 4
	[0074.111] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1
	[0074.111] lstrlenW (lpString=".crt") returned 4
	[0074.112] lstrcmpiW (lpString1=".crt", lpString2="") returned 1
	[0074.112] lstrlenW (lpString=".crw") returned 4
	[0074.112] lstrcmpiW (lpString1=".crw", lpString2="") returned 1
	[0074.112] lstrlenW (lpString=".cs") returned 3
	[0074.112] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1
	[0074.112] lstrlenW (lpString=".css") returned 4
	[0074.112] lstrcmpiW (lpString1=".css", lpString2="") returned 1
	[0074.112] lstrlenW (lpString=".csv") returned 4
	[0074.112] lstrcmpiW (lpString1=".csv", lpString2="") returned 1
	[0074.112] lstrlenW (lpString=".cub") returned 4
	[0074.112] lstrcmpiW (lpString1=".cub", lpString2="") returned 1
	[0074.112] lstrlenW (lpString=".dae") returned 4
	[0074.112] lstrcmpiW (lpString1=".dae", lpString2="") returned 1
	[0074.112] lstrlenW (lpString=".dat") returned 4
	[0074.112] lstrcmpiW (lpString1=".dat", lpString2="") returned 1
	[0074.112] lstrlenW (lpString=".db") returned 3
	[0074.112] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1
	[0074.112] lstrlenW (lpString=".dbf") returned 4
	[0074.112] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1
	[0074.112] lstrlenW (lpString=".dbx") returned 4
	[0074.112] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1
	[0074.112] lstrlenW (lpString=".dc3") returned 4
	[0074.112] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1
	[0074.112] lstrlenW (lpString=".dcm") returned 4
	[0074.112] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1
	[0074.112] lstrlenW (lpString=".dcr") returned 4
	[0074.112] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1
	[0074.112] lstrlenW (lpString=".der") returned 4
	[0074.112] lstrcmpiW (lpString1=".der", lpString2="") returned 1
	[0074.113] lstrlenW (lpString=".dib") returned 4
	[0074.113] lstrcmpiW (lpString1=".dib", lpString2="") returned 1
	[0074.113] lstrlenW (lpString=".dic") returned 4
	[0074.113] lstrcmpiW (lpString1=".dic", lpString2="") returned 1
	[0074.113] lstrlenW (lpString=".dif") returned 4
	[0074.113] lstrcmpiW (lpString1=".dif", lpString2="") returned 1
	[0074.113] lstrlenW (lpString=".divx") returned 5
	[0074.113] lstrcmpiW (lpString1=".divx", lpString2="") returned 1
	[0074.113] lstrlenW (lpString=".djvu") returned 5
	[0074.113] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1
	[0074.113] lstrlenW (lpString=".dng") returned 4
	[0074.113] lstrcmpiW (lpString1=".dng", lpString2="") returned 1
	[0074.113] lstrlenW (lpString=".doc") returned 4
	[0074.113] lstrcmpiW (lpString1=".doc", lpString2="") returned 1
	[0074.113] lstrlenW (lpString=".docm") returned 5
	[0074.113] lstrcmpiW (lpString1=".docm", lpString2="") returned 1
	[0074.113] lstrlenW (lpString=".docx") returned 5
	[0074.113] lstrcmpiW (lpString1=".docx", lpString2="") returned 1
	[0074.113] lstrlenW (lpString=".dot") returned 4
	[0074.113] lstrcmpiW (lpString1=".dot", lpString2="") returned 1
	[0074.113] lstrlenW (lpString=".dotm") returned 5
	[0074.113] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1
	[0074.113] lstrlenW (lpString=".dotx") returned 5
	[0074.113] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1
	[0074.113] lstrlenW (lpString=".dpx") returned 4
	[0074.113] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1
	[0074.113] lstrlenW (lpString=".dqy") returned 4
	[0074.113] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1
	[0074.113] lstrlenW (lpString=".dsn") returned 4
	[0074.114] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1
	[0074.114] lstrlenW (lpString=".dt") returned 3
	[0074.114] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1
	[0074.114] lstrlenW (lpString=".dtd") returned 4
	[0074.114] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1
	[0074.114] lstrlenW (lpString=".dwg") returned 4
	[0074.114] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1
	[0074.114] lstrlenW (lpString=".dwt") returned 4
	[0074.114] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1
	[0074.114] lstrlenW (lpString=".dx") returned 3
	[0074.114] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1
	[0074.114] lstrlenW (lpString=".dxf") returned 4
	[0074.114] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1
	[0074.114] lstrlenW (lpString=".edml") returned 5
	[0074.114] lstrcmpiW (lpString1=".edml", lpString2="") returned 1
	[0074.114] lstrlenW (lpString=".efd") returned 4
	[0074.114] lstrcmpiW (lpString1=".efd", lpString2="") returned 1
	[0074.114] lstrlenW (lpString=".elf") returned 4
	[0074.114] lstrcmpiW (lpString1=".elf", lpString2="") returned 1
	[0074.114] lstrlenW (lpString=".emf") returned 4
	[0074.114] lstrcmpiW (lpString1=".emf", lpString2="") returned 1
	[0074.114] lstrlenW (lpString=".emz") returned 4
	[0074.114] lstrcmpiW (lpString1=".emz", lpString2="") returned 1
	[0074.114] lstrlenW (lpString=".epf") returned 4
	[0074.114] lstrcmpiW (lpString1=".epf", lpString2="") returned 1
	[0074.114] lstrlenW (lpString=".eps") returned 4
	[0074.114] lstrcmpiW (lpString1=".eps", lpString2="") returned 1
	[0074.114] lstrlenW (lpString=".epsf") returned 5
	[0074.115] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1
	[0074.115] lstrlenW (lpString=".epsp") returned 5
	[0074.115] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1
	[0074.115] lstrlenW (lpString=".erf") returned 4
	[0074.115] lstrcmpiW (lpString1=".erf", lpString2="") returned 1
	[0074.115] lstrlenW (lpString=".exr") returned 4
	[0074.115] lstrcmpiW (lpString1=".exr", lpString2="") returned 1
	[0074.115] lstrlenW (lpString=".f4v") returned 4
	[0074.115] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1
	[0074.115] lstrlenW (lpString=".fido") returned 5
	[0074.115] lstrcmpiW (lpString1=".fido", lpString2="") returned 1
	[0074.115] lstrlenW (lpString=".flm") returned 4
	[0074.115] lstrcmpiW (lpString1=".flm", lpString2="") returned 1
	[0074.115] lstrlenW (lpString=".flv") returned 4
	[0074.115] lstrcmpiW (lpString1=".flv", lpString2="") returned 1
	[0074.115] lstrlenW (lpString=".frm") returned 4
	[0074.115] lstrcmpiW (lpString1=".frm", lpString2="") returned 1
	[0074.115] lstrlenW (lpString=".fxg") returned 4
	[0074.115] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1
	[0079.036] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.037] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1
	[0079.037] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0079.037] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0079.037] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0079.037] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0079.037] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0079.037] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0079.037] lstrcmpiW (lpString1=".accda", lpString2="ct.avi") returned -1
	[0079.037] lstrcmpiW (lpString1=".accdb", lpString2="ct.avi") returned -1
	[0079.037] lstrcmpiW (lpString1=".accdc", lpString2="ct.avi") returned -1
	[0079.037] lstrcmpiW (lpString1=".accde", lpString2="ct.avi") returned -1
	[0079.037] lstrcmpiW (lpString1=".accdt", lpString2="ct.avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".accdw", lpString2="ct.avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0079.038] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1
	[0079.039] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0079.039] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1
	[0079.039] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0079.039] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1
	[0079.039] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0079.039] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0079.039] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0079.039] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1
	[0079.039] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0079.039] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0079.039] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0079.039] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0079.039] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0079.039] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0079.039] lstrcmpiW (lpString1=".accda", lpString2="te.avi") returned -1
	[0079.039] lstrcmpiW (lpString1=".accdb", lpString2="te.avi") returned -1
	[0079.039] lstrcmpiW (lpString1=".accdc", lpString2="te.avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".accde", lpString2="te.avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".accdt", lpString2="te.avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".accdw", lpString2="te.avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".anim", lpString2="e.avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0079.040] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0079.041] lstrcmpiW (lpString1=".ascx", lpString2="e.avi") returned -1
	[0079.041] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0079.041] lstrcmpiW (lpString1=".asmx", lpString2="e.avi") returned -1
	[0079.041] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0079.041] lstrcmpiW (lpString1=".aspx", lpString2="e.avi") returned -1
	[0079.041] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0079.041] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0079.041] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0079.041] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1
	[0079.041] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0079.041] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0079.041] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0079.041] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0079.041] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0079.041] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0079.041] lstrcmpiW (lpString1=".accda", lpString2="in.avi") returned -1
	[0079.041] lstrcmpiW (lpString1=".accdb", lpString2="in.avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".accdc", lpString2="in.avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".accde", lpString2="in.avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".accdt", lpString2="in.avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".accdw", lpString2="in.avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".anim", lpString2="n.avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0079.042] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0079.043] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0079.043] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0079.043] lstrcmpiW (lpString1=".ascx", lpString2="n.avi") returned -1
	[0079.043] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0079.043] lstrcmpiW (lpString1=".asmx", lpString2="n.avi") returned -1
	[0079.043] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0079.043] lstrcmpiW (lpString1=".aspx", lpString2="n.avi") returned -1
	[0079.043] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0079.043] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0079.043] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0079.043] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1
	[0079.043] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0079.043] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0079.043] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0079.044] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0079.044] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0079.044] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0079.044] lstrcmpiW (lpString1=".accda", lpString2="it.avi") returned -1
	[0079.044] lstrcmpiW (lpString1=".accdb", lpString2="it.avi") returned -1
	[0079.044] lstrcmpiW (lpString1=".accdc", lpString2="it.avi") returned -1
	[0079.044] lstrcmpiW (lpString1=".accde", lpString2="it.avi") returned -1
	[0079.044] lstrcmpiW (lpString1=".accdt", lpString2="it.avi") returned -1
	[0079.044] lstrcmpiW (lpString1=".accdw", lpString2="it.avi") returned -1
	[0079.044] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0079.044] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0079.044] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0079.044] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0079.044] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0079.044] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0079.045] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0079.045] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0079.045] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0079.045] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1
	[0079.045] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0079.045] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0079.045] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0079.045] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0079.045] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1
	[0079.045] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0079.045] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1
	[0079.045] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0079.045] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1
	[0079.045] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0079.045] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0079.046] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0079.046] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1
	[0079.046] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0079.046] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0079.046] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0079.046] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0079.046] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0079.046] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0079.046] lstrcmpiW (lpString1=".accda", lpString2="ct.avi") returned -1
	[0079.046] lstrcmpiW (lpString1=".accdb", lpString2="ct.avi") returned -1
	[0079.046] lstrcmpiW (lpString1=".accdc", lpString2="ct.avi") returned -1
	[0079.046] lstrcmpiW (lpString1=".accde", lpString2="ct.avi") returned -1
	[0079.046] lstrcmpiW (lpString1=".accdt", lpString2="ct.avi") returned -1
	[0079.046] lstrcmpiW (lpString1=".accdw", lpString2="ct.avi") returned -1
	[0079.046] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0079.046] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0079.046] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0079.047] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1
	[0079.048] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0079.048] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0079.048] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0079.048] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1
	[0079.048] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0079.048] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0079.048] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0079.048] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0079.048] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0079.048] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0079.048] lstrcmpiW (lpString1=".accda", lpString2="te.avi") returned -1
	[0079.048] lstrcmpiW (lpString1=".accdb", lpString2="te.avi") returned -1
	[0079.048] lstrcmpiW (lpString1=".accdc", lpString2="te.avi") returned -1
	[0079.048] lstrcmpiW (lpString1=".accde", lpString2="te.avi") returned -1
	[0079.048] lstrcmpiW (lpString1=".accdt", lpString2="te.avi") returned -1
	[0079.048] lstrcmpiW (lpString1=".accdw", lpString2="te.avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".anim", lpString2="e.avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".ascx", lpString2="e.avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0079.049] lstrcmpiW (lpString1=".asmx", lpString2="e.avi") returned -1
	[0079.050] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0079.050] lstrcmpiW (lpString1=".aspx", lpString2="e.avi") returned -1
	[0079.050] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0079.050] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0079.050] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0079.050] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1
	[0079.050] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0079.050] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0079.050] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0079.050] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0079.050] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0079.050] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0079.050] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0079.050] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0079.050] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0079.050] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0079.053] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0079.053] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0079.053] FindClose (in: hFindFile=0x3841950 | out: hFindFile=0x3841950) returned 1
	[0079.437] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0079.439] FindNextFileW (in: hFindFile=0x3841910, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0079.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841950
	[0079.441] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.441] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0079.441] FindClose (in: hFindFile=0x3841950 | out: hFindFile=0x3841950) returned 1
	[0079.442] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0079.442] FindNextFileW (in: hFindFile=0x3841910, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0079.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841990
	[0080.097] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.097] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0080.097] FindClose (in: hFindFile=0x3841990 | out: hFindFile=0x3841990) returned 1
	[0080.097] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0080.100] FindNextFileW (in: hFindFile=0x3841910, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0080.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841990
	[0080.666] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.667] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0080.667] FindClose (in: hFindFile=0x3841990 | out: hFindFile=0x3841990) returned 1
	[0080.667] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0080.671] FindNextFileW (in: hFindFile=0x3841910, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1
	[0080.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841990
	[0081.338] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.338] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0081.338] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0081.338] FindClose (in: hFindFile=0x3841990 | out: hFindFile=0x3841990) returned 1
	[0081.338] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0081.338] FindNextFileW (in: hFindFile=0x3841910, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1
	[0081.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions") returned 64
	[0081.338] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions") returned 1
	[0081.338] lstrlenW (lpString="fsdefinitions") returned 13
	[0081.338] lstrcmpiW (lpString1="C:\\Windows", lpString2="fsdefinitions") returned -1
	[0081.339] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x3f20068
	[0081.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions") returned 64
	[0081.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841990
	[0081.437] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.439] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1
	[0081.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad") returned 71
	[0081.439] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad") returned 1
	[0081.439] lstrlenW (lpString="auxpad") returned 6
	[0081.439] lstrcmpiW (lpString1="C:\\Windows", lpString2="auxpad") returned 1
	[0081.439] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x3fd0010
	[0081.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad") returned 71
	[0081.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x38419d0
	[0081.440] FindNextFileW (in: hFindFile=0x38419d0, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.440] FindNextFileW (in: hFindFile=0x38419d0, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1
	[0081.440] lstrlenW (lpString="auxbase.xml") returned 11
	[0081.440] lstrlenW (lpString=".1cd") returned 4
	[0081.440] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.440] lstrlenW (lpString=".3ds") returned 4
	[0081.440] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1
	[0081.440] lstrlenW (lpString=".3fr") returned 4
	[0081.440] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1
	[0081.440] lstrlenW (lpString=".3g2") returned 4
	[0081.440] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1
	[0081.440] lstrlenW (lpString=".3gp") returned 4
	[0081.440] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1
	[0081.440] lstrlenW (lpString=".7z") returned 3
	[0081.440] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.440] lstrlenW (lpString=".accda") returned 6
	[0081.440] lstrcmpiW (lpString1=".accda", lpString2="se.xml") returned -1
	[0081.440] lstrlenW (lpString=".accdb") returned 6
	[0081.441] lstrcmpiW (lpString1=".accdb", lpString2="se.xml") returned -1
	[0081.441] lstrlenW (lpString=".accdc") returned 6
	[0081.441] lstrcmpiW (lpString1=".accdc", lpString2="se.xml") returned -1
	[0081.441] lstrlenW (lpString=".accde") returned 6
	[0081.441] lstrcmpiW (lpString1=".accde", lpString2="se.xml") returned -1
	[0081.441] lstrlenW (lpString=".accdt") returned 6
	[0081.441] lstrcmpiW (lpString1=".accdt", lpString2="se.xml") returned -1
	[0081.441] lstrlenW (lpString=".accdw") returned 6
	[0081.441] lstrcmpiW (lpString1=".accdw", lpString2="se.xml") returned -1
	[0081.441] lstrlenW (lpString=".adb") returned 4
	[0081.441] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1
	[0081.441] lstrlenW (lpString=".adp") returned 4
	[0081.441] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1
	[0081.441] lstrlenW (lpString=".ai") returned 3
	[0081.441] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1
	[0081.441] lstrlenW (lpString=".ai3") returned 4
	[0081.441] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1
	[0081.441] lstrlenW (lpString=".ai4") returned 4
	[0081.441] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1
	[0081.441] lstrlenW (lpString=".ai5") returned 4
	[0081.441] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1
	[0081.441] lstrlenW (lpString=".ai6") returned 4
	[0081.441] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1
	[0081.441] lstrlenW (lpString=".ai7") returned 4
	[0081.441] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1
	[0081.441] lstrlenW (lpString=".ai8") returned 4
	[0081.441] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1
	[0081.441] lstrlenW (lpString=".anim") returned 5
	[0081.441] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1
	[0081.441] lstrlenW (lpString=".arw") returned 4
	[0081.441] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1
	[0081.441] lstrlenW (lpString=".as") returned 3
	[0081.442] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1
	[0081.442] lstrlenW (lpString=".asa") returned 4
	[0081.442] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1
	[0081.442] lstrlenW (lpString=".asc") returned 4
	[0081.442] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1
	[0081.442] lstrlenW (lpString=".ascx") returned 5
	[0081.442] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1
	[0081.442] lstrlenW (lpString=".asm") returned 4
	[0081.442] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1
	[0081.442] lstrlenW (lpString=".asmx") returned 5
	[0081.442] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1
	[0081.442] lstrlenW (lpString=".asp") returned 4
	[0081.442] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1
	[0081.442] lstrlenW (lpString=".aspx") returned 5
	[0081.442] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1
	[0081.442] lstrlenW (lpString=".asr") returned 4
	[0081.442] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1
	[0081.442] lstrlenW (lpString=".asx") returned 4
	[0081.442] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1
	[0081.442] lstrlenW (lpString=".avi") returned 4
	[0081.442] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1
	[0081.442] lstrlenW (lpString=".avs") returned 4
	[0081.442] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1
	[0081.442] lstrlenW (lpString=".backup") returned 7
	[0081.442] lstrcmpiW (lpString1=".backup", lpString2="ase.xml") returned -1
	[0081.442] lstrlenW (lpString=".bak") returned 4
	[0081.442] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1
	[0081.442] lstrlenW (lpString=".bay") returned 4
	[0081.442] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1
	[0081.442] lstrlenW (lpString=".bd") returned 3
	[0081.442] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1
	[0081.442] lstrlenW (lpString=".bin") returned 4
	[0081.442] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1
	[0081.443] lstrlenW (lpString=".bmp") returned 4
	[0081.443] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1
	[0081.443] lstrlenW (lpString=".bz2") returned 4
	[0081.443] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.443] lstrlenW (lpString=".c") returned 2
	[0081.443] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0081.443] lstrlenW (lpString=".cdr") returned 4
	[0081.443] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1
	[0081.443] lstrlenW (lpString=".cer") returned 4
	[0081.443] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1
	[0081.443] lstrlenW (lpString=".cf") returned 3
	[0081.443] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1
	[0081.443] lstrlenW (lpString=".cfc") returned 4
	[0081.443] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1
	[0081.443] lstrlenW (lpString=".cfm") returned 4
	[0081.443] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1
	[0081.443] lstrlenW (lpString=".cfml") returned 5
	[0081.443] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1
	[0081.443] lstrlenW (lpString=".cfu") returned 4
	[0081.443] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1
	[0081.443] lstrlenW (lpString=".chm") returned 4
	[0081.443] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1
	[0081.443] lstrlenW (lpString=".cin") returned 4
	[0081.443] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1
	[0081.443] lstrlenW (lpString=".class") returned 6
	[0081.443] lstrcmpiW (lpString1=".class", lpString2="se.xml") returned -1
	[0081.443] lstrlenW (lpString=".clx") returned 4
	[0081.443] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1
	[0081.443] lstrlenW (lpString=".config") returned 7
	[0081.443] lstrcmpiW (lpString1=".config", lpString2="ase.xml") returned -1
	[0081.443] lstrlenW (lpString=".cpp") returned 4
	[0081.443] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1
	[0081.443] lstrlenW (lpString=".cr2") returned 4
	[0081.444] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1
	[0081.444] lstrlenW (lpString=".crt") returned 4
	[0081.444] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1
	[0081.444] lstrlenW (lpString=".crw") returned 4
	[0081.444] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1
	[0081.444] lstrlenW (lpString=".cs") returned 3
	[0081.444] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1
	[0081.444] lstrlenW (lpString=".css") returned 4
	[0081.444] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1
	[0081.444] lstrlenW (lpString=".csv") returned 4
	[0081.444] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1
	[0081.444] lstrlenW (lpString=".cub") returned 4
	[0081.444] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1
	[0081.444] lstrlenW (lpString=".dae") returned 4
	[0081.444] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1
	[0081.444] lstrlenW (lpString=".dat") returned 4
	[0081.444] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1
	[0081.444] lstrlenW (lpString=".db") returned 3
	[0081.444] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1
	[0081.444] lstrlenW (lpString=".dbf") returned 4
	[0081.444] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.444] lstrlenW (lpString=".dbx") returned 4
	[0081.444] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1
	[0081.444] lstrlenW (lpString=".dc3") returned 4
	[0081.444] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1
	[0081.444] lstrlenW (lpString=".dcm") returned 4
	[0081.444] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1
	[0081.444] lstrlenW (lpString=".dcr") returned 4
	[0081.444] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1
	[0081.444] lstrlenW (lpString=".der") returned 4
	[0081.444] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1
	[0081.444] lstrlenW (lpString=".dib") returned 4
	[0081.444] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1
	[0081.444] lstrlenW (lpString=".dic") returned 4
	[0081.445] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1
	[0081.445] lstrlenW (lpString=".dif") returned 4
	[0081.445] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1
	[0081.445] lstrlenW (lpString=".divx") returned 5
	[0081.445] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1
	[0081.445] lstrlenW (lpString=".djvu") returned 5
	[0081.445] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1
	[0081.445] lstrlenW (lpString=".dng") returned 4
	[0081.445] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1
	[0081.445] lstrlenW (lpString=".doc") returned 4
	[0081.445] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.445] lstrlenW (lpString=".docm") returned 5
	[0081.445] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1
	[0081.445] lstrlenW (lpString=".docx") returned 5
	[0081.445] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0081.445] lstrlenW (lpString=".dot") returned 4
	[0081.445] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1
	[0081.445] lstrlenW (lpString=".dotm") returned 5
	[0081.445] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1
	[0081.445] lstrlenW (lpString=".dotx") returned 5
	[0081.445] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1
	[0081.445] lstrlenW (lpString=".dpx") returned 4
	[0081.445] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1
	[0081.445] lstrlenW (lpString=".dqy") returned 4
	[0081.445] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1
	[0081.445] lstrlenW (lpString=".dsn") returned 4
	[0081.445] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1
	[0081.445] lstrlenW (lpString=".dt") returned 3
	[0081.445] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1
	[0081.445] lstrlenW (lpString=".dtd") returned 4
	[0081.445] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1
	[0081.445] lstrlenW (lpString=".dwg") returned 4
	[0081.445] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1
	[0081.445] lstrlenW (lpString=".dwt") returned 4
	[0081.445] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1
	[0081.446] lstrlenW (lpString=".dx") returned 3
	[0081.446] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1
	[0081.446] lstrlenW (lpString=".dxf") returned 4
	[0081.446] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1
	[0081.446] lstrlenW (lpString=".edml") returned 5
	[0081.446] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1
	[0081.446] lstrlenW (lpString=".efd") returned 4
	[0081.446] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1
	[0081.446] lstrlenW (lpString=".elf") returned 4
	[0081.446] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1
	[0081.446] lstrlenW (lpString=".emf") returned 4
	[0081.446] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1
	[0081.446] lstrlenW (lpString=".emz") returned 4
	[0081.446] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1
	[0081.446] lstrlenW (lpString=".epf") returned 4
	[0081.446] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1
	[0081.446] lstrlenW (lpString=".eps") returned 4
	[0081.446] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1
	[0081.446] lstrlenW (lpString=".epsf") returned 5
	[0081.446] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1
	[0081.446] lstrlenW (lpString=".epsp") returned 5
	[0081.446] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1
	[0081.446] lstrlenW (lpString=".erf") returned 4
	[0081.446] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1
	[0081.446] lstrlenW (lpString=".exr") returned 4
	[0081.446] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1
	[0081.446] lstrlenW (lpString=".f4v") returned 4
	[0081.446] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1
	[0081.446] lstrlenW (lpString=".fido") returned 5
	[0081.446] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1
	[0081.446] lstrlenW (lpString=".flm") returned 4
	[0081.446] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1
	[0081.446] lstrlenW (lpString=".flv") returned 4
	[0081.447] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1
	[0081.447] lstrlenW (lpString=".frm") returned 4
	[0081.447] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1
	[0081.447] lstrlenW (lpString=".fxg") returned 4
	[0081.447] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1
	[0081.447] lstrlenW (lpString=".geo") returned 4
	[0081.447] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1
	[0081.447] lstrlenW (lpString=".gif") returned 4
	[0081.447] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1
	[0081.447] lstrlenW (lpString=".grs") returned 4
	[0081.447] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1
	[0081.447] lstrlenW (lpString=".gz") returned 3
	[0081.447] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1
	[0081.447] lstrlenW (lpString=".h") returned 2
	[0081.447] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0081.447] lstrlenW (lpString=".hdr") returned 4
	[0081.447] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1
	[0081.447] lstrlenW (lpString=".hpp") returned 4
	[0081.447] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1
	[0081.447] lstrlenW (lpString=".hta") returned 4
	[0081.447] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1
	[0081.447] lstrlenW (lpString=".htc") returned 4
	[0081.447] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1
	[0081.447] lstrlenW (lpString=".htm") returned 4
	[0081.447] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1
	[0081.447] lstrlenW (lpString=".html") returned 5
	[0081.447] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1
	[0081.447] lstrlenW (lpString=".icb") returned 4
	[0081.447] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1
	[0081.447] lstrlenW (lpString=".ics") returned 4
	[0081.447] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1
	[0081.447] lstrlenW (lpString=".iff") returned 4
	[0081.447] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1
	[0081.447] lstrlenW (lpString=".inc") returned 4
	[0081.448] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1
	[0081.448] lstrlenW (lpString=".indd") returned 5
	[0081.448] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1
	[0081.448] lstrlenW (lpString=".ini") returned 4
	[0081.448] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1
	[0081.448] lstrlenW (lpString=".iqy") returned 4
	[0081.448] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1
	[0081.448] lstrlenW (lpString=".j2c") returned 4
	[0081.448] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1
	[0081.448] lstrlenW (lpString=".j2k") returned 4
	[0081.448] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1
	[0081.448] lstrlenW (lpString=".java") returned 5
	[0081.448] lstrcmpiW (lpString1=".java", lpString2="e.xml") returned -1
	[0081.448] lstrlenW (lpString=".jp2") returned 4
	[0081.448] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1
	[0081.448] lstrlenW (lpString=".jpc") returned 4
	[0081.448] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1
	[0081.448] lstrlenW (lpString=".jpe") returned 4
	[0081.448] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1
	[0081.448] lstrlenW (lpString=".jpeg") returned 5
	[0081.448] lstrcmpiW (lpString1=".jpeg", lpString2="e.xml") returned -1
	[0081.448] lstrlenW (lpString=".jpf") returned 4
	[0081.448] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1
	[0081.448] lstrlenW (lpString=".jpg") returned 4
	[0081.448] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.448] lstrlenW (lpString=".jpx") returned 4
	[0081.448] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1
	[0081.448] lstrlenW (lpString=".js") returned 3
	[0081.448] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1
	[0081.448] lstrlenW (lpString=".jsf") returned 4
	[0081.448] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1
	[0081.448] lstrlenW (lpString=".json") returned 5
	[0081.448] lstrcmpiW (lpString1=".json", lpString2="e.xml") returned -1
	[0081.448] lstrlenW (lpString=".jsp") returned 4
	[0081.448] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1
	[0081.449] lstrlenW (lpString=".kdc") returned 4
	[0081.449] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1
	[0081.449] lstrlenW (lpString=".kmz") returned 4
	[0081.449] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1
	[0081.449] lstrlenW (lpString=".kwm") returned 4
	[0081.449] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1
	[0081.449] lstrlenW (lpString=".lasso") returned 6
	[0081.449] lstrcmpiW (lpString1=".lasso", lpString2="se.xml") returned -1
	[0081.449] lstrlenW (lpString=".lbi") returned 4
	[0081.449] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1
	[0081.449] lstrlenW (lpString=".lgf") returned 4
	[0081.449] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1
	[0081.449] lstrlenW (lpString=".lgp") returned 4
	[0081.449] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1
	[0081.449] lstrlenW (lpString=".log") returned 4
	[0081.449] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1
	[0081.449] lstrlenW (lpString=".m1v") returned 4
	[0081.449] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1
	[0081.449] lstrlenW (lpString=".m4a") returned 4
	[0081.449] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1
	[0081.449] lstrlenW (lpString=".m4v") returned 4
	[0081.449] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1
	[0081.449] lstrlenW (lpString=".max") returned 4
	[0081.449] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1
	[0081.449] lstrlenW (lpString=".md") returned 3
	[0081.449] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1
	[0081.449] lstrlenW (lpString=".mda") returned 4
	[0081.449] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1
	[0081.449] lstrlenW (lpString=".mdb") returned 4
	[0081.449] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1
	[0081.449] lstrlenW (lpString=".mde") returned 4
	[0081.449] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1
	[0081.449] lstrlenW (lpString=".mdf") returned 4
	[0081.449] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1
	[0081.450] lstrlenW (lpString=".mdw") returned 4
	[0081.450] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1
	[0081.450] lstrlenW (lpString=".mef") returned 4
	[0081.450] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1
	[0081.450] lstrlenW (lpString=".mft") returned 4
	[0081.450] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1
	[0081.450] lstrlenW (lpString=".mfw") returned 4
	[0081.450] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1
	[0081.450] lstrlenW (lpString=".mht") returned 4
	[0081.450] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1
	[0081.450] lstrlenW (lpString=".mhtml") returned 6
	[0081.450] lstrcmpiW (lpString1=".mhtml", lpString2="se.xml") returned -1
	[0081.450] lstrlenW (lpString=".mka") returned 4
	[0081.450] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1
	[0081.450] lstrlenW (lpString=".mkidx") returned 6
	[0081.450] lstrcmpiW (lpString1=".mkidx", lpString2="se.xml") returned -1
	[0081.450] lstrlenW (lpString=".mkv") returned 4
	[0081.450] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1
	[0081.450] lstrlenW (lpString=".mos") returned 4
	[0081.450] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1
	[0081.450] lstrlenW (lpString=".mov") returned 4
	[0081.450] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1
	[0081.450] lstrlenW (lpString=".mp3") returned 4
	[0081.450] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1
	[0081.450] lstrlenW (lpString=".mp4") returned 4
	[0081.450] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1
	[0081.450] lstrlenW (lpString=".mpeg") returned 5
	[0081.450] lstrcmpiW (lpString1=".mpeg", lpString2="e.xml") returned -1
	[0081.450] lstrlenW (lpString=".mpg") returned 4
	[0081.450] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1
	[0081.450] lstrlenW (lpString=".mpv") returned 4
	[0081.450] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1
	[0081.450] lstrlenW (lpString=".mrw") returned 4
	[0081.451] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1
	[0081.451] lstrlenW (lpString=".msg") returned 4
	[0081.451] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1
	[0081.451] lstrlenW (lpString=".mxl") returned 4
	[0081.451] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1
	[0081.451] lstrlenW (lpString=".myd") returned 4
	[0081.451] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1
	[0081.451] lstrlenW (lpString=".myi") returned 4
	[0081.451] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1
	[0081.451] lstrlenW (lpString=".nef") returned 4
	[0081.451] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1
	[0081.451] lstrlenW (lpString=".nrw") returned 4
	[0081.451] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1
	[0081.451] lstrlenW (lpString=".obj") returned 4
	[0081.451] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1
	[0081.451] lstrlenW (lpString=".odb") returned 4
	[0081.451] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1
	[0081.451] lstrlenW (lpString=".odc") returned 4
	[0081.451] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1
	[0081.451] lstrlenW (lpString=".odm") returned 4
	[0081.451] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1
	[0081.451] lstrlenW (lpString=".odp") returned 4
	[0081.451] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1
	[0081.451] lstrlenW (lpString=".ods") returned 4
	[0081.451] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1
	[0081.451] lstrlenW (lpString=".oft") returned 4
	[0081.451] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1
	[0081.451] lstrlenW (lpString=".one") returned 4
	[0081.451] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1
	[0081.451] lstrlenW (lpString=".onepkg") returned 7
	[0081.451] lstrcmpiW (lpString1=".onepkg", lpString2="ase.xml") returned -1
	[0081.451] lstrlenW (lpString=".onetoc2") returned 8
	[0081.451] lstrcmpiW (lpString1=".onetoc2", lpString2="base.xml") returned -1
	[0081.451] lstrlenW (lpString=".opt") returned 4
	[0081.451] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".oqy") returned 4
	[0081.452] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".orf") returned 4
	[0081.452] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".p12") returned 4
	[0081.452] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".p7b") returned 4
	[0081.452] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".p7c") returned 4
	[0081.452] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".pam") returned 4
	[0081.452] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".pbm") returned 4
	[0081.452] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".pct") returned 4
	[0081.452] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".pcx") returned 4
	[0081.452] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".pdd") returned 4
	[0081.452] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".pdf") returned 4
	[0081.452] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".pdp") returned 4
	[0081.452] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".pef") returned 4
	[0081.452] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".pem") returned 4
	[0081.452] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".pff") returned 4
	[0081.452] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".pfm") returned 4
	[0081.452] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".pfx") returned 4
	[0081.452] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1
	[0081.452] lstrlenW (lpString=".pgm") returned 4
	[0081.453] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1
	[0081.453] lstrlenW (lpString=".php") returned 4
	[0081.453] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1
	[0081.453] lstrlenW (lpString=".php3") returned 5
	[0081.453] lstrcmpiW (lpString1=".php3", lpString2="e.xml") returned -1
	[0081.453] lstrlenW (lpString=".php4") returned 5
	[0081.453] lstrcmpiW (lpString1=".php4", lpString2="e.xml") returned -1
	[0081.453] lstrlenW (lpString=".php5") returned 5
	[0081.453] lstrcmpiW (lpString1=".php5", lpString2="e.xml") returned -1
	[0081.453] lstrlenW (lpString=".phtml") returned 6
	[0081.453] lstrcmpiW (lpString1=".phtml", lpString2="se.xml") returned -1
	[0081.453] lstrlenW (lpString=".pict") returned 5
	[0081.453] lstrcmpiW (lpString1=".pict", lpString2="e.xml") returned -1
	[0081.453] lstrlenW (lpString=".pl") returned 3
	[0081.453] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1
	[0081.453] lstrlenW (lpString=".pls") returned 4
	[0081.453] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1
	[0081.453] lstrlenW (lpString=".pm") returned 3
	[0081.453] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1
	[0081.453] lstrlenW (lpString=".png") returned 4
	[0081.453] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1
	[0081.453] lstrlenW (lpString=".pnm") returned 4
	[0081.453] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1
	[0081.453] lstrlenW (lpString=".pot") returned 4
	[0081.453] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1
	[0081.453] lstrlenW (lpString=".potm") returned 5
	[0081.453] lstrcmpiW (lpString1=".potm", lpString2="e.xml") returned -1
	[0081.453] lstrlenW (lpString=".potx") returned 5
	[0081.453] lstrcmpiW (lpString1=".potx", lpString2="e.xml") returned -1
	[0081.453] lstrlenW (lpString=".ppa") returned 4
	[0081.453] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1
	[0081.453] lstrlenW (lpString=".ppam") returned 5
	[0081.453] lstrcmpiW (lpString1=".ppam", lpString2="e.xml") returned -1
	[0081.453] lstrlenW (lpString=".ppm") returned 4
	[0081.453] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1
	[0081.454] lstrlenW (lpString=".pps") returned 4
	[0081.454] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1
	[0081.454] lstrlenW (lpString=".ppsm") returned 5
	[0081.454] lstrcmpiW (lpString1=".ppsm", lpString2="e.xml") returned -1
	[0081.454] lstrlenW (lpString=".ppt") returned 4
	[0081.454] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.454] lstrlenW (lpString=".pptm") returned 5
	[0081.454] lstrcmpiW (lpString1=".pptm", lpString2="e.xml") returned -1
	[0081.454] lstrlenW (lpString=".pptx") returned 5
	[0081.454] lstrcmpiW (lpString1=".pptx", lpString2="e.xml") returned -1
	[0081.454] lstrlenW (lpString=".prn") returned 4
	[0081.454] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1
	[0081.454] lstrlenW (lpString=".ps") returned 3
	[0081.454] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1
	[0081.454] lstrlenW (lpString=".psb") returned 4
	[0081.454] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1
	[0081.454] lstrlenW (lpString=".psd") returned 4
	[0081.454] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1
	[0081.454] lstrlenW (lpString=".pst") returned 4
	[0081.454] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1
	[0081.454] lstrlenW (lpString=".ptx") returned 4
	[0081.454] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1
	[0081.454] lstrlenW (lpString=".pub") returned 4
	[0081.454] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1
	[0081.454] lstrlenW (lpString=".pwm") returned 4
	[0081.454] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1
	[0081.454] lstrlenW (lpString=".pxr") returned 4
	[0081.454] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1
	[0081.455] FindClose (in: hFindFile=0x38419d0 | out: hFindFile=0x38419d0) returned 1
	[0081.456] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3fd0010 | out: hHeap=0x5e0000) returned 1
	[0081.456] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1
	[0081.457] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x38419d0
	[0081.457] FindNextFileW (in: hFindFile=0x38419d0, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.457] FindNextFileW (in: hFindFile=0x38419d0, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1
	[0081.463] FindNextFileW (in: hFindFile=0x3841a10, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.467] FindNextFileW (in: hFindFile=0x3841a10, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1
	[0081.478] FindNextFileW (in: hFindFile=0x3841a10, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.478] FindNextFileW (in: hFindFile=0x3841a10, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1
	[0081.503] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.503] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0081.514] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.514] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0081.514] FindClose (in: hFindFile=0x3841990 | out: hFindFile=0x3841990) returned 1
	[0081.514] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0081.514] FindNextFileW (in: hFindFile=0x3841910, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1
	[0091.237] FindClose (in: hFindFile=0x3841950 | out: hFindFile=0x3841950) returned 1
	[0091.243] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3fd0010 | out: hHeap=0x5e0000) returned 1
	[0091.243] FindNextFileW (in: hFindFile=0x3841910, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x62688, dwReserved0=0x7ff, dwReserved1=0x20000, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1
	[0091.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*", lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841950
	[0091.244] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.244] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6c340, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER.XLAM", cAlternateFileName="SOLVER~1.XLA")) returned 1
	[0091.244] FindClose (in: hFindFile=0x3841950 | out: hFindFile=0x3841950) returned 1
	[0091.244] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f10060 | out: hHeap=0x5e0000) returned 1
	[0091.244] FindNextFileW (in: hFindFile=0x3841910, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ff, dwReserved1=0x20000, cFileName="SOLVER", cAlternateFileName="")) returned 0
	[0091.244] FindClose (in: hFindFile=0x3841910 | out: hFindFile=0x3841910) returned 1
	[0091.245] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x5e0000) returned 1
	[0091.245] FindNextFileW (in: hFindFile=0x3841810, lpFindFileData=0x341f58c | out: lpFindFileData=0x341f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5dfae80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xfafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGELEMS.DLL", cAlternateFileName="")) returned 1
	[0091.430] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*", lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x3841950
	[0091.719] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0091.725] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa, dwReserved0=0x7ff, dwReserved1=0x20000, cFileName="APPLAUSE.WAV", cAlternateFileName="")) returned 1
	[0091.726] FindClose (in: hFindFile=0x3841950 | out: hFindFile=0x3841950) returned 1
	[0091.727] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x5e0000) returned 1
	[0091.730] FindNextFileW (in: hFindFile=0x3841810, lpFindFileData=0x341f58c | out: lpFindFileData=0x341f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f5000, ftCreationTime.dwHighDateTime=0x1cac037, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4f5000, ftLastWriteTime.dwHighDateTime=0x1cac037, nFileSizeHigh=0x0, nFileSizeLow=0x1c798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MI5659~1.DLL")) returned 1
	[0100.179] FindNextFileW (in: hFindFile=0x3841890, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0100.179] FindNextFileW (in: hFindFile=0x3841890, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0103.892] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.893] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0103.893] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0103.893] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0103.893] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0103.893] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0103.893] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0103.960] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.960] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0103.960] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0103.960] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0103.960] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0103.960] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0103.961] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0103.968] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.968] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0103.968] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0103.968] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0103.968] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0103.968] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0103.968] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0103.973] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.973] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0103.973] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0103.973] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0103.973] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0103.973] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0103.973] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.012] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.012] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.012] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.012] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.013] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0104.013] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0104.013] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.123] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.123] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.123] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.123] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.123] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0104.123] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0104.124] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.130] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.130] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.130] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.130] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.130] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0104.130] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0104.131] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.136] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.136] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.136] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.136] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.136] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0104.136] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0104.136] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.201] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.201] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.201] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.201] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.202] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0104.202] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0104.202] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.261] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.261] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.262] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.262] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.262] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0104.262] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1
	[0104.263] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.275] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.275] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.276] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.276] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.276] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0104.276] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0104.276] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.280] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.280] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.280] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.280] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.280] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0104.280] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0104.281] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.308] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.308] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.308] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.308] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.309] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0104.309] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0104.309] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.312] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.312] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.312] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.312] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.312] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0104.312] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0104.312] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.347] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.347] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.347] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.347] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.347] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0104.347] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0104.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.350] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.350] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.351] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.351] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.351] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0104.351] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1
	[0104.351] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.361] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.361] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.361] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.361] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.361] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0104.361] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1
	[0104.362] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.376] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.376] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.376] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.376] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.385] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20068 | out: hHeap=0x5e0000) returned 1
	[0104.385] FindNextFileW (in: hFindFile=0x3841d50, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0
	[0104.385] FindClose (in: hFindFile=0x3841d50 | out: hFindFile=0x3841d50) returned 1
	[0104.385] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f00058 | out: hHeap=0x5e0000) returned 1
	[0104.385] FindNextFileW (in: hFindFile=0x3841cd0, lpFindFileData=0x341e1ac | out: lpFindFileData=0x341e1ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1
	[0104.394] FindNextFileW (in: hFindFile=0x3841d90, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.397] FindNextFileW (in: hFindFile=0x3841d90, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x844eed30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1
	[0104.397] FindNextFileW (in: hFindFile=0x3841d90, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1
	[0104.397] FindNextFileW (in: hFindFile=0x3841d90, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0
	[0104.397] FindClose (in: hFindFile=0x3841d90 | out: hFindFile=0x3841d90) returned 1
	[0104.397] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f00058 | out: hHeap=0x5e0000) returned 1
	[0104.398] FindNextFileW (in: hFindFile=0x3841cd0, lpFindFileData=0x341e1ac | out: lpFindFileData=0x341e1ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0
	[0104.398] FindClose (in: hFindFile=0x3841cd0 | out: hFindFile=0x3841cd0) returned 1
	[0104.398] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x40c1080 | out: hHeap=0x5e0000) returned 1
	[0104.398] FindNextFileW (in: hFindFile=0x3841d10, lpFindFileData=0x341e428 | out: lpFindFileData=0x341e428*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1_0", cAlternateFileName="")) returned 0
	[0104.398] FindClose (in: hFindFile=0x3841d10 | out: hFindFile=0x3841d10) returned 1
	[0104.398] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f40078 | out: hHeap=0x5e0000) returned 1
	[0104.401] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x341e6a4 | out: lpFindFileData=0x341e6a4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1
	[0104.404] FindNextFileW (in: hFindFile=0x3841d10, lpFindFileData=0x341e428 | out: lpFindFileData=0x341e428*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.404] FindNextFileW (in: hFindFile=0x3841d10, lpFindFileData=0x341e428 | out: lpFindFileData=0x341e428*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.4_0", cAlternateFileName="")) returned 1
	[0104.445] FindNextFileW (in: hFindFile=0x3841d90, lpFindFileData=0x341e1ac | out: lpFindFileData=0x341e1ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.446] FindNextFileW (in: hFindFile=0x3841d90, lpFindFileData=0x341e1ac | out: lpFindFileData=0x341e1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1
	[0105.152] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.152] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1

Thread:
	id = 63
	os_tid = 0xbbc

	[0074.119] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x38106d8
	[0074.119] lstrlenW (lpString="C:") returned 2
	[0074.119] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3edfd00 | out: lpFindFileData=0x3edfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x6d34f8
	[0074.119] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0074.120] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1
	[0074.120] lstrlenW (lpString="$Recycle.Bin") returned 12
	[0074.120] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1
	[0074.120] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x38206e0
	[0074.120] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0074.120] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d3538
	[0074.120] FindNextFileW (in: hFindFile=0x6d3538, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.120] FindNextFileW (in: hFindFile=0x6d3538, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0074.121] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0074.121] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1
	[0074.121] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46
	[0074.121] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1
	[0074.121] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x38306e8
	[0074.121] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0074.121] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4580
	[0074.122] FindNextFileW (in: hFindFile=0x6d4580, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.122] FindNextFileW (in: hFindFile=0x6d4580, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0074.122] lstrlenW (lpString="desktop.ini") returned 11
	[0074.122] lstrlenW (lpString=".1cd") returned 4
	[0074.122] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0074.122] lstrlenW (lpString=".3ds") returned 4
	[0074.122] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0074.122] lstrlenW (lpString=".3fr") returned 4
	[0074.122] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0074.122] lstrlenW (lpString=".3g2") returned 4
	[0074.122] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0074.122] lstrlenW (lpString=".3gp") returned 4
	[0074.122] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0074.122] lstrlenW (lpString=".7z") returned 3
	[0074.122] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0074.122] lstrlenW (lpString=".accda") returned 6
	[0074.122] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1
	[0074.122] lstrlenW (lpString=".accdb") returned 6
	[0074.122] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1
	[0074.122] lstrlenW (lpString=".accdc") returned 6
	[0074.123] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1
	[0074.123] lstrlenW (lpString=".accde") returned 6
	[0074.123] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1
	[0074.123] lstrlenW (lpString=".accdt") returned 6
	[0074.123] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1
	[0074.123] lstrlenW (lpString=".accdw") returned 6
	[0074.123] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1
	[0074.123] lstrlenW (lpString=".adb") returned 4
	[0074.123] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0074.123] lstrlenW (lpString=".adp") returned 4
	[0074.123] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0074.123] lstrlenW (lpString=".ai") returned 3
	[0074.123] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0074.123] lstrlenW (lpString=".ai3") returned 4
	[0074.123] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0074.123] lstrlenW (lpString=".ai4") returned 4
	[0074.123] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0074.123] lstrlenW (lpString=".ai5") returned 4
	[0074.123] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0074.123] lstrlenW (lpString=".ai6") returned 4
	[0074.123] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0074.123] lstrlenW (lpString=".ai7") returned 4
	[0074.123] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0074.123] lstrlenW (lpString=".ai8") returned 4
	[0074.123] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0074.123] lstrlenW (lpString=".anim") returned 5
	[0074.123] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1
	[0074.123] lstrlenW (lpString=".arw") returned 4
	[0074.123] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0074.124] lstrlenW (lpString=".as") returned 3
	[0074.124] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0074.124] lstrlenW (lpString=".asa") returned 4
	[0074.124] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0074.124] lstrlenW (lpString=".asc") returned 4
	[0074.124] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0074.124] lstrlenW (lpString=".ascx") returned 5
	[0074.124] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1
	[0074.124] lstrlenW (lpString=".asm") returned 4
	[0074.124] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0074.124] lstrlenW (lpString=".asmx") returned 5
	[0074.124] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1
	[0074.124] lstrlenW (lpString=".asp") returned 4
	[0074.124] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0074.124] lstrlenW (lpString=".aspx") returned 5
	[0074.124] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1
	[0074.124] lstrlenW (lpString=".asr") returned 4
	[0074.124] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0074.124] lstrlenW (lpString=".asx") returned 4
	[0074.124] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0074.124] lstrlenW (lpString=".avi") returned 4
	[0074.124] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0074.124] lstrlenW (lpString=".avs") returned 4
	[0074.124] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0074.124] lstrlenW (lpString=".backup") returned 7
	[0074.124] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1
	[0074.124] lstrlenW (lpString=".bak") returned 4
	[0074.124] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0074.125] lstrlenW (lpString=".bay") returned 4
	[0074.125] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0074.125] lstrlenW (lpString=".bd") returned 3
	[0074.125] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0074.125] lstrlenW (lpString=".bin") returned 4
	[0074.125] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0074.125] lstrlenW (lpString=".bmp") returned 4
	[0074.125] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0074.125] lstrlenW (lpString=".bz2") returned 4
	[0074.125] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0074.125] lstrlenW (lpString=".c") returned 2
	[0074.125] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0074.125] lstrlenW (lpString=".cdr") returned 4
	[0074.125] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0074.125] lstrlenW (lpString=".cer") returned 4
	[0074.125] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0074.125] lstrlenW (lpString=".cf") returned 3
	[0074.125] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0074.125] lstrlenW (lpString=".cfc") returned 4
	[0074.125] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0074.125] lstrlenW (lpString=".cfm") returned 4
	[0074.125] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0074.125] lstrlenW (lpString=".cfml") returned 5
	[0074.125] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1
	[0074.125] lstrlenW (lpString=".cfu") returned 4
	[0074.125] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0074.125] lstrlenW (lpString=".chm") returned 4
	[0074.125] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0074.126] lstrlenW (lpString=".cin") returned 4
	[0074.126] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0074.126] lstrlenW (lpString=".class") returned 6
	[0074.126] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1
	[0074.126] lstrlenW (lpString=".clx") returned 4
	[0074.126] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0074.126] lstrlenW (lpString=".config") returned 7
	[0074.126] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1
	[0074.126] lstrlenW (lpString=".cpp") returned 4
	[0074.126] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0074.126] lstrlenW (lpString=".cr2") returned 4
	[0074.126] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0074.126] lstrlenW (lpString=".crt") returned 4
	[0074.126] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0074.126] lstrlenW (lpString=".crw") returned 4
	[0074.126] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0074.126] lstrlenW (lpString=".cs") returned 3
	[0074.126] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0074.126] lstrlenW (lpString=".css") returned 4
	[0074.126] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0074.126] lstrlenW (lpString=".csv") returned 4
	[0074.126] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0074.126] lstrlenW (lpString=".cub") returned 4
	[0074.126] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0074.126] lstrlenW (lpString=".dae") returned 4
	[0074.126] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0074.126] lstrlenW (lpString=".dat") returned 4
	[0074.126] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0074.127] lstrlenW (lpString=".db") returned 3
	[0074.127] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0074.127] lstrlenW (lpString=".dbf") returned 4
	[0074.127] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0074.127] lstrlenW (lpString=".dbx") returned 4
	[0074.127] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0074.127] lstrlenW (lpString=".dc3") returned 4
	[0074.127] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0074.127] lstrlenW (lpString=".dcm") returned 4
	[0074.127] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0074.127] lstrlenW (lpString=".dcr") returned 4
	[0074.127] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0074.127] lstrlenW (lpString=".der") returned 4
	[0074.127] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0074.127] lstrlenW (lpString=".dib") returned 4
	[0074.127] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0074.127] lstrlenW (lpString=".dic") returned 4
	[0074.127] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0074.127] lstrlenW (lpString=".dif") returned 4
	[0074.127] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0074.127] lstrlenW (lpString=".divx") returned 5
	[0074.128] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1
	[0074.128] lstrlenW (lpString=".djvu") returned 5
	[0074.128] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1
	[0074.128] lstrlenW (lpString=".dng") returned 4
	[0074.128] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0074.128] lstrlenW (lpString=".doc") returned 4
	[0074.128] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0074.128] lstrlenW (lpString=".docm") returned 5
	[0074.128] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1
	[0074.128] lstrlenW (lpString=".docx") returned 5
	[0074.128] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0074.128] lstrlenW (lpString=".dot") returned 4
	[0074.128] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0074.128] lstrlenW (lpString=".dotm") returned 5
	[0074.128] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1
	[0074.128] lstrlenW (lpString=".dotx") returned 5
	[0074.128] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1
	[0074.128] lstrlenW (lpString=".dpx") returned 4
	[0074.128] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0074.128] lstrlenW (lpString=".dqy") returned 4
	[0074.128] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0074.128] lstrlenW (lpString=".dsn") returned 4
	[0074.128] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0074.129] lstrlenW (lpString=".dt") returned 3
	[0074.129] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0074.129] lstrlenW (lpString=".dtd") returned 4
	[0074.129] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0074.129] lstrlenW (lpString=".dwg") returned 4
	[0074.129] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0074.129] lstrlenW (lpString=".dwt") returned 4
	[0074.129] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0074.129] lstrlenW (lpString=".dx") returned 3
	[0074.129] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0074.129] lstrlenW (lpString=".dxf") returned 4
	[0074.129] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0074.129] lstrlenW (lpString=".edml") returned 5
	[0074.129] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1
	[0074.129] lstrlenW (lpString=".efd") returned 4
	[0074.129] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0074.129] lstrlenW (lpString=".elf") returned 4
	[0074.129] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0074.129] lstrlenW (lpString=".emf") returned 4
	[0074.129] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0074.129] lstrlenW (lpString=".emz") returned 4
	[0074.129] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0074.129] lstrlenW (lpString=".epf") returned 4
	[0074.129] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0074.129] lstrlenW (lpString=".eps") returned 4
	[0074.129] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0074.129] lstrlenW (lpString=".epsf") returned 5
	[0074.129] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1
	[0074.129] lstrlenW (lpString=".epsp") returned 5
	[0074.130] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1
	[0074.130] lstrlenW (lpString=".erf") returned 4
	[0074.130] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0074.130] lstrlenW (lpString=".exr") returned 4
	[0074.130] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0074.130] lstrlenW (lpString=".f4v") returned 4
	[0074.130] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0074.130] lstrlenW (lpString=".fido") returned 5
	[0074.130] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1
	[0074.130] lstrlenW (lpString=".flm") returned 4
	[0074.130] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0074.130] lstrlenW (lpString=".flv") returned 4
	[0074.130] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0074.130] lstrlenW (lpString=".frm") returned 4
	[0074.130] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0074.130] lstrlenW (lpString=".fxg") returned 4
	[0074.130] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1
	[0074.130] lstrlenW (lpString=".geo") returned 4
	[0074.130] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1
	[0074.130] lstrlenW (lpString=".gif") returned 4
	[0074.130] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1
	[0074.130] lstrlenW (lpString=".grs") returned 4
	[0074.130] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1
	[0074.130] lstrlenW (lpString=".gz") returned 3
	[0074.130] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1
	[0074.130] lstrlenW (lpString=".h") returned 2
	[0074.130] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1
	[0074.130] lstrlenW (lpString=".hdr") returned 4
	[0074.131] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1
	[0074.131] lstrlenW (lpString=".hpp") returned 4
	[0074.131] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1
	[0074.131] lstrlenW (lpString=".hta") returned 4
	[0074.131] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1
	[0074.131] lstrlenW (lpString=".htc") returned 4
	[0074.131] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1
	[0074.131] lstrlenW (lpString=".htm") returned 4
	[0074.131] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1
	[0074.131] lstrlenW (lpString=".html") returned 5
	[0074.131] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1
	[0074.131] lstrlenW (lpString=".icb") returned 4
	[0074.131] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1
	[0074.131] lstrlenW (lpString=".ics") returned 4
	[0074.131] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1
	[0074.131] lstrlenW (lpString=".iff") returned 4
	[0074.131] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1
	[0074.131] lstrlenW (lpString=".inc") returned 4
	[0074.131] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1
	[0074.131] lstrlenW (lpString=".indd") returned 5
	[0074.131] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1
	[0074.131] lstrlenW (lpString=".ini") returned 4
	[0074.131] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0
	[0074.131] lstrlenW (lpString="desktop.ini") returned 11
	[0074.131] lstrlenW (lpString=".adobe") returned 6
	[0074.131] lstrcmpiW (lpString1=".adobe", lpString2="op.ini") returned -1
	[0074.131] lstrlenW (lpString="desktop.ini") returned 11
	[0074.131] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1
	[0074.132] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1
	[0074.132] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1
	[0074.132] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1
	[0074.132] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1
	[0074.132] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1
	[0074.132] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1
	[0074.132] lstrcmpiW (lpString1="winhost.exe", lpString2="desktop.ini") returned 1
	[0074.132] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0074.132] FindNextFileW (in: hFindFile=0x6d4580, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0074.132] FindClose (in: hFindFile=0x6d4580 | out: hFindFile=0x6d4580) returned 1
	[0074.132] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x5e0000) returned 1
	[0074.132] FindNextFileW (in: hFindFile=0x6d3538, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0074.132] FindClose (in: hFindFile=0x6d3538 | out: hFindFile=0x6d3538) returned 1
	[0074.132] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x38206e0 | out: hHeap=0x5e0000) returned 1
	[0074.132] FindNextFileW (in: hFindFile=0x6d34f8, lpFindFileData=0x3edfd00 | out: lpFindFileData=0x3edfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0074.132] lstrlenW (lpString="C:\\Boot") returned 7
	[0074.133] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1
	[0074.133] lstrlenW (lpString="Boot") returned 4
	[0074.133] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1
	[0074.133] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x38206e0
	[0074.133] lstrlenW (lpString="C:\\Boot") returned 7
	[0074.133] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4540
	[0074.136] FindNextFileW (in: hFindFile=0x6d4540, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.136] FindNextFileW (in: hFindFile=0x6d4540, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0074.136] lstrlenW (lpString="BCD") returned 3
	[0074.136] lstrlenW (lpString=".1cd") returned 4
	[0074.136] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1
	[0074.136] lstrlenW (lpString=".3ds") returned 4
	[0074.137] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1
	[0074.137] lstrlenW (lpString=".3fr") returned 4
	[0074.137] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1
	[0074.137] lstrlenW (lpString=".3g2") returned 4
	[0074.137] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1
	[0074.137] lstrlenW (lpString=".3gp") returned 4
	[0074.137] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1
	[0074.137] lstrlenW (lpString=".7z") returned 3
	[0074.137] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0074.137] lstrlenW (lpString=".accda") returned 6
	[0074.137] lstrcmpiW (lpString1=".accda", lpString2="") returned 1
	[0074.137] lstrlenW (lpString=".accdb") returned 6
	[0074.137] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1
	[0074.137] lstrlenW (lpString=".accdc") returned 6
	[0074.137] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1
	[0074.137] lstrlenW (lpString=".accde") returned 6
	[0074.137] lstrcmpiW (lpString1=".accde", lpString2="") returned 1
	[0074.137] lstrlenW (lpString=".accdt") returned 6
	[0074.137] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1
	[0074.137] lstrlenW (lpString=".accdw") returned 6
	[0074.137] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1
	[0074.137] lstrlenW (lpString=".adb") returned 4
	[0074.137] lstrcmpiW (lpString1=".adb", lpString2="") returned 1
	[0074.137] lstrlenW (lpString=".adp") returned 4
	[0074.137] lstrcmpiW (lpString1=".adp", lpString2="") returned 1
	[0074.137] lstrlenW (lpString=".ai") returned 3
	[0074.137] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1
	[0074.137] lstrlenW (lpString=".ai3") returned 4
	[0074.137] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1
	[0074.138] lstrlenW (lpString=".ai4") returned 4
	[0074.138] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1
	[0074.138] lstrlenW (lpString=".ai5") returned 4
	[0074.138] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1
	[0074.138] lstrlenW (lpString=".ai6") returned 4
	[0074.138] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1
	[0074.138] lstrlenW (lpString=".ai7") returned 4
	[0074.138] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1
	[0074.138] lstrlenW (lpString=".ai8") returned 4
	[0074.138] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1
	[0074.138] lstrlenW (lpString=".anim") returned 5
	[0074.138] lstrcmpiW (lpString1=".anim", lpString2="") returned 1
	[0074.138] lstrlenW (lpString=".arw") returned 4
	[0074.138] lstrcmpiW (lpString1=".arw", lpString2="") returned 1
	[0074.138] lstrlenW (lpString=".as") returned 3
	[0074.138] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1
	[0074.138] lstrlenW (lpString=".asa") returned 4
	[0074.138] lstrcmpiW (lpString1=".asa", lpString2="") returned 1
	[0074.138] lstrlenW (lpString=".asc") returned 4
	[0074.138] lstrcmpiW (lpString1=".asc", lpString2="") returned 1
	[0074.138] lstrlenW (lpString=".ascx") returned 5
	[0074.138] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1
	[0074.138] lstrlenW (lpString=".asm") returned 4
	[0074.138] lstrcmpiW (lpString1=".asm", lpString2="") returned 1
	[0074.138] lstrlenW (lpString=".asmx") returned 5
	[0074.138] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1
	[0074.138] lstrlenW (lpString=".asp") returned 4
	[0074.139] lstrcmpiW (lpString1=".asp", lpString2="") returned 1
	[0074.139] lstrlenW (lpString=".aspx") returned 5
	[0074.139] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1
	[0074.139] lstrlenW (lpString=".asr") returned 4
	[0074.139] lstrcmpiW (lpString1=".asr", lpString2="") returned 1
	[0074.139] lstrlenW (lpString=".asx") returned 4
	[0074.139] lstrcmpiW (lpString1=".asx", lpString2="") returned 1
	[0074.139] lstrlenW (lpString=".avi") returned 4
	[0074.139] lstrcmpiW (lpString1=".avi", lpString2="") returned 1
	[0074.139] lstrlenW (lpString=".avs") returned 4
	[0074.139] lstrcmpiW (lpString1=".avs", lpString2="") returned 1
	[0074.139] lstrlenW (lpString=".backup") returned 7
	[0074.139] lstrcmpiW (lpString1=".backup", lpString2="") returned 1
	[0074.139] lstrlenW (lpString=".bak") returned 4
	[0074.139] lstrcmpiW (lpString1=".bak", lpString2="") returned 1
	[0074.139] lstrlenW (lpString=".bay") returned 4
	[0074.139] lstrcmpiW (lpString1=".bay", lpString2="") returned 1
	[0074.139] lstrlenW (lpString=".bd") returned 3
	[0074.139] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1
	[0074.139] lstrlenW (lpString=".bin") returned 4
	[0074.139] lstrcmpiW (lpString1=".bin", lpString2="") returned 1
	[0074.139] lstrlenW (lpString=".bmp") returned 4
	[0074.139] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1
	[0074.139] lstrlenW (lpString=".bz2") returned 4
	[0074.139] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1
	[0074.139] lstrlenW (lpString=".c") returned 2
	[0074.139] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1
	[0074.139] lstrlenW (lpString=".cdr") returned 4
	[0074.139] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1
	[0074.140] lstrlenW (lpString=".cer") returned 4
	[0074.140] lstrcmpiW (lpString1=".cer", lpString2="") returned 1
	[0074.140] lstrlenW (lpString=".cf") returned 3
	[0074.140] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1
	[0074.140] lstrlenW (lpString=".cfc") returned 4
	[0074.140] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1
	[0074.140] lstrlenW (lpString=".cfm") returned 4
	[0074.140] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1
	[0074.140] lstrlenW (lpString=".cfml") returned 5
	[0074.140] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1
	[0074.140] lstrlenW (lpString=".cfu") returned 4
	[0074.140] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1
	[0074.140] lstrlenW (lpString=".chm") returned 4
	[0074.140] lstrcmpiW (lpString1=".chm", lpString2="") returned 1
	[0074.140] lstrlenW (lpString=".cin") returned 4
	[0074.140] lstrcmpiW (lpString1=".cin", lpString2="") returned 1
	[0074.140] lstrlenW (lpString=".class") returned 6
	[0074.140] lstrcmpiW (lpString1=".class", lpString2="") returned 1
	[0074.140] lstrlenW (lpString=".clx") returned 4
	[0074.140] lstrcmpiW (lpString1=".clx", lpString2="") returned 1
	[0074.140] lstrlenW (lpString=".config") returned 7
	[0074.140] lstrcmpiW (lpString1=".config", lpString2="") returned 1
	[0074.140] lstrlenW (lpString=".cpp") returned 4
	[0074.140] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1
	[0074.140] lstrlenW (lpString=".cr2") returned 4
	[0074.140] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1
	[0074.140] lstrlenW (lpString=".crt") returned 4
	[0074.140] lstrcmpiW (lpString1=".crt", lpString2="") returned 1
	[0074.141] lstrlenW (lpString=".crw") returned 4
	[0074.141] lstrcmpiW (lpString1=".crw", lpString2="") returned 1
	[0074.141] lstrlenW (lpString=".cs") returned 3
	[0074.141] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1
	[0074.141] lstrlenW (lpString=".css") returned 4
	[0074.141] lstrcmpiW (lpString1=".css", lpString2="") returned 1
	[0074.141] lstrlenW (lpString=".csv") returned 4
	[0074.141] lstrcmpiW (lpString1=".csv", lpString2="") returned 1
	[0074.141] lstrlenW (lpString=".cub") returned 4
	[0074.141] lstrcmpiW (lpString1=".cub", lpString2="") returned 1
	[0074.141] lstrlenW (lpString=".dae") returned 4
	[0074.141] lstrcmpiW (lpString1=".dae", lpString2="") returned 1
	[0074.141] lstrlenW (lpString=".dat") returned 4
	[0074.141] lstrcmpiW (lpString1=".dat", lpString2="") returned 1
	[0074.141] lstrlenW (lpString=".db") returned 3
	[0074.141] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1
	[0074.141] lstrlenW (lpString=".dbf") returned 4
	[0074.141] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1
	[0074.141] lstrlenW (lpString=".dbx") returned 4
	[0074.141] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1
	[0074.141] lstrlenW (lpString=".dc3") returned 4
	[0074.141] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1
	[0074.141] lstrlenW (lpString=".dcm") returned 4
	[0074.141] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1
	[0074.141] lstrlenW (lpString=".dcr") returned 4
	[0074.141] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1
	[0074.141] lstrlenW (lpString=".der") returned 4
	[0074.141] lstrcmpiW (lpString1=".der", lpString2="") returned 1
	[0074.141] lstrlenW (lpString=".dib") returned 4
	[0074.142] lstrcmpiW (lpString1=".dib", lpString2="") returned 1
	[0074.142] lstrlenW (lpString=".dic") returned 4
	[0074.142] lstrcmpiW (lpString1=".dic", lpString2="") returned 1
	[0074.142] lstrlenW (lpString=".dif") returned 4
	[0074.142] lstrcmpiW (lpString1=".dif", lpString2="") returned 1
	[0074.142] lstrlenW (lpString=".divx") returned 5
	[0074.142] lstrcmpiW (lpString1=".divx", lpString2="") returned 1
	[0074.142] lstrlenW (lpString=".djvu") returned 5
	[0074.142] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1
	[0074.142] lstrlenW (lpString=".dng") returned 4
	[0074.142] lstrcmpiW (lpString1=".dng", lpString2="") returned 1
	[0074.142] lstrlenW (lpString=".doc") returned 4
	[0074.142] lstrcmpiW (lpString1=".doc", lpString2="") returned 1
	[0074.142] lstrlenW (lpString=".docm") returned 5
	[0074.142] lstrcmpiW (lpString1=".docm", lpString2="") returned 1
	[0074.142] lstrlenW (lpString=".docx") returned 5
	[0074.142] lstrcmpiW (lpString1=".docx", lpString2="") returned 1
	[0074.142] lstrlenW (lpString=".dot") returned 4
	[0074.142] lstrcmpiW (lpString1=".dot", lpString2="") returned 1
	[0074.142] lstrlenW (lpString=".dotm") returned 5
	[0074.142] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1
	[0074.142] lstrlenW (lpString=".dotx") returned 5
	[0074.142] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1
	[0074.142] lstrlenW (lpString=".dpx") returned 4
	[0074.142] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1
	[0074.142] lstrlenW (lpString=".dqy") returned 4
	[0074.142] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1
	[0074.142] lstrlenW (lpString=".dsn") returned 4
	[0074.143] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1
	[0074.143] lstrlenW (lpString=".dt") returned 3
	[0074.143] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1
	[0074.143] lstrlenW (lpString=".dtd") returned 4
	[0074.143] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1
	[0074.143] lstrlenW (lpString=".dwg") returned 4
	[0074.143] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1
	[0074.143] lstrlenW (lpString=".dwt") returned 4
	[0074.143] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1
	[0074.143] lstrlenW (lpString=".dx") returned 3
	[0074.143] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1
	[0074.143] lstrlenW (lpString=".dxf") returned 4
	[0074.143] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1
	[0074.143] lstrlenW (lpString=".edml") returned 5
	[0074.143] lstrcmpiW (lpString1=".edml", lpString2="") returned 1
	[0074.143] lstrlenW (lpString=".efd") returned 4
	[0074.143] lstrcmpiW (lpString1=".efd", lpString2="") returned 1
	[0074.143] lstrlenW (lpString=".elf") returned 4
	[0074.143] lstrcmpiW (lpString1=".elf", lpString2="") returned 1
	[0074.143] lstrlenW (lpString=".emf") returned 4
	[0074.143] lstrcmpiW (lpString1=".emf", lpString2="") returned 1
	[0074.143] lstrlenW (lpString=".emz") returned 4
	[0074.143] lstrcmpiW (lpString1=".emz", lpString2="") returned 1
	[0074.143] lstrlenW (lpString=".epf") returned 4
	[0074.143] lstrcmpiW (lpString1=".epf", lpString2="") returned 1
	[0074.143] lstrlenW (lpString=".eps") returned 4
	[0074.143] lstrcmpiW (lpString1=".eps", lpString2="") returned 1
	[0074.143] lstrlenW (lpString=".epsf") returned 5
	[0074.143] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1
	[0074.144] lstrlenW (lpString=".epsp") returned 5
	[0074.144] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1
	[0074.144] lstrlenW (lpString=".erf") returned 4
	[0074.144] lstrcmpiW (lpString1=".erf", lpString2="") returned 1
	[0074.144] lstrlenW (lpString=".exr") returned 4
	[0074.144] lstrcmpiW (lpString1=".exr", lpString2="") returned 1
	[0074.144] lstrlenW (lpString=".f4v") returned 4
	[0074.144] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1
	[0074.144] lstrlenW (lpString=".fido") returned 5
	[0074.144] lstrcmpiW (lpString1=".fido", lpString2="") returned 1
	[0074.146] FindNextFileW (in: hFindFile=0x6d5588, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.146] FindNextFileW (in: hFindFile=0x6d5588, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0079.285] FindClose (in: hFindFile=0x3841990 | out: hFindFile=0x3841990) returned 1
	[0079.505] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0079.506] FindNextFileW (in: hFindFile=0x38418d0, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0079.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841990
	[0080.190] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.190] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0080.190] FindClose (in: hFindFile=0x3841990 | out: hFindFile=0x3841990) returned 1
	[0080.190] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0080.190] FindNextFileW (in: hFindFile=0x38418d0, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0080.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841990
	[0080.743] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.743] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0080.743] FindClose (in: hFindFile=0x3841990 | out: hFindFile=0x3841990) returned 1
	[0080.744] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0080.744] FindNextFileW (in: hFindFile=0x38418d0, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0080.744] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841990
	[0081.399] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.400] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0081.401] FindClose (in: hFindFile=0x3841990 | out: hFindFile=0x3841990) returned 1
	[0081.401] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0081.401] FindNextFileW (in: hFindFile=0x38418d0, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1
	[0081.401] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841990
	[0081.434] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.434] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0081.434] FindClose (in: hFindFile=0x3841990 | out: hFindFile=0x3841990) returned 1
	[0081.434] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0081.436] FindNextFileW (in: hFindFile=0x38418d0, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1
	[0081.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841950
	[0081.438] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.438] FindNextFileW (in: hFindFile=0x3841950, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1
	[0081.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841a10
	[0081.456] FindNextFileW (in: hFindFile=0x3841a10, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.462] FindNextFileW (in: hFindFile=0x3841a10, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1
	[0081.462] FindNextFileW (in: hFindFile=0x3841a10, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.462] FindNextFileW (in: hFindFile=0x3841a10, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1
	[0081.468] FindNextFileW (in: hFindFile=0x38419d0, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.468] FindNextFileW (in: hFindFile=0x38419d0, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1
	[0091.207] FindNextFileW (in: hFindFile=0x3841890, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xcf2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROCDB.XLAM", cAlternateFileName="PROCDB~1.XLA")) returned 1
	[0091.207] lstrcmpiW (lpString1=".1cd", lpString2="XLAM") returned -1
	[0091.207] lstrcmpiW (lpString1=".3ds", lpString2="XLAM") returned -1
	[0091.208] lstrcmpiW (lpString1=".3fr", lpString2="XLAM") returned -1
	[0091.208] lstrcmpiW (lpString1=".3g2", lpString2="XLAM") returned -1
	[0091.208] lstrcmpiW (lpString1=".3gp", lpString2="XLAM") returned -1
	[0091.208] lstrcmpiW (lpString1=".7z", lpString2="LAM") returned -1
	[0091.208] lstrcmpiW (lpString1=".accda", lpString2="B.XLAM") returned -1
	[0091.208] lstrcmpiW (lpString1=".accdb", lpString2="B.XLAM") returned -1
	[0091.208] lstrcmpiW (lpString1=".accdc", lpString2="B.XLAM") returned -1
	[0091.208] lstrcmpiW (lpString1=".accde", lpString2="B.XLAM") returned -1
	[0091.208] lstrcmpiW (lpString1=".accdt", lpString2="B.XLAM") returned -1
	[0091.208] lstrcmpiW (lpString1=".accdw", lpString2="B.XLAM") returned -1
	[0091.208] lstrcmpiW (lpString1=".adb", lpString2="XLAM") returned -1
	[0091.208] lstrcmpiW (lpString1=".adp", lpString2="XLAM") returned -1
	[0091.209] lstrcmpiW (lpString1=".ai", lpString2="LAM") returned -1
	[0091.209] lstrcmpiW (lpString1=".ai3", lpString2="XLAM") returned -1
	[0091.209] lstrcmpiW (lpString1=".ai4", lpString2="XLAM") returned -1
	[0091.209] lstrcmpiW (lpString1=".ai5", lpString2="XLAM") returned -1
	[0091.209] lstrcmpiW (lpString1=".ai6", lpString2="XLAM") returned -1
	[0091.209] lstrcmpiW (lpString1=".ai7", lpString2="XLAM") returned -1
	[0091.209] lstrcmpiW (lpString1=".ai8", lpString2="XLAM") returned -1
	[0091.209] lstrcmpiW (lpString1=".anim", lpString2=".XLAM") returned -1
	[0091.209] lstrcmpiW (lpString1=".arw", lpString2="XLAM") returned -1
	[0091.209] lstrcmpiW (lpString1=".as", lpString2="LAM") returned -1
	[0091.209] lstrcmpiW (lpString1=".asa", lpString2="XLAM") returned -1
	[0091.209] lstrcmpiW (lpString1=".asc", lpString2="XLAM") returned -1
	[0091.210] lstrcmpiW (lpString1=".ascx", lpString2=".XLAM") returned -1
	[0091.210] lstrcmpiW (lpString1=".asm", lpString2="XLAM") returned -1
	[0091.210] lstrcmpiW (lpString1=".asmx", lpString2=".XLAM") returned -1
	[0091.210] lstrcmpiW (lpString1=".asp", lpString2="XLAM") returned -1
	[0091.210] lstrcmpiW (lpString1=".aspx", lpString2=".XLAM") returned -1
	[0091.210] lstrcmpiW (lpString1=".asr", lpString2="XLAM") returned -1
	[0091.210] lstrcmpiW (lpString1=".asx", lpString2="XLAM") returned -1
	[0091.210] lstrcmpiW (lpString1=".avi", lpString2="XLAM") returned -1
	[0091.210] lstrcmpiW (lpString1=".avs", lpString2="XLAM") returned -1
	[0091.210] lstrcmpiW (lpString1=".backup", lpString2="DB.XLAM") returned -1
	[0091.210] lstrcmpiW (lpString1=".bak", lpString2="XLAM") returned -1
	[0091.210] lstrcmpiW (lpString1=".bay", lpString2="XLAM") returned -1
	[0091.211] lstrcmpiW (lpString1=".bd", lpString2="LAM") returned -1
	[0091.211] lstrcmpiW (lpString1=".bin", lpString2="XLAM") returned -1
	[0091.211] lstrcmpiW (lpString1=".bmp", lpString2="XLAM") returned -1
	[0091.211] lstrcmpiW (lpString1=".bz2", lpString2="XLAM") returned -1
	[0091.211] lstrcmpiW (lpString1=".c", lpString2="AM") returned -1
	[0091.211] lstrcmpiW (lpString1=".cdr", lpString2="XLAM") returned -1
	[0091.211] lstrcmpiW (lpString1=".cer", lpString2="XLAM") returned -1
	[0091.211] lstrcmpiW (lpString1=".cf", lpString2="LAM") returned -1
	[0091.211] lstrcmpiW (lpString1=".cfc", lpString2="XLAM") returned -1
	[0091.211] lstrcmpiW (lpString1=".cfm", lpString2="XLAM") returned -1
	[0091.211] lstrcmpiW (lpString1=".cfml", lpString2=".XLAM") returned -1
	[0091.211] lstrcmpiW (lpString1=".cfu", lpString2="XLAM") returned -1
	[0091.211] lstrcmpiW (lpString1=".chm", lpString2="XLAM") returned -1
	[0091.212] lstrcmpiW (lpString1=".cin", lpString2="XLAM") returned -1
	[0091.212] lstrcmpiW (lpString1=".class", lpString2="B.XLAM") returned -1
	[0091.212] lstrcmpiW (lpString1=".clx", lpString2="XLAM") returned -1
	[0091.212] lstrcmpiW (lpString1=".config", lpString2="DB.XLAM") returned -1
	[0091.212] lstrcmpiW (lpString1=".cpp", lpString2="XLAM") returned -1
	[0091.212] lstrcmpiW (lpString1=".cr2", lpString2="XLAM") returned -1
	[0091.212] lstrcmpiW (lpString1=".crt", lpString2="XLAM") returned -1
	[0091.212] lstrcmpiW (lpString1=".crw", lpString2="XLAM") returned -1
	[0091.212] lstrcmpiW (lpString1=".cs", lpString2="LAM") returned -1
	[0091.212] lstrcmpiW (lpString1=".css", lpString2="XLAM") returned -1
	[0091.212] lstrcmpiW (lpString1=".csv", lpString2="XLAM") returned -1
	[0091.212] lstrcmpiW (lpString1=".cub", lpString2="XLAM") returned -1
	[0091.212] lstrcmpiW (lpString1=".dae", lpString2="XLAM") returned -1
	[0091.212] lstrcmpiW (lpString1=".dat", lpString2="XLAM") returned -1
	[0091.213] lstrcmpiW (lpString1=".db", lpString2="LAM") returned -1
	[0091.213] lstrcmpiW (lpString1=".dbf", lpString2="XLAM") returned -1
	[0091.213] lstrcmpiW (lpString1=".dbx", lpString2="XLAM") returned -1
	[0091.213] lstrcmpiW (lpString1=".dc3", lpString2="XLAM") returned -1
	[0091.213] lstrcmpiW (lpString1=".dcm", lpString2="XLAM") returned -1
	[0091.213] lstrcmpiW (lpString1=".dcr", lpString2="XLAM") returned -1
	[0091.213] lstrcmpiW (lpString1=".der", lpString2="XLAM") returned -1
	[0091.213] lstrcmpiW (lpString1=".dib", lpString2="XLAM") returned -1
	[0091.213] lstrcmpiW (lpString1=".dic", lpString2="XLAM") returned -1
	[0091.213] lstrcmpiW (lpString1=".dif", lpString2="XLAM") returned -1
	[0091.213] lstrcmpiW (lpString1=".divx", lpString2=".XLAM") returned -1
	[0091.213] lstrcmpiW (lpString1=".djvu", lpString2=".XLAM") returned -1
	[0091.214] lstrcmpiW (lpString1=".dng", lpString2="XLAM") returned -1
	[0091.214] lstrcmpiW (lpString1=".doc", lpString2="XLAM") returned -1
	[0091.214] lstrcmpiW (lpString1=".docm", lpString2=".XLAM") returned -1
	[0091.214] lstrcmpiW (lpString1=".docx", lpString2=".XLAM") returned -1
	[0091.214] lstrcmpiW (lpString1=".dot", lpString2="XLAM") returned -1
	[0091.214] lstrcmpiW (lpString1=".dotm", lpString2=".XLAM") returned -1
	[0091.214] lstrcmpiW (lpString1=".dotx", lpString2=".XLAM") returned -1
	[0091.214] lstrcmpiW (lpString1=".dpx", lpString2="XLAM") returned -1
	[0091.214] lstrcmpiW (lpString1=".dqy", lpString2="XLAM") returned -1
	[0091.214] lstrcmpiW (lpString1=".dsn", lpString2="XLAM") returned -1
	[0091.214] lstrcmpiW (lpString1=".dt", lpString2="LAM") returned -1
	[0091.214] lstrcmpiW (lpString1=".dtd", lpString2="XLAM") returned -1
	[0091.214] lstrcmpiW (lpString1=".dwg", lpString2="XLAM") returned -1
	[0091.215] lstrcmpiW (lpString1=".dwt", lpString2="XLAM") returned -1
	[0091.215] lstrcmpiW (lpString1=".dx", lpString2="LAM") returned -1
	[0091.215] lstrcmpiW (lpString1=".dxf", lpString2="XLAM") returned -1
	[0091.215] lstrcmpiW (lpString1=".edml", lpString2=".XLAM") returned -1
	[0091.215] lstrcmpiW (lpString1=".efd", lpString2="XLAM") returned -1
	[0091.215] lstrcmpiW (lpString1=".elf", lpString2="XLAM") returned -1
	[0091.215] lstrcmpiW (lpString1=".emf", lpString2="XLAM") returned -1
	[0091.215] lstrcmpiW (lpString1=".emz", lpString2="XLAM") returned -1
	[0091.215] lstrcmpiW (lpString1=".epf", lpString2="XLAM") returned -1
	[0091.215] lstrcmpiW (lpString1=".eps", lpString2="XLAM") returned -1
	[0091.215] lstrcmpiW (lpString1=".epsf", lpString2=".XLAM") returned -1
	[0091.215] lstrcmpiW (lpString1=".epsp", lpString2=".XLAM") returned -1
	[0091.216] lstrcmpiW (lpString1=".erf", lpString2="XLAM") returned -1
	[0091.216] lstrcmpiW (lpString1=".exr", lpString2="XLAM") returned -1
	[0091.216] lstrcmpiW (lpString1=".f4v", lpString2="XLAM") returned -1
	[0091.216] lstrcmpiW (lpString1=".fido", lpString2=".XLAM") returned -1
	[0091.216] lstrcmpiW (lpString1=".flm", lpString2="XLAM") returned -1
	[0091.216] lstrcmpiW (lpString1=".flv", lpString2="XLAM") returned -1
	[0091.216] lstrcmpiW (lpString1=".frm", lpString2="XLAM") returned -1
	[0091.216] lstrcmpiW (lpString1=".fxg", lpString2="XLAM") returned -1
	[0091.216] lstrcmpiW (lpString1=".geo", lpString2="XLAM") returned -1
	[0091.216] lstrcmpiW (lpString1=".gif", lpString2="XLAM") returned -1
	[0091.216] lstrcmpiW (lpString1=".grs", lpString2="XLAM") returned -1
	[0091.216] lstrcmpiW (lpString1=".gz", lpString2="LAM") returned -1
	[0091.217] lstrcmpiW (lpString1=".h", lpString2="AM") returned -1
	[0091.217] lstrcmpiW (lpString1=".hdr", lpString2="XLAM") returned -1
	[0091.217] lstrcmpiW (lpString1=".hpp", lpString2="XLAM") returned -1
	[0091.217] lstrcmpiW (lpString1=".hta", lpString2="XLAM") returned -1
	[0091.217] lstrcmpiW (lpString1=".htc", lpString2="XLAM") returned -1
	[0091.217] lstrcmpiW (lpString1=".htm", lpString2="XLAM") returned -1
	[0091.217] lstrcmpiW (lpString1=".html", lpString2=".XLAM") returned -1
	[0091.217] lstrcmpiW (lpString1=".icb", lpString2="XLAM") returned -1
	[0091.217] lstrcmpiW (lpString1=".ics", lpString2="XLAM") returned -1
	[0091.217] lstrcmpiW (lpString1=".iff", lpString2="XLAM") returned -1
	[0091.217] lstrcmpiW (lpString1=".inc", lpString2="XLAM") returned -1
	[0091.217] lstrcmpiW (lpString1=".indd", lpString2=".XLAM") returned -1
	[0091.217] lstrcmpiW (lpString1=".ini", lpString2="XLAM") returned -1
	[0091.218] lstrcmpiW (lpString1=".iqy", lpString2="XLAM") returned -1
	[0091.218] lstrcmpiW (lpString1=".j2c", lpString2="XLAM") returned -1
	[0091.218] lstrcmpiW (lpString1=".j2k", lpString2="XLAM") returned -1
	[0091.218] lstrcmpiW (lpString1=".java", lpString2=".XLAM") returned -1
	[0091.218] lstrcmpiW (lpString1=".jp2", lpString2="XLAM") returned -1
	[0091.218] lstrcmpiW (lpString1=".jpc", lpString2="XLAM") returned -1
	[0091.218] lstrcmpiW (lpString1=".jpe", lpString2="XLAM") returned -1
	[0091.218] lstrcmpiW (lpString1=".jpeg", lpString2=".XLAM") returned -1
	[0091.218] lstrcmpiW (lpString1=".jpf", lpString2="XLAM") returned -1
	[0091.218] lstrcmpiW (lpString1=".jpg", lpString2="XLAM") returned -1
	[0091.218] lstrcmpiW (lpString1=".jpx", lpString2="XLAM") returned -1
	[0091.218] lstrcmpiW (lpString1=".js", lpString2="LAM") returned -1
	[0091.218] lstrcmpiW (lpString1=".jsf", lpString2="XLAM") returned -1
	[0091.219] lstrcmpiW (lpString1=".json", lpString2=".XLAM") returned -1
	[0091.219] lstrcmpiW (lpString1=".jsp", lpString2="XLAM") returned -1
	[0091.219] lstrcmpiW (lpString1=".kdc", lpString2="XLAM") returned -1
	[0091.219] lstrcmpiW (lpString1=".kmz", lpString2="XLAM") returned -1
	[0091.219] lstrcmpiW (lpString1=".kwm", lpString2="XLAM") returned -1
	[0091.219] lstrcmpiW (lpString1=".lasso", lpString2="B.XLAM") returned -1
	[0091.219] lstrcmpiW (lpString1=".lbi", lpString2="XLAM") returned -1
	[0091.219] lstrcmpiW (lpString1=".lgf", lpString2="XLAM") returned -1
	[0091.219] lstrcmpiW (lpString1=".lgp", lpString2="XLAM") returned -1
	[0091.219] lstrcmpiW (lpString1=".log", lpString2="XLAM") returned -1
	[0091.219] lstrcmpiW (lpString1=".m1v", lpString2="XLAM") returned -1
	[0091.220] lstrcmpiW (lpString1=".m4a", lpString2="XLAM") returned -1
	[0091.220] lstrcmpiW (lpString1=".m4v", lpString2="XLAM") returned -1
	[0091.220] lstrcmpiW (lpString1=".max", lpString2="XLAM") returned -1
	[0091.220] lstrcmpiW (lpString1=".md", lpString2="LAM") returned -1
	[0091.220] lstrcmpiW (lpString1=".mda", lpString2="XLAM") returned -1
	[0091.220] lstrcmpiW (lpString1=".mdb", lpString2="XLAM") returned -1
	[0091.220] lstrcmpiW (lpString1=".mde", lpString2="XLAM") returned -1
	[0091.220] lstrcmpiW (lpString1=".mdf", lpString2="XLAM") returned -1
	[0091.220] lstrcmpiW (lpString1=".mdw", lpString2="XLAM") returned -1
	[0091.220] lstrcmpiW (lpString1=".mef", lpString2="XLAM") returned -1
	[0091.220] lstrcmpiW (lpString1=".mft", lpString2="XLAM") returned -1
	[0091.220] lstrcmpiW (lpString1=".mfw", lpString2="XLAM") returned -1
	[0091.220] lstrcmpiW (lpString1=".mht", lpString2="XLAM") returned -1
	[0091.220] lstrcmpiW (lpString1=".mhtml", lpString2="B.XLAM") returned -1
	[0091.221] lstrcmpiW (lpString1=".mka", lpString2="XLAM") returned -1
	[0091.221] lstrcmpiW (lpString1=".mkidx", lpString2="B.XLAM") returned -1
	[0091.221] lstrcmpiW (lpString1=".mkv", lpString2="XLAM") returned -1
	[0091.221] lstrcmpiW (lpString1=".mos", lpString2="XLAM") returned -1
	[0091.221] lstrcmpiW (lpString1=".mov", lpString2="XLAM") returned -1
	[0091.221] lstrcmpiW (lpString1=".mp3", lpString2="XLAM") returned -1
	[0091.221] lstrcmpiW (lpString1=".mp4", lpString2="XLAM") returned -1
	[0091.221] lstrcmpiW (lpString1=".mpeg", lpString2=".XLAM") returned -1
	[0091.221] lstrcmpiW (lpString1=".mpg", lpString2="XLAM") returned -1
	[0091.221] lstrcmpiW (lpString1=".mpv", lpString2="XLAM") returned -1
	[0091.221] lstrcmpiW (lpString1=".mrw", lpString2="XLAM") returned -1
	[0091.221] lstrcmpiW (lpString1=".msg", lpString2="XLAM") returned -1
	[0091.221] lstrcmpiW (lpString1=".mxl", lpString2="XLAM") returned -1
	[0091.222] lstrcmpiW (lpString1=".myd", lpString2="XLAM") returned -1
	[0091.222] lstrcmpiW (lpString1=".myi", lpString2="XLAM") returned -1
	[0091.222] lstrcmpiW (lpString1=".nef", lpString2="XLAM") returned -1
	[0091.222] lstrcmpiW (lpString1=".nrw", lpString2="XLAM") returned -1
	[0091.224] lstrcmpiW (lpString1=".obj", lpString2="XLAM") returned -1
	[0091.224] lstrcmpiW (lpString1=".odb", lpString2="XLAM") returned -1
	[0091.224] lstrcmpiW (lpString1=".odc", lpString2="XLAM") returned -1
	[0091.224] lstrcmpiW (lpString1=".odm", lpString2="XLAM") returned -1
	[0091.224] lstrcmpiW (lpString1=".odp", lpString2="XLAM") returned -1
	[0091.225] lstrcmpiW (lpString1=".ods", lpString2="XLAM") returned -1
	[0091.225] lstrcmpiW (lpString1=".oft", lpString2="XLAM") returned -1
	[0091.225] lstrcmpiW (lpString1=".one", lpString2="XLAM") returned -1
	[0091.225] lstrcmpiW (lpString1=".onepkg", lpString2="DB.XLAM") returned -1
	[0091.225] lstrcmpiW (lpString1=".onetoc2", lpString2="CDB.XLAM") returned -1
	[0091.225] lstrcmpiW (lpString1=".opt", lpString2="XLAM") returned -1
	[0091.225] lstrcmpiW (lpString1=".oqy", lpString2="XLAM") returned -1
	[0091.225] lstrcmpiW (lpString1=".orf", lpString2="XLAM") returned -1
	[0091.225] lstrcmpiW (lpString1=".p12", lpString2="XLAM") returned -1
	[0091.225] lstrcmpiW (lpString1=".p7b", lpString2="XLAM") returned -1
	[0091.225] lstrcmpiW (lpString1=".p7c", lpString2="XLAM") returned -1
	[0091.225] lstrcmpiW (lpString1=".pam", lpString2="XLAM") returned -1
	[0091.225] lstrcmpiW (lpString1=".pbm", lpString2="XLAM") returned -1
	[0091.226] lstrcmpiW (lpString1=".pct", lpString2="XLAM") returned -1
	[0091.226] lstrcmpiW (lpString1=".pcx", lpString2="XLAM") returned -1
	[0091.226] lstrlenW (lpString=".pdd") returned 4
	[0091.226] lstrcmpiW (lpString1=".pdd", lpString2="XLAM") returned -1
	[0091.226] lstrlenW (lpString=".pdf") returned 4
	[0091.226] lstrcmpiW (lpString1=".pdf", lpString2="XLAM") returned -1
	[0091.226] lstrlenW (lpString=".pdp") returned 4
	[0091.226] lstrcmpiW (lpString1=".pdp", lpString2="XLAM") returned -1
	[0091.226] lstrlenW (lpString=".pef") returned 4
	[0091.226] lstrcmpiW (lpString1=".pef", lpString2="XLAM") returned -1
	[0091.226] lstrlenW (lpString=".pem") returned 4
	[0091.226] lstrcmpiW (lpString1=".pem", lpString2="XLAM") returned -1
	[0091.226] lstrlenW (lpString=".pff") returned 4
	[0091.226] lstrcmpiW (lpString1=".pff", lpString2="XLAM") returned -1
	[0091.226] lstrlenW (lpString=".pfm") returned 4
	[0091.226] lstrcmpiW (lpString1=".pfm", lpString2="XLAM") returned -1
	[0091.226] lstrlenW (lpString=".pfx") returned 4
	[0091.226] lstrcmpiW (lpString1=".pfx", lpString2="XLAM") returned -1
	[0091.227] lstrlenW (lpString=".pgm") returned 4
	[0091.227] lstrcmpiW (lpString1=".pgm", lpString2="XLAM") returned -1
	[0091.227] lstrlenW (lpString=".php") returned 4
	[0091.227] lstrcmpiW (lpString1=".php", lpString2="XLAM") returned -1
	[0091.227] lstrlenW (lpString=".php3") returned 5
	[0091.227] lstrcmpiW (lpString1=".php3", lpString2=".XLAM") returned -1
	[0091.227] lstrlenW (lpString=".php4") returned 5
	[0091.227] lstrcmpiW (lpString1=".php4", lpString2=".XLAM") returned -1
	[0091.227] lstrlenW (lpString=".php5") returned 5
	[0091.227] lstrcmpiW (lpString1=".php5", lpString2=".XLAM") returned -1
	[0091.227] lstrlenW (lpString=".phtml") returned 6
	[0091.227] lstrcmpiW (lpString1=".phtml", lpString2="B.XLAM") returned -1
	[0091.227] lstrlenW (lpString=".pict") returned 5
	[0091.227] lstrcmpiW (lpString1=".pict", lpString2=".XLAM") returned -1
	[0091.227] lstrlenW (lpString=".pl") returned 3
	[0091.227] lstrcmpiW (lpString1=".pl", lpString2="LAM") returned -1
	[0091.227] lstrlenW (lpString=".pls") returned 4
	[0091.227] lstrcmpiW (lpString1=".pls", lpString2="XLAM") returned -1
	[0091.227] lstrlenW (lpString=".pm") returned 3
	[0091.227] lstrcmpiW (lpString1=".pm", lpString2="LAM") returned -1
	[0091.227] lstrlenW (lpString=".png") returned 4
	[0091.227] lstrcmpiW (lpString1=".png", lpString2="XLAM") returned -1
	[0091.227] lstrlenW (lpString=".pnm") returned 4
	[0091.227] lstrcmpiW (lpString1=".pnm", lpString2="XLAM") returned -1
	[0091.227] lstrlenW (lpString=".pot") returned 4
	[0091.227] lstrcmpiW (lpString1=".pot", lpString2="XLAM") returned -1
	[0091.227] lstrlenW (lpString=".potm") returned 5
	[0091.228] lstrcmpiW (lpString1=".potm", lpString2=".XLAM") returned -1
	[0091.228] lstrlenW (lpString=".potx") returned 5
	[0091.228] lstrcmpiW (lpString1=".potx", lpString2=".XLAM") returned -1
	[0091.228] lstrlenW (lpString=".ppa") returned 4
	[0091.228] lstrcmpiW (lpString1=".ppa", lpString2="XLAM") returned -1
	[0091.228] lstrlenW (lpString=".ppam") returned 5
	[0091.228] lstrcmpiW (lpString1=".ppam", lpString2=".XLAM") returned -1
	[0091.228] lstrlenW (lpString=".ppm") returned 4
	[0091.228] lstrcmpiW (lpString1=".ppm", lpString2="XLAM") returned -1
	[0091.228] lstrlenW (lpString=".pps") returned 4
	[0091.228] lstrcmpiW (lpString1=".pps", lpString2="XLAM") returned -1
	[0091.228] lstrlenW (lpString=".ppsm") returned 5
	[0091.228] lstrcmpiW (lpString1=".ppsm", lpString2=".XLAM") returned -1
	[0091.228] lstrlenW (lpString=".ppt") returned 4
	[0091.228] lstrcmpiW (lpString1=".ppt", lpString2="XLAM") returned -1
	[0091.228] lstrlenW (lpString=".pptm") returned 5
	[0091.228] lstrcmpiW (lpString1=".pptm", lpString2=".XLAM") returned -1
	[0091.228] lstrlenW (lpString=".pptx") returned 5
	[0091.228] lstrcmpiW (lpString1=".pptx", lpString2=".XLAM") returned -1
	[0091.228] lstrlenW (lpString=".prn") returned 4
	[0091.228] lstrcmpiW (lpString1=".prn", lpString2="XLAM") returned -1
	[0091.228] lstrlenW (lpString=".ps") returned 3
	[0091.228] lstrcmpiW (lpString1=".ps", lpString2="LAM") returned -1
	[0091.228] lstrlenW (lpString=".psb") returned 4
	[0091.228] lstrcmpiW (lpString1=".psb", lpString2="XLAM") returned -1
	[0091.228] lstrlenW (lpString=".psd") returned 4
	[0091.228] lstrcmpiW (lpString1=".psd", lpString2="XLAM") returned -1
	[0091.229] lstrlenW (lpString=".pst") returned 4
	[0091.229] lstrcmpiW (lpString1=".pst", lpString2="XLAM") returned -1
	[0091.229] lstrlenW (lpString=".ptx") returned 4
	[0091.229] lstrcmpiW (lpString1=".ptx", lpString2="XLAM") returned -1
	[0091.229] lstrlenW (lpString=".pub") returned 4
	[0091.229] lstrcmpiW (lpString1=".pub", lpString2="XLAM") returned -1
	[0091.229] lstrlenW (lpString=".pwm") returned 4
	[0091.229] lstrcmpiW (lpString1=".pwm", lpString2="XLAM") returned -1
	[0091.229] lstrlenW (lpString=".pxr") returned 4
	[0091.229] lstrcmpiW (lpString1=".pxr", lpString2="XLAM") returned -1
	[0091.229] lstrlenW (lpString=".py") returned 3
	[0091.229] lstrcmpiW (lpString1=".py", lpString2="LAM") returned -1
	[0091.229] lstrlenW (lpString=".qt") returned 3
	[0091.229] lstrcmpiW (lpString1=".qt", lpString2="LAM") returned -1
	[0091.229] lstrlenW (lpString=".r3d") returned 4
	[0091.229] lstrcmpiW (lpString1=".r3d", lpString2="XLAM") returned -1
	[0091.229] lstrlenW (lpString=".raf") returned 4
	[0091.229] lstrcmpiW (lpString1=".raf", lpString2="XLAM") returned -1
	[0091.229] lstrlenW (lpString=".rar") returned 4
	[0091.229] lstrcmpiW (lpString1=".rar", lpString2="XLAM") returned -1
	[0091.229] lstrlenW (lpString=".raw") returned 4
	[0091.229] lstrcmpiW (lpString1=".raw", lpString2="XLAM") returned -1
	[0091.229] lstrlenW (lpString=".rdf") returned 4
	[0091.229] lstrcmpiW (lpString1=".rdf", lpString2="XLAM") returned -1
	[0091.230] lstrlenW (lpString=".rgbe") returned 5
	[0091.230] FindClose (in: hFindFile=0x3841890 | out: hFindFile=0x3841890) returned 1
	[0091.238] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3fc0008 | out: hHeap=0x5e0000) returned 1
	[0091.238] FindNextFileW (in: hFindFile=0x3841a10, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x62688, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1
	[0091.238] lstrlenW (lpString="EUROTOOL.XLAM") returned 13
	[0091.238] lstrlenW (lpString=".1cd") returned 4
	[0091.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*", lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841890
	[0091.240] FindNextFileW (in: hFindFile=0x3841890, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.240] FindNextFileW (in: hFindFile=0x3841890, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6c340, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER.XLAM", cAlternateFileName="SOLVER~1.XLA")) returned 1
	[0091.240] lstrlenW (lpString="SOLVER.XLAM") returned 11
	[0091.240] lstrlenW (lpString=".1cd") returned 4
	[0091.240] FindClose (in: hFindFile=0x3841890 | out: hFindFile=0x3841890) returned 1
	[0091.241] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3fc0008 | out: hHeap=0x5e0000) returned 1
	[0091.241] FindNextFileW (in: hFindFile=0x3841a10, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 0
	[0091.241] FindClose (in: hFindFile=0x3841a10 | out: hFindFile=0x3841a10) returned 1
	[0091.241] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f10060 | out: hHeap=0x5e0000) returned 1
	[0091.241] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x3edf58c | out: lpFindFileData=0x3edf58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5dfae80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xfafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGELEMS.DLL", cAlternateFileName="")) returned 1
	[0091.241] lstrlenW (lpString="LOGELEMS.DLL") returned 12
	[0091.241] lstrlenW (lpString=".1cd") returned 4
	[0091.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*", lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841910
	[0091.620] FindNextFileW (in: hFindFile=0x3841910, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.620] FindNextFileW (in: hFindFile=0x3841910, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPLAUSE.WAV", cAlternateFileName="")) returned 1
	[0091.620] lstrlenW (lpString="APPLAUSE.WAV") returned 12
	[0091.620] lstrlenW (lpString=".1cd") returned 4
	[0091.621] FindClose (in: hFindFile=0x3841910 | out: hFindFile=0x3841910) returned 1
	[0091.722] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f10060 | out: hHeap=0x5e0000) returned 1
	[0091.722] FindNextFileW (in: hFindFile=0x3841990, lpFindFileData=0x3edf58c | out: lpFindFileData=0x3edf58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f5000, ftCreationTime.dwHighDateTime=0x1cac037, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4f5000, ftLastWriteTime.dwHighDateTime=0x1cac037, nFileSizeHigh=0x0, nFileSizeLow=0x1c798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MI5659~1.DLL")) returned 1
	[0091.722] lstrlenW (lpString="Microsoft.BusinessData.dll") returned 26
	[0091.722] lstrlenW (lpString=".1cd") returned 4
	[0100.177] FindNextFileW (in: hFindFile=0x3841890, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0100.177] FindNextFileW (in: hFindFile=0x3841890, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0100.177] lstrlenW (lpString="resource.xml") returned 12
	[0100.177] lstrlenW (lpString=".1cd") returned 4
	[0103.888] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.888] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0103.889] lstrlenW (lpString="messages.json") returned 13
	[0103.889] lstrlenW (lpString=".1cd") returned 4
	[0103.889] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0103.889] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0103.889] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0103.889] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0103.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no") returned 137
	[0103.890] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0103.958] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.958] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0103.958] lstrlenW (lpString="messages.json") returned 13
	[0103.958] lstrlenW (lpString=".1cd") returned 4
	[0103.959] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0103.959] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0103.959] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0103.959] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0103.959] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl") returned 137
	[0103.959] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0103.966] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.966] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0103.966] lstrlenW (lpString="messages.json") returned 13
	[0103.966] lstrlenW (lpString=".1cd") returned 4
	[0103.967] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0103.967] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0103.967] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0103.967] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0103.967] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR") returned 140
	[0103.967] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0103.971] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.971] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0103.971] lstrlenW (lpString="messages.json") returned 13
	[0103.972] lstrlenW (lpString=".1cd") returned 4
	[0103.972] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0103.972] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0103.972] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0103.972] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0103.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT") returned 140
	[0103.972] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.011] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.011] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.011] lstrlenW (lpString="messages.json") returned 13
	[0104.011] lstrlenW (lpString=".1cd") returned 4
	[0104.011] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.011] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.011] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0104.011] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0104.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro") returned 137
	[0104.012] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.117] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.117] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.117] lstrlenW (lpString="messages.json") returned 13
	[0104.117] lstrlenW (lpString=".1cd") returned 4
	[0104.117] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.117] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.118] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0104.118] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0104.118] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru") returned 137
	[0104.118] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.128] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.128] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.128] lstrlenW (lpString="messages.json") returned 13
	[0104.128] lstrlenW (lpString=".1cd") returned 4
	[0104.129] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.129] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.129] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0104.129] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0104.129] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk") returned 137
	[0104.129] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.134] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.134] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.134] lstrlenW (lpString="messages.json") returned 13
	[0104.134] lstrlenW (lpString=".1cd") returned 4
	[0104.134] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.135] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.135] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0104.135] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0104.135] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl") returned 137
	[0104.135] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.198] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.198] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.198] lstrlenW (lpString="messages.json") returned 13
	[0104.198] lstrlenW (lpString=".1cd") returned 4
	[0104.198] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.198] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.198] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0104.198] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1
	[0104.198] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr") returned 137
	[0104.198] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.254] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.254] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.255] lstrlenW (lpString="messages.json") returned 13
	[0104.255] lstrlenW (lpString=".1cd") returned 4
	[0104.255] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.255] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.255] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0104.255] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0104.255] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv") returned 137
	[0104.255] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.273] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.273] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.273] lstrlenW (lpString="messages.json") returned 13
	[0104.273] lstrlenW (lpString=".1cd") returned 4
	[0104.274] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.274] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.274] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0104.274] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0104.274] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th") returned 137
	[0104.274] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.278] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.278] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.279] lstrlenW (lpString="messages.json") returned 13
	[0104.279] lstrlenW (lpString=".1cd") returned 4
	[0104.279] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.279] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.279] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0104.279] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0104.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr") returned 137
	[0104.279] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.304] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.305] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.305] lstrlenW (lpString="messages.json") returned 13
	[0104.305] lstrlenW (lpString=".1cd") returned 4
	[0104.305] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.305] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.305] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0104.305] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0104.310] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk") returned 137
	[0104.310] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.329] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.329] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.329] lstrlenW (lpString="messages.json") returned 13
	[0104.329] lstrlenW (lpString=".1cd") returned 4
	[0104.330] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.330] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.330] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0104.330] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0104.330] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi") returned 137
	[0104.330] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.351] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.351] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.351] lstrlenW (lpString="messages.json") returned 13
	[0104.351] lstrlenW (lpString=".1cd") returned 4
	[0104.351] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.351] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.352] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0104.352] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1
	[0104.352] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN") returned 140
	[0104.352] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841c50
	[0104.362] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.362] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.362] lstrlenW (lpString="messages.json") returned 13
	[0104.362] lstrlenW (lpString=".1cd") returned 4
	[0104.362] FindNextFileW (in: hFindFile=0x3841c50, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.362] FindClose (in: hFindFile=0x3841c50 | out: hFindFile=0x3841c50) returned 1
	[0104.362] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0104.362] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1
	[0104.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW") returned 140
	[0104.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3841d90
	[0104.384] FindNextFileW (in: hFindFile=0x3841d90, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.387] FindNextFileW (in: hFindFile=0x3841d90, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0104.387] lstrlenW (lpString="messages.json") returned 13
	[0104.387] lstrlenW (lpString=".1cd") returned 4
	[0104.387] FindNextFileW (in: hFindFile=0x3841d90, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0104.387] FindClose (in: hFindFile=0x3841d90 | out: hFindFile=0x3841d90) returned 1
	[0104.387] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30070 | out: hHeap=0x5e0000) returned 1
	[0104.387] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0
	[0104.387] FindClose (in: hFindFile=0x3841c90 | out: hFindFile=0x3841c90) returned 1
	[0104.388] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f10060 | out: hHeap=0x5e0000) returned 1
	[0104.390] FindNextFileW (in: hFindFile=0x3841ad0, lpFindFileData=0x3ede1ac | out: lpFindFileData=0x3ede1ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1
	[0104.391] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata") returned 135
	[0104.392] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.392] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x844eed30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1
	[0104.392] lstrlenW (lpString="computed_hashes.json") returned 20
	[0104.392] lstrlenW (lpString=".1cd") returned 4
	[0104.392] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1
	[0104.392] lstrlenW (lpString="verified_contents.json") returned 22
	[0104.392] lstrlenW (lpString=".1cd") returned 4
	[0104.392] FindNextFileW (in: hFindFile=0x3841c90, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0
	[0104.393] FindClose (in: hFindFile=0x3841c90 | out: hFindFile=0x3841c90) returned 1
	[0104.394] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f10060 | out: hHeap=0x5e0000) returned 1
	[0104.394] FindNextFileW (in: hFindFile=0x3841ad0, lpFindFileData=0x3ede1ac | out: lpFindFileData=0x3ede1ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0
	[0104.394] FindClose (in: hFindFile=0x3841ad0 | out: hFindFile=0x3841ad0) returned 1
	[0104.394] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x40b1078 | out: hHeap=0x5e0000) returned 1
	[0104.395] FindNextFileW (in: hFindFile=0x3841b50, lpFindFileData=0x3ede428 | out: lpFindFileData=0x3ede428*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1_0", cAlternateFileName="")) returned 0
	[0104.395] FindClose (in: hFindFile=0x3841b50 | out: hFindFile=0x3841b50) returned 1
	[0104.395] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x40a1070 | out: hHeap=0x5e0000) returned 1
	[0104.395] FindNextFileW (in: hFindFile=0x3841910, lpFindFileData=0x3ede6a4 | out: lpFindFileData=0x3ede6a4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1
	[0104.395] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi") returned 119
	[0104.438] FindNextFileW (in: hFindFile=0x3841cd0, lpFindFileData=0x3ede428 | out: lpFindFileData=0x3ede428*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.441] FindNextFileW (in: hFindFile=0x3841cd0, lpFindFileData=0x3ede428 | out: lpFindFileData=0x3ede428*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.4_0", cAlternateFileName="")) returned 1
	[0104.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0") returned 125

Thread:
	id = 65
	os_tid = 0xbc8


Thread:
	id = 66
	os_tid = 0xbcc


Process:
	id = "4"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x3888e000"
	os_pid = "0xb6c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0xb60"
	cmd_line = "\"C:\\Windows\\system32\\cmd.exe\""
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "64"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 48
	os_tid = 0xb70

	[0073.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afc70 | out: lpSystemTimeAsFileTime=0x1afc70*(dwLowDateTime=0x88cd2480, dwHighDateTime=0x1d59309)) 
	[0073.727] GetCurrentProcessId () returned 0xb6c
	[0073.727] GetCurrentThreadId () returned 0xb70
	[0073.727] GetTickCount () returned 0x1148a75
	[0073.727] QueryPerformanceCounter (in: lpPerformanceCount=0x1afc78 | out: lpPerformanceCount=0x1afc78*=19363554669) returned 1
	[0073.729] GetModuleHandleW (lpModuleName=0x0) returned 0x49de0000
	[0073.729] __set_app_type (_Type=0x1) 
	[0073.729] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e07810) returned 0x0
	[0073.729] __getmainargs (in: _Argc=0x49e2a608, _Argv=0x49e2a618, _Env=0x49e2a610, _DoWildCard=0, _StartInfo=0x49e0e0f4 | out: _Argc=0x49e2a608, _Argv=0x49e2a618, _Env=0x49e2a610) returned 0
	[0073.730] GetCurrentThreadId () returned 0xb70
	[0073.730] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb70) returned 0x3c
	[0073.873] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000
	[0073.873] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40
	[0073.873] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0073.873] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0073.873] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1afc08 | out: phkResult=0x1afc08*=0x0) returned 0x2
	[0073.874] VirtualQuery (in: lpAddress=0x1afbf0, lpBuffer=0x1afb70, dwLength=0x30 | out: lpBuffer=0x1afb70*(BaseAddress=0x1af000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0073.874] VirtualQuery (in: lpAddress=0xb0000, lpBuffer=0x1afb70, dwLength=0x30 | out: lpBuffer=0x1afb70*(BaseAddress=0xb0000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0073.874] VirtualQuery (in: lpAddress=0xb1000, lpBuffer=0x1afb70, dwLength=0x30 | out: lpBuffer=0x1afb70*(BaseAddress=0xb1000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0073.874] VirtualQuery (in: lpAddress=0xb4000, lpBuffer=0x1afb70, dwLength=0x30 | out: lpBuffer=0x1afb70*(BaseAddress=0xb4000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0073.874] VirtualQuery (in: lpAddress=0x1b0000, lpBuffer=0x1afb70, dwLength=0x30 | out: lpBuffer=0x1afb70*(BaseAddress=0x1b0000, AllocationBase=0x1b0000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30
	[0073.874] GetConsoleOutputCP () returned 0x1b5
	[0073.874] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e1bfe0 | out: lpCPInfo=0x49e1bfe0) returned 1
	[0073.874] SetConsoleCtrlHandler (HandlerRoutine=0x49e03184, Add=1) returned 1
	[0073.875] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.875] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0
	[0073.875] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.875] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x49e0e194 | out: lpMode=0x49e0e194) returned 0
	[0073.875] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.875] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x49e0e198 | out: lpMode=0x49e0e198) returned 0
	[0073.875] GetEnvironmentStringsW () returned 0x3b8e00*
	[0073.875] GetProcessHeap () returned 0x3a0000
	[0073.875] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xd04) returned 0x3b9b10
	[0073.875] FreeEnvironmentStringsW (penv=0x3b8e00) returned 1
	[0073.875] GetProcessHeap () returned 0x3a0000
	[0073.876] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3b8680
	[0073.876] GetEnvironmentStringsW () returned 0x3b8e00*
	[0073.876] GetProcessHeap () returned 0x3a0000
	[0073.876] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xd04) returned 0x3ba820
	[0073.876] FreeEnvironmentStringsW (penv=0x3b8e00) returned 1
	[0073.876] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1aeac8 | out: phkResult=0x1aeac8*=0x44) returned 0x0
	[0073.876] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1aeac0, lpData=0x1aeae0, lpcbData=0x1aeac4*=0x1000 | out: lpType=0x1aeac0*=0x0, lpData=0x1aeae0*=0x18, lpcbData=0x1aeac4*=0x1000) returned 0x2
	[0073.876] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1aeac0, lpData=0x1aeae0, lpcbData=0x1aeac4*=0x1000 | out: lpType=0x1aeac0*=0x4, lpData=0x1aeae0*=0x1, lpcbData=0x1aeac4*=0x4) returned 0x0
	[0073.876] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1aeac0, lpData=0x1aeae0, lpcbData=0x1aeac4*=0x1000 | out: lpType=0x1aeac0*=0x0, lpData=0x1aeae0*=0x1, lpcbData=0x1aeac4*=0x1000) returned 0x2
	[0073.876] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1aeac0, lpData=0x1aeae0, lpcbData=0x1aeac4*=0x1000 | out: lpType=0x1aeac0*=0x4, lpData=0x1aeae0*=0x0, lpcbData=0x1aeac4*=0x4) returned 0x0
	[0073.876] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1aeac0, lpData=0x1aeae0, lpcbData=0x1aeac4*=0x1000 | out: lpType=0x1aeac0*=0x4, lpData=0x1aeae0*=0x40, lpcbData=0x1aeac4*=0x4) returned 0x0
	[0073.876] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1aeac0, lpData=0x1aeae0, lpcbData=0x1aeac4*=0x1000 | out: lpType=0x1aeac0*=0x4, lpData=0x1aeae0*=0x40, lpcbData=0x1aeac4*=0x4) returned 0x0
	[0073.876] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1aeac0, lpData=0x1aeae0, lpcbData=0x1aeac4*=0x1000 | out: lpType=0x1aeac0*=0x0, lpData=0x1aeae0*=0x40, lpcbData=0x1aeac4*=0x1000) returned 0x2
	[0073.876] RegCloseKey (hKey=0x44) returned 0x0
	[0073.876] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1aeac8 | out: phkResult=0x1aeac8*=0x44) returned 0x0
	[0073.877] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1aeac0, lpData=0x1aeae0, lpcbData=0x1aeac4*=0x1000 | out: lpType=0x1aeac0*=0x0, lpData=0x1aeae0*=0x40, lpcbData=0x1aeac4*=0x1000) returned 0x2
	[0073.877] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1aeac0, lpData=0x1aeae0, lpcbData=0x1aeac4*=0x1000 | out: lpType=0x1aeac0*=0x4, lpData=0x1aeae0*=0x1, lpcbData=0x1aeac4*=0x4) returned 0x0
	[0073.877] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1aeac0, lpData=0x1aeae0, lpcbData=0x1aeac4*=0x1000 | out: lpType=0x1aeac0*=0x0, lpData=0x1aeae0*=0x1, lpcbData=0x1aeac4*=0x1000) returned 0x2
	[0073.877] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1aeac0, lpData=0x1aeae0, lpcbData=0x1aeac4*=0x1000 | out: lpType=0x1aeac0*=0x4, lpData=0x1aeae0*=0x0, lpcbData=0x1aeac4*=0x4) returned 0x0
	[0073.877] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1aeac0, lpData=0x1aeae0, lpcbData=0x1aeac4*=0x1000 | out: lpType=0x1aeac0*=0x4, lpData=0x1aeae0*=0x9, lpcbData=0x1aeac4*=0x4) returned 0x0
	[0073.877] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1aeac0, lpData=0x1aeae0, lpcbData=0x1aeac4*=0x1000 | out: lpType=0x1aeac0*=0x4, lpData=0x1aeae0*=0x9, lpcbData=0x1aeac4*=0x4) returned 0x0
	[0073.877] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1aeac0, lpData=0x1aeae0, lpcbData=0x1aeac4*=0x1000 | out: lpType=0x1aeac0*=0x0, lpData=0x1aeae0*=0x9, lpcbData=0x1aeac4*=0x1000) returned 0x2
	[0073.877] RegCloseKey (hKey=0x44) returned 0x0
	[0073.877] time (in: timer=0x0 | out: timer=0x0) returned 0x5dc0165b
	[0073.877] srand (_Seed=0x5dc0165b) 
	[0073.877] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\""
	[0073.877] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\""
	[0073.877] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e1c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0073.877] GetProcessHeap () returned 0x3a0000
	[0073.877] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x218) returned 0x3bb530
	[0073.878] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3bb540, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0073.878] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e0f360, nSize=0x2000 | out: lpBuffer="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x91
	[0073.878] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e0f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0073.878] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e0f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0073.878] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0073.878] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0073.878] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0073.878] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0073.878] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0073.878] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0073.878] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0073.878] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0073.878] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0073.878] GetProcessHeap () returned 0x3a0000
	[0073.878] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b9b10 | out: hHeap=0x3a0000) returned 1
	[0073.878] GetEnvironmentStringsW () returned 0x3b8e00*
	[0073.878] GetProcessHeap () returned 0x3a0000
	[0073.878] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xd1c) returned 0x3bb750
	[0073.878] FreeEnvironmentStringsW (penv=0x3b8e00) returned 1
	[0073.878] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e0f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0073.878] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e0f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0073.879] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0073.879] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0073.879] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0073.879] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0073.879] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0073.879] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0073.879] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0073.879] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0073.879] GetProcessHeap () returned 0x3a0000
	[0073.879] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x5c) returned 0x3bc480
	[0073.879] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1af8d0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0073.879] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1af8d0, lpFilePart=0x1af8b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af8b0*="Desktop") returned 0x25
	[0073.879] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0073.879] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1af5e0 | out: lpFindFileData=0x1af5e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa30001a2, cFileName="Users", cAlternateFileName="")) returned 0x3b8c60
	[0073.879] FindClose (in: hFindFile=0x3b8c60 | out: hFindFile=0x3b8c60) returned 1
	[0073.879] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1af5e0 | out: lpFindFileData=0x1af5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa30001a2, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x3b8c60
	[0073.880] FindClose (in: hFindFile=0x3b8c60 | out: hFindFile=0x3b8c60) returned 1
	[0073.880] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20
	[0073.880] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1af5e0 | out: lpFindFileData=0x1af5e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7dee7d20, ftLastAccessTime.dwHighDateTime=0x1d59309, ftLastWriteTime.dwLowDateTime=0x7dee7d20, ftLastWriteTime.dwHighDateTime=0x1d59309, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa30001a2, cFileName="Desktop", cAlternateFileName="")) returned 0x3b8c60
	[0073.880] FindClose (in: hFindFile=0x3b8c60 | out: hFindFile=0x3b8c60) returned 1
	[0073.880] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0073.880] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1
	[0073.880] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0073.880] GetProcessHeap () returned 0x3a0000
	[0073.880] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bb750 | out: hHeap=0x3a0000) returned 1
	[0073.880] GetEnvironmentStringsW () returned 0x3bc4f0*
	[0073.881] GetProcessHeap () returned 0x3a0000
	[0073.881] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xd70) returned 0x3bd270
	[0073.881] FreeEnvironmentStringsW (penv=0x3bc4f0) returned 1
	[0073.881] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e1c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0073.881] GetProcessHeap () returned 0x3a0000
	[0073.881] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc480 | out: hHeap=0x3a0000) returned 1
	[0073.881] GetProcessHeap () returned 0x3a0000
	[0073.881] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x4016) returned 0x3bdff0
	[0073.881] GetProcessHeap () returned 0x3a0000
	[0073.881] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bdff0 | out: hHeap=0x3a0000) returned 1
	[0073.881] GetConsoleOutputCP () returned 0x1b5
	[0073.882] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e1bfe0 | out: lpCPInfo=0x49e1bfe0) returned 1
	[0073.882] GetUserDefaultLCID () returned 0x409
	[0073.882] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e17b50, cchData=8 | out: lpLCData=":") returned 2
	[0073.883] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1af9e0, cchData=128 | out: lpLCData="0") returned 2
	[0073.883] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1af9e0, cchData=128 | out: lpLCData="0") returned 2
	[0073.883] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1af9e0, cchData=128 | out: lpLCData="1") returned 2
	[0073.883] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e2a740, cchData=8 | out: lpLCData="/") returned 2
	[0073.883] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e2a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0073.883] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e2a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0073.883] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e2a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0073.883] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e2a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0073.883] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e2a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0073.883] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e2a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0073.883] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e2a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0073.883] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e17b40, cchData=8 | out: lpLCData=".") returned 2
	[0073.883] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e2a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0073.883] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0073.884] GetProcessHeap () returned 0x3a0000
	[0073.884] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x0, Size=0x20c) returned 0x3b9bf0
	[0073.885] GetConsoleTitleW (in: lpConsoleTitle=0x3b9bf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0073.885] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.885] GetFileType (hFile=0xf4) returned 0x3
	[0073.885] BrandingFormatString () returned 0x3ba780
	[0073.892] GetVersion () returned 0x1db10106
	[0073.892] _vsnwprintf (in: _Buffer=0x1afb50, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1afae8 | out: _Buffer="6.1.7601") returned 8
	[0073.892] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.892] GetFileType (hFile=0xf4) returned 0x3
	[0073.892] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49e26340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0073.892] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49e26340, nSize=0x2000, Arguments=0x1afaf0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24
	[0073.892] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.893] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x49e1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37
	[0073.893] WriteFile (in: hFile=0xf4, lpBuffer=0x49e1c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1afa78, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesWritten=0x1afa78*=0x24, lpOverlapped=0x0) returned 1
	[0073.893] _vsnwprintf (in: _Buffer=0x49e26340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1afb18 | out: _Buffer="\r\n") returned 2
	[0073.893] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.893] GetFileType (hFile=0xf4) returned 0x3
	[0073.893] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.893] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49e1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0073.893] WriteFile (in: hFile=0xf4, lpBuffer=0x49e1c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1afae8, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesWritten=0x1afae8*=0x2, lpOverlapped=0x0) returned 1
	[0073.893] _vsnwprintf (in: _Buffer=0x49e26340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1afb18 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.") returned 63
	[0073.893] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.893] GetFileType (hFile=0xf4) returned 0x3
	[0073.893] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.893] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x49e1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.", lpUsedDefaultChar=0x0) returned 64
	[0073.893] WriteFile (in: hFile=0xf4, lpBuffer=0x49e1c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x1afae8, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesWritten=0x1afae8*=0x3f, lpOverlapped=0x0) returned 1
	[0073.893] _vsnwprintf (in: _Buffer=0x49e26340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1afb18 | out: _Buffer="\r\n") returned 2
	[0073.893] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.893] GetFileType (hFile=0xf4) returned 0x3
	[0073.893] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.893] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49e1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0073.894] WriteFile (in: hFile=0xf4, lpBuffer=0x49e1c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1afae8, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesWritten=0x1afae8*=0x2, lpOverlapped=0x0) returned 1
	[0073.894] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000
	[0073.894] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0
	[0073.894] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290
	[0073.894] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0
	[0073.894] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.894] GetFileType (hFile=0xe8) returned 0x3
	[0073.895] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0073.895] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1af940 | out: TokenHandle=0x1af940*=0x0) returned 0xc000007c
	[0073.895] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1af940 | out: TokenHandle=0x1af940*=0x50) returned 0x0
	[0073.895] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x1af950, TokenInformationLength=0x4, ReturnLength=0x1af958 | out: TokenInformation=0x1af950, ReturnLength=0x1af958) returned 0x0
	[0073.895] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x1af958, TokenInformationLength=0x4, ReturnLength=0x1af950 | out: TokenInformation=0x1af958, ReturnLength=0x1af950) returned 0x0
	[0073.895] NtClose (Handle=0x50) returned 0x0
	[0073.895] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x1af920, nSize=0x0, Arguments=0x1af928 | out: lpBuffer="廀;") returned 0xf
	[0073.895] GetProcessHeap () returned 0x3a0000
	[0073.895] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x218) returned 0x3a1320
	[0073.895] GetConsoleTitleW (in: lpConsoleTitle=0x1af970, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0073.896] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0
	[0073.896] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1
	[0073.897] GetProcessHeap () returned 0x3a0000
	[0073.897] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3a1320 | out: hHeap=0x3a0000) returned 1
	[0073.897] LocalFree (hMem=0x3b5ec0) returned 0x0
	[0073.897] GetProcessHeap () returned 0x3a0000
	[0073.897] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bb530 | out: hHeap=0x3a0000) returned 1
	[0073.897] _vsnwprintf (in: _Buffer=0x49e26340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af658 | out: _Buffer="\r\n") returned 2
	[0073.897] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.897] GetFileType (hFile=0xf4) returned 0x3
	[0073.897] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.898] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49e1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0073.898] WriteFile (in: hFile=0xf4, lpBuffer=0x49e1c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af628, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesWritten=0x1af628*=0x2, lpOverlapped=0x0) returned 1
	[0073.898] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e0f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0073.898] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e1c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0073.898] _vsnwprintf (in: _Buffer=0x49e0eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af668 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37
	[0073.898] _vsnwprintf (in: _Buffer=0x49e0ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af668 | out: _Buffer=">") returned 1
	[0073.898] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.898] GetFileType (hFile=0xf4) returned 0x3
	[0073.898] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.898] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49e1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39
	[0073.898] WriteFile (in: hFile=0xf4, lpBuffer=0x49e1c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af658, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesWritten=0x1af658*=0x26, lpOverlapped=0x0) returned 1
	[0073.898] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.898] GetFileType (hFile=0xe8) returned 0x3
	[0073.898] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.898] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.898] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.899] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0073.899] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.900] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.900] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.900] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0073.900] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.900] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.900] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.900] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0073.900] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.900] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.900] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.900] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0073.900] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.900] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.900] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.900] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0073.900] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.900] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.900] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.900] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0073.900] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.900] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.901] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.901] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0073.901] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.901] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.901] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.901] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0073.901] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.901] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.901] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.901] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0073.901] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.901] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.901] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.901] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0073.901] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.901] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.901] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.901] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0073.901] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.901] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.902] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.902] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0073.902] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.902] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.902] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.902] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0073.902] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.902] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.902] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.902] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0073.902] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.902] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.902] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.902] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0073.902] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.902] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.902] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.902] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0073.902] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.903] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.903] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.903] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0073.903] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.903] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.903] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.903] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0073.903] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.903] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.903] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.903] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1
	[0073.903] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.903] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.903] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.903] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0073.903] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.903] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.903] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.903] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1
	[0073.903] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.903] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.904] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.904] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1
	[0073.904] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.904] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.904] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.904] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0073.904] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.904] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.904] ReadFile (in: hFile=0xe8, lpBuffer=0x49e1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesRead=0x1af958*=0x1, lpOverlapped=0x0) returned 1
	[0073.904] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e1c320, cbMultiByte=1, lpWideCharStr=0x49e1e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0073.905] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.905] GetFileType (hFile=0xe8) returned 0x3
	[0073.905] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0073.905] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0073.905] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.905] GetFileType (hFile=0xf4) returned 0x3
	[0073.905] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0073.905] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x49e1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25
	[0073.905] WriteFile (in: hFile=0xf4, lpBuffer=0x49e1c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x1af938, lpOverlapped=0x0 | out: lpBuffer=0x49e1c320*, lpNumberOfBytesWritten=0x1af938*=0x18, lpOverlapped=0x0) returned 1
	[0073.905] GetProcessHeap () returned 0x3a0000
	[0073.905] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x4012) returned 0x3bdff0
	[0073.905] GetProcessHeap () returned 0x3a0000
	[0073.905] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bdff0 | out: hHeap=0x3a0000) returned 1
	[0073.906] _wcsicmp (_String1="mode", _String2=")") returned 68
	[0073.906] _wcsicmp (_String1="FOR", _String2="mode") returned -7
	[0073.906] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7
	[0073.906] _wcsicmp (_String1="IF", _String2="mode") returned -4
	[0073.906] _wcsicmp (_String1="IF/?", _String2="mode") returned -4
	[0073.906] _wcsicmp (_String1="REM", _String2="mode") returned 5
	[0073.906] _wcsicmp (_String1="REM/?", _String2="mode") returned 5
	[0073.906] GetProcessHeap () returned 0x3a0000
	[0073.906] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xb0) returned 0x3b5ec0
	[0073.906] GetProcessHeap () returned 0x3a0000
	[0073.906] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x1a) returned 0x3b48e0
	[0073.907] GetProcessHeap () returned 0x3a0000
	[0073.907] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x38) returned 0x3b68c0
	[0073.908] GetConsoleOutputCP () returned 0x1b5
	[0073.908] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e1bfe0 | out: lpCPInfo=0x49e1bfe0) returned 1
	[0073.909] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0073.909] GetConsoleTitleW (in: lpConsoleTitle=0x1af8f0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0073.909] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0073.909] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0073.909] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0073.909] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0073.909] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0073.909] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0073.909] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0073.909] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0073.909] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0073.909] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0073.909] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0073.909] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0073.910] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0073.910] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0073.910] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0073.910] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0073.910] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0073.910] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0073.910] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0073.910] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0073.910] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0073.910] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0073.910] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0073.910] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0073.910] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0073.910] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0073.910] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0073.910] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0073.910] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0073.910] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0073.910] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0073.910] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0073.910] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0073.910] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0073.910] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0073.910] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0073.910] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0073.910] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0073.910] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0073.910] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0073.910] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0073.911] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0073.911] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0073.911] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0073.911] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0073.911] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0073.911] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0073.911] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0073.911] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0073.911] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0073.911] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0073.911] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0073.911] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0073.911] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0073.911] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0073.911] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0073.911] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0073.911] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0073.911] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0073.911] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0073.911] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0073.911] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0073.911] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0073.911] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0073.911] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0073.911] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0073.911] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0073.911] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0073.911] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0073.911] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0073.911] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0073.912] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0073.912] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0073.912] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0073.912] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0073.912] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0073.912] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0073.912] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0073.912] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0073.912] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0073.912] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0073.912] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0073.912] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0073.912] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0073.912] _wcsicmp (_String1="mode", _String2="FOR") returned 7
	[0073.912] _wcsicmp (_String1="mode", _String2="IF") returned 4
	[0073.912] _wcsicmp (_String1="mode", _String2="REM") returned -5
	[0073.912] GetProcessHeap () returned 0x3a0000
	[0073.912] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x218) returned 0x3a1320
	[0073.912] GetProcessHeap () returned 0x3a0000
	[0073.912] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x42) returned 0x3b8c60
	[0073.913] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10
	[0073.913] GetProcessHeap () returned 0x3a0000
	[0073.913] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x420) returned 0x3a1540
	[0073.913] SetErrorMode (uMode=0x0) returned 0x0
	[0073.913] SetErrorMode (uMode=0x1) returned 0x0
	[0073.913] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3a1550, lpFilePart=0x1af180 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af180*="Desktop") returned 0x25
	[0073.913] SetErrorMode (uMode=0x0) returned 0x1
	[0073.913] GetProcessHeap () returned 0x3a0000
	[0073.913] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3a1540, Size=0x66) returned 0x3a1540
	[0073.913] GetProcessHeap () returned 0x3a0000
	[0073.913] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3a1540) returned 0x66
	[0073.913] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e0f360, nSize=0x2000 | out: lpBuffer="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x91
	[0073.913] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0073.913] GetProcessHeap () returned 0x3a0000
	[0073.914] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x184) returned 0x3a15c0
	[0073.914] GetProcessHeap () returned 0x3a0000
	[0073.914] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x2f8) returned 0x3a1750
	[0073.921] GetProcessHeap () returned 0x3a0000
	[0073.921] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3a1750, Size=0x186) returned 0x3a1750
	[0073.921] GetProcessHeap () returned 0x3a0000
	[0073.921] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3a1750) returned 0x186
	[0073.921] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e0f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0073.921] GetProcessHeap () returned 0x3a0000
	[0073.921] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xe8) returned 0x3b5f80
	[0073.921] GetProcessHeap () returned 0x3a0000
	[0073.921] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3b5f80, Size=0x7e) returned 0x3b5f80
	[0073.921] GetProcessHeap () returned 0x3a0000
	[0073.921] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5f80) returned 0x7e
	[0073.923] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0073.923] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x1aeef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aeef0) returned 0xffffffffffffffff
	[0073.923] GetLastError () returned 0x2
	[0073.923] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x1aeef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aeef0) returned 0xffffffffffffffff
	[0073.923] GetLastError () returned 0x2
	[0073.924] FindFirstFileExW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x1aeef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aeef0) returned 0xffffffffffffffff
	[0073.924] GetLastError () returned 0x3
	[0073.924] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0073.924] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x1aeef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aeef0) returned 0x3b6010
	[0073.924] GetProcessHeap () returned 0x3a0000
	[0073.924] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x0, Size=0x28) returned 0x3b4910
	[0073.924] FindClose (in: hFindFile=0x3b6010 | out: hFindFile=0x3b6010) returned 1
	[0073.924] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x1aeef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aeef0) returned 0x3b6010
	[0073.924] GetProcessHeap () returned 0x3a0000
	[0073.924] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3b4910, Size=0x8) returned 0x3b6070
	[0073.925] FindClose (in: hFindFile=0x3b6010 | out: hFindFile=0x3b6010) returned 1
	[0073.925] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1
	[0073.925] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2
	[0073.925] GetConsoleTitleW (in: lpConsoleTitle=0x1af440, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0073.925] GetProcessHeap () returned 0x3a0000
	[0073.925] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x21c) returned 0x3a18f0
	[0073.925] GetConsoleTitleW (in: lpConsoleTitle=0x3a1900, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0073.925] GetProcessHeap () returned 0x3a0000
	[0073.925] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3a18f0, Size=0xa8) returned 0x3a18f0
	[0073.925] GetProcessHeap () returned 0x3a0000
	[0073.925] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3a18f0) returned 0xa8
	[0073.925] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode  con cp select=1251") returned 1
	[0073.926] GetProcessHeap () returned 0x3a0000
	[0073.926] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3a18f0 | out: hHeap=0x3a0000) returned 1
	[0073.926] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af1f8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af1b8 | out: lpAttributeList=0x1af1f8, lpSize=0x1af1b8) returned 1
	[0073.926] UpdateProcThreadAttribute (in: lpAttributeList=0x1af1f8, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af1a8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af1f8, lpPreviousValue=0x0) returned 1
	[0073.926] GetStartupInfoW (in: lpStartupInfo=0x1af310 | out: lpStartupInfo=0x1af310*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) 
	[0073.926] GetProcessHeap () returned 0x3a0000
	[0073.926] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x20) returned 0x3b4910
	[0073.926] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38
	[0073.926] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0073.926] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0073.926] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0073.926] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0073.926] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0073.926] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0073.926] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="Path=%S", _MaxCount=0x7) returned -13
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="PSExecu", _MaxCount=0x7) returned -13
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="sfxcmd=", _MaxCount=0x7) returned -16
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="sfxname", _MaxCount=0x7) returned -16
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="sfxpar=", _MaxCount=0x7) returned -16
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="sfxstim", _MaxCount=0x7) returned -16
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0073.927] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0073.928] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0073.928] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0073.928] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0073.928] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0073.928] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0073.928] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0073.928] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0073.928] GetProcessHeap () returned 0x3a0000
	[0073.928] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b4910 | out: hHeap=0x3a0000) returned 1
	[0073.928] GetProcessHeap () returned 0x3a0000
	[0073.928] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x12) returned 0x3b6010
	[0073.928] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode  con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af230*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode  con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af1e0 | out: lpCommandLine="mode  con cp select=1251", lpProcessInformation=0x1af1e0*(hProcess=0x54, hThread=0x50, dwProcessId=0xbc0, dwThreadId=0xbc4)) returned 1
	[0073.938] CloseHandle (hObject=0x50) returned 1
	[0073.938] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0073.938] GetProcessHeap () returned 0x3a0000
	[0073.938] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd270 | out: hHeap=0x3a0000) returned 1
	[0073.939] GetEnvironmentStringsW () returned 0x3bb530*
	[0073.939] GetProcessHeap () returned 0x3a0000
	[0073.939] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xd70) returned 0x3bc2b0
	[0073.939] FreeEnvironmentStringsW (penv=0x3bb530) returned 1
	[0073.939] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000
	[0073.939] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0
	[0073.939] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aeae8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aeae8, ReturnLength=0x0) returned 0x0
	[0073.939] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeb20, nSize=0x380, lpNumberOfBytesRead=0x1aeae0 | out: lpBuffer=0x1aeb20*, lpNumberOfBytesRead=0x1aeae0*=0x380) returned 1
	[0073.940] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) 

Process:
	id = "5"
	image_name = "mode.com"
	filename = "c:\\windows\\system32\\mode.com"
	page_root = "0x38648000"
	os_pid = "0xbc0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0xb6c"
	cmd_line = "mode  con cp select=1251"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "64"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 64
	os_tid = 0xbc4